DPDPA's Consent Fiction: Why Granular Toggles Aren't Granular Consent

Most consent interfaces built in the last two years look genuinely careful: separate toggles for marketing, analytics, and third-party sharing, each with its own explanation. This is real progress over the single blanket "I agree" checkbox it replaced. But a consent interface's design tells you nothing about whether the systems underneath it actually differentiate processing by purpose — and that gap is where DPDPA compliance programs most commonly fail in practice, not in the visible layer regulators and users actually see first.

The pattern is consistent: a product team designs a genuinely granular front-end, and a backend built earlier — often years earlier, before DPDPA existed — gates all processing behind a single internal flag. A user who declines marketing consent is, in practice, still having their data processed for that exact purpose, because no engineering work was ever done to make the granular toggles actually control granular data flows downstream.

A consent screen is what a user sees. A consent architecture is whether the backend actually behaves accordingly. Section 8 obligations attach to the latter, and an audit will look at the latter.

This matters because Section 8's data fiduciary obligations require processing to actually be limited to the specified, consented purpose — not merely disclosed as limited. A cosmetically granular consent screen sitting on top of an ungranular backend does not satisfy that requirement; it creates a false paper trail that makes the eventual finding worse, because it shows the company represented a capability it did not have.

The fix is not a policy rewrite. It requires data flows to be tagged by purpose at the point of collection, with that tagging actually enforced at every downstream system that touches the data — marketing automation, analytics pipelines, third-party integrations. This is meaningfully harder and slower than updating a consent screen, which is exactly why so many companies stop at the visible layer and assume the work is done.