1. Executive Summary: The Consent Architecture

Section 6 is the crown jewel of the DPDPA 2023. While Section 4 establishes that processing requires consent or legitimate use, Section 6 defines what valid consent actually means.

This is not mere formality - it's the difference between meaningful choice and manufactured compliance.

1.1 The Six Pillars of Valid Consent

Section 6(1) establishes six mandatory characteristics. ALL six must be present simultaneously for consent to be valid:

Critical Point: These are cumulative requirements, not alternatives. Consent that satisfies 5 out of 6 is still invalid.

1.2 The FISU-UW Mnemonic

Remember valid consent with: FISU-UW

• Free
• Informed
• Specific
• Unconditional
• Unambiguous
• Withdrawable

If your consent request doesn't pass the FISU-UW test, you're in violation.

2. Philosophical Foundations: Autonomy & Agency

2.1 Kant's Categorical Imperative

Immanuel Kant argued that autonomy - the capacity for self-governance - is what makes humans worthy of moral respect.

Application to Section 6: When you obtain consent through deception, coercion, or manipulation, you violate the person's autonomy. You treat them as a means (a source of data) rather than an end (an autonomous agent).

Section 6's requirement that consent be "free" and "informed" implements Kantian respect for autonomy.

2.2 John Locke's Theory of Property Rights

John Locke argued that individuals have property rights in their own person and labor.

Locke, Second Treatise of Government (1689): "Every man has a property in his own person."

Extension to Data: Personal data is an extension of personhood. Processing personal data without valid consent is akin to taking someone's property without permission - it's data theft, not data processing.

2.3 Mill's Harm Principle and Paternalism

John Stuart Mill argued against paternalism - the idea that authority figures can override individual choices "for their own good."

Mill, On Liberty (1859): "Over himself, over his own body and mind, the individual is sovereign."

Section 6's Brilliance: It doesn't prohibit data processing. It requires genuine consent - respecting Mill's principle that individuals should control their own information.

Exception: Section 6(2) allows parental consent for children - a justified form of paternalism protecting those who cannot protect themselves.

2.4 Behavioral Economics: The Reality of Choice

Daniel Kahneman's Insight: Humans use mental shortcuts (heuristics) that can be exploited.

Richard Thaler's Nudge Theory: Small changes in how choices are presented can dramatically affect decisions - even when people think they're choosing freely.

Dan Ariely's Research: In "Predictably Irrational" (2008), Ariely showed that:

• Default options are chosen 70-90% of the time
• People rarely read terms & conditions
• Irrelevant options influence choices

Section 6(1)(a)'s Genius: By prohibiting "deceptive or manipulative practices," Section 6 protects against exploitation of these cognitive biases.

2.5 Academic Research on Consent

Key Studies:

1. Acquisti et al. (2015) - "Privacy and Human Behavior in the Age of Information" Science, Vol. 347(6221).

Found that privacy decisions are context-dependent, influenced by framing, and subject to immediate gratification bias.

2. Balebako et al. (2015) - "The Impact of Timing on the Salience of Smartphone App Privacy Notices" SOUPS.

Found that timing of consent requests dramatically affects user attention and comprehension.

3. Bösch et al. (2016) - "Tales from the Dark Side: Privacy Dark Strategies and Privacy Dark Patterns" PETS.

Catalogued 28 types of manipulative practices ("dark patterns") used to obtain consent.

Section 6 implements these research findings by requiring consent be free from manipulation!

3. Constitutional Framework: Bodily Integrity Parallel

3.1 Puttaswamy: Privacy as Dignity

Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1

3.2 Common Cause v. Union of India: Bodily Autonomy

Common Cause (A Regd. Society) v. Union of India, (2018) 5 SCC 1

The Supreme Court recognized the right to die with dignity, holding that bodily autonomy is fundamental.

Justice D.Y. Chandrachud: "The right to die with dignity is intrinsically related to the right to live with dignity..."

Data Autonomy Parallel: If individuals have autonomy over their physical body, they certainly have autonomy over their informational body (personal data).

