The Consent Manager model seeks to shift the balance of power in the data economy towards the individual. Critically examine in the context of the DPDP framework.

The DPDP Act, 2023 gives statutory form to the right to privacy recognised in Puttaswamy (2017), and consent is at its centre. Since 13 November 2026, Consent Managers can register with the Data Protection Board of India (DPBI). They are intermediaries accountable to the Data Principal [1]. The model gives individuals more power over private firms but much less over the State.

How the model empowers the individual

• Loyalty to the user: the Consent Manager answers to the Data Principal, not the Data Fiduciary. One platform lets users give, review and withdraw consent, which reduces consent fatigue [1].
• Interoperability: the platform must be interoperable [1]. This fits India's DPI approach and prevents users being locked into one firm.
• Trust filters: only Indian-incorporated companies with a ₹2 crore net worth can register, and the DPBI publishes a public list of registered firms [1].
• Tested model: RBI Account Aggregators cannot share financial data without explicit consent recorded in a standard consent artefact [4].

Limits to the shift

• State exemptions: PRS flags wide exemptions for processing by the State and notes that government agencies need not delete data once its purpose is met [3]. Where the State needs no consent, a consent dashboard gives the user nothing to withdraw.
• Regulator's independence: the central government sets up the Board, and members can be re-appointed, which may weaken its independence [3]. A 4-member Board [2] must handle registration and, from May 2027, enforcement too [1].
• Enforcement lag: Fiduciaries' obligations and the Board's penalty powers start only on 13 May 2027 [1]. Until then, registered Consent Managers have no penalties behind them and few users.
• Undefined standard: no common consent format has been published, unlike RBI's Directions [4]. The ₹2 crore floor, borrowed from Account Aggregators [4], may also keep out start-ups.
• Missing rights: the law has no data portability or right to be forgotten [3].

The Consent Manager model does shift power towards the individual in the private data economy, but that shift stops where State processing begins. To make it real, MeitY and the DPBI should use the time before penalties begin to publish a common consent artefact. The Board's capacity and security of tenure should be strengthened, and State exemptions narrowed in line with Puttaswamy's proportionality test. Done together, these steps would turn consent into real informational self-determination under Article 21.