At a glanceUnder India’s DPDP Act, consent must be a clear, affirmative action — so a pre-ticked box, silence, “by continuing you agree,” or a single bundled “I agree” doesn’t count. Good consent design does the opposite: unticked opt-ins the person actively ticks, one purpose per opt-in, plain language, and an easy withdrawal. If a person could end up “consenting” without doing anything, the design has failed. This is about the how of asking — the interface and wording, not just the legal notice.
Educational resource only. This explains consent design under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.
The situation
For years, the default web pattern was a pre-checked “keep me updated” box and an “I agree” bundled into signup. The DPDP Act’s consent standard makes those patterns invalid — the consent they “collect” isn’t real. Fixing the design is often a small UI change with a large compliance payoff.
Why pre-ticked and “by continuing” fail
Consent has to be something the person actively does — never something they fail to undo. The Act requires consent by a clear affirmative action (Section 6). That single requirement invalidates the common shortcuts: a pre-ticked box collects agreement from inaction; “by continuing, you agree” infers consent from using the site; and a buried blanket tick doesn’t reflect a specific, deliberate yes. In each, the person could end up “consenting” without ever choosing to — which is exactly what the standard rules out.
The dark patterns to drop
These designs manufacture consent instead of obtaining it — retire them.
- Pre-ticked checkboxes (opt-out by default).
- “By continuing / signing up, you agree” as a stand-in for a real opt-in.
- One bundled “I agree” covering several unrelated purposes.
- Confirmshaming — guilt-tripping language on the decline option (“No, I don’t want to save money”).
- Unequal buttons — a big bright “Accept all” next to a hidden or greyed “Manage.”
- A withdrawal path far harder than the opt-in was.
What good consent design looks like
Make the affirmative action real, specific, and as easy to reverse as to give. The design principles:
- Unticked opt-ins the person actively selects.
- One purpose per opt-in — separate toggles for separate uses.
- Plain-language labels that name the purpose (“Send me offers by SMS”), not legalese.
- Balanced choices — accept and decline given equal visual weight; no manipulation.
- Withdrawal as easy as consent — if one tap turned it on, one tap turns it off.
- The notice right there — the person sees what they’re agreeing to as they agree.
Good consent design isn’t a compliance tax; a clear, honest ask tends to build more trust than a tricked one.
A quick self-test
Run each consent moment through three questions. If any answer is wrong, redesign it:
- Could the person “consent” without doing anything? (If yes — pre-ticked or inferred — it fails.)
- Does each purpose have its own opt-in? (If it’s one bundled tick — it fails.)
- Is withdrawing as easy as agreeing was? (If withdrawal is buried — it fails.)
FAQ
Are pre-ticked consent boxes illegal under the DPDP Act?
They don’t produce valid consent — the Act requires a clear affirmative action, and a pre-ticked box collects agreement from inaction. So relying on them fails the standard.
Is “by continuing you agree” enough?
No. Inferring consent from someone using your site or continuing isn’t a clear, specific opt-in. You need an actual affirmative action tied to the stated purpose.
What’s the simplest fix for a non-compliant signup?
Replace pre-ticked/bundled agrees with separate, unticked opt-ins per purpose, in plain language, with an easy withdrawal. It’s usually a small UI change.
Are dark patterns specifically banned?
The Act’s requirement for free, specific, unambiguous consent by clear affirmative action rules out designs that manufacture or pressure consent — which is what dark patterns do.