3.3 Medical Consent Jurisprudence

Samira Kohli v. Dr. Prabha Manchanda, (2008) 2 SCC 1

Established that medical consent must be:

• Voluntary (free from coercion)
• Informed (understanding risks/benefits)
• Competent (given by someone capable)
• Specific (for particular procedure)

Section 6 applies the same medical consent standards to data processing!

4. Section 6(1)(a): Free Consent - The Non-Coercion Principle

Statutory Language: "Free: given without her being subjected to any deceptive or manipulative practice, including making consent a precondition for the provision of any good or service or offering differential treatment"

4.1 The Three Enemies of Free Consent

Section 6(1)(a) identifies three categories of unfreedom:

1. Deceptive Practices - Lying or misleading
2. Manipulative Practices - Exploiting cognitive biases
3. Coercive Bundling - Making consent a precondition or offering differential treatment

4.2 Deceptive Practices

4.3 Manipulative Practices

Manipulation = Exploiting psychological vulnerabilities to obtain consent without genuine choice.

4.4 Coercive Bundling: The "Take-It-Or-Leave-It" Problem

Section 6(1)(a) explicitly prohibits "making consent a precondition for the provision of any good or service."

This is revolutionary!

4.5 Differential Treatment

Section 6(1)(a) also prohibits "offering differential treatment" based on consent.

4.6 The "Necessary for Performance" Exception

Critical Distinction: Section 6(1)(a) prohibits making consent a precondition for unrelated processing, but not for necessary processing.

Rule of Thumb: If the service literally cannot function without the data, bundling is permitted. Otherwise, it's coercion.

5. Section 6(1)(b): Specific Consent - Purpose Limitation

Statutory Language: "Specific: not for more than the specified purpose and, if the purpose changes, then a fresh consent shall be obtained"

5.1 The Purpose Limitation Principle

Purpose limitation is one of the oldest principles in data protection law, dating back to the 1973 Fair Information Practice Principles.

Core Idea: Data collected for Purpose A cannot be used for Purpose B without fresh consent.

5.2 Compatible vs. Incompatible Purposes

Not every new use requires fresh consent - only incompatible purposes do.

6. Section 6(1)(c): Informed Consent - Knowledge Requirement

Statutory Language: "Informed: given for the specified purpose after having been informed in accordance with section 5"

Critical Link: Section 6(1)(c) creates a mandatory sequence:

1. First, provide Section 5 notice (information)
2. Then, obtain Section 6 consent (agreement)

Notice → Consent, never Consent → Notice.

7. Section 6(1)(d): Unconditional Consent - No Hidden Terms

Statutory Language: "Unconditional: not made subject to compliance with any term or condition that would constitute a deceptive or manipulative practice or, make consent a precondition for the provision of any good or service"

Section 6(1)(d) reinforces and expands on 6(1)(a). The key addition: no hidden conditions.

8. Section 6(1)(e): Unambiguous Consent - Affirmative Action

Statutory Language: "Unambiguous: expressed by way of any clear affirmative action and not by mere inaction or disengagement"

This subsection is a direct attack on "deemed consent" or "implied consent" theories.

8.1 What is "Clear Affirmative Action"?

8.2 The Pre-Checked Box Problem

9. Section 6(1)(f): Withdrawable Consent - Right to Exit

Statutory Language: "With the option to withdraw: as easily as it may be given, and the withdrawal shall be processed at least within such period as the original consent was provided"

This is the "Easy In, Easy Out" principle.

9.1 Symmetry Requirement

The law requires symmetry between giving and withdrawing consent:

9.2 Processing Timeline

"...and the withdrawal shall be processed at least within such period as the original consent was provided."

Interpretation:

• If consent was processed instantly (e.g., checkbox → immediate data collection), withdrawal must be processed instantly
• If consent processing took 24 hours, withdrawal processing can take up to 24 hours
• If consent took 5 minutes, withdrawal must take no more than 5 minutes

10. Sections 6(2) & 6(3): Children's Special Protection

10.1 Section 6(2): Parental Consent Requirement

Statutory Language: "Where consent is sought from a Data Principal who is a child, such consent shall be given by the parent of such child."

Child Definition (Section 2(k)): A person under the age of 18 years.

Why Parental Consent?

• Children lack full decisional capacity
• Children are more vulnerable to manipulation
• Children may not understand long-term consequences
• Parental responsibility includes protecting children's data

10.2 Section 6(3): Absolute Prohibitions for Children

Statutory Language: "A Data Fiduciary shall not undertake any tracking or behavioural monitoring of children or targeted advertising directed at children."

This is an absolute prohibition. Even with parental consent, these activities are forbidden:

1. Tracking: Following children's online activities across sites/apps
2. Behavioral Monitoring: Building profiles of children's behavior
3. Targeted Advertising: Showing ads based on children's data

10.3 Age Verification Challenge

Practical Problem: How do you know if a user is under 18?

Solutions:

• Age Gate: Ask user's age before allowing access
• Age-Neutral Design: Design service to comply with children's protections for all users (safest)
• Verification Systems: Use Aadhaar or other ID verification (for high-risk processing)

Best Practice: If your service might attract children, treat ALL users as children (highest protection standard).

11. Section 6(4): Consent Mechanisms

Statutory Language: "The Data Fiduciary may allow a Data Principal to consent in such manner and by such means as may be specified by regulations."

Section 6(4) provides flexibility in how consent is obtained, while maintaining the what (six requirements from 6(1)).

11.1 Permissible Consent Mechanisms

12. Comparative Analysis: DPDPA vs. GDPR

Key Takeaway: DPDPA's consent requirements are actually stricter than GDPR in several ways, particularly regarding children and bundling.

13. Dark Patterns: The Enemy of Valid Consent

Dark Patterns are design techniques that manipulate users into making decisions they wouldn't otherwise make.

Section 6(1)(a)'s prohibition on "deceptive or manipulative practices" is a direct attack on dark patterns.

13.1 Common Dark Patterns in Consent

13.2 DPDP Rules on Dark Patterns

DPDP Rules 2025, Rule 8 explicitly prohibits dark patterns and provides examples. Violations attract penalties.

14. Practical Compliance Guidance

14.1 Consent Request Template

14.2 Section 6 Compliance Checklist

14.3 Common Mistakes to Avoid

14.4 Documentation Requirements

You Must Maintain Records Of:

• ✓ When consent was obtained (timestamp)
• ✓ What information was shown to user (Section 5 notice version)
• ✓ What consent was for (specific purposes)
• ✓ How consent was obtained (mechanism used)
• ✓ Evidence of affirmative action (click logs, etc.)
• ✓ When consent was withdrawn (if applicable)
• ✓ How withdrawal was processed
• ✓ For children: Evidence of parental verification

Why? In enforcement proceedings, Data Fiduciary must prove consent was valid. Documentation is your only defense.

15. Conclusion: Consent as the Cornerstone of Data Protection

Section 6 is not just a technical requirement - it's the moral and legal foundation of the entire DPDPA framework.

Without valid consent:

• Data processing becomes data theft
• Privacy becomes a word without meaning
• Individual autonomy is violated
• Trust in digital economy collapses

15.1 Key Principles to Remember

1. FISU-UW: All six characteristics must be present
2. No Coercion: Bundling unrelated processing with service access is forbidden
3. Affirmative Action: Silence, inaction, or pre-checked boxes are not consent
4. Easy Exit: Withdrawal must be as easy as giving consent
5. Children are Special: Absolute protection against tracking and targeted ads
6. Dark Patterns are Illegal: Manipulation voids consent
7. Prove It: Burden of proof is on Data Fiduciary

15.2 The Consent Revolution

Section 6 represents a paradigm shift from "notice and consent theater" to "meaningful consent."

The old world: Users clicked "I agree" to 50-page policies they never read.

The new world (Section 6): Consent must be genuinely free, informed, specific, and easy to withdraw. Anything less is illegal.

This is not compliance - it's respect for human dignity.