Consent Is Not Control: Rethinking Individual Choice under India's Digital Personal Data Protection Framework

Abstract

The growing use of digital platforms has made the collection and processing of personal data a part of everyday life. While consent is often treated as the primary means of protecting individual privacy, the reality is more complicated. Lengthy privacy policies, limited alternatives and unequal bargaining power can make it difficult for individuals to understand what they are agreeing to or to exercise genuine control over their personal information. This article examines the consent framework under India's Digital Personal Data Protection Act, 2023, in light of the constitutional recognition of privacy by the Supreme Court in Justice K.S. Puttaswamy (Retd.) v. Union of India. It argues that consent remains important but cannot, on its own, provide adequate protection in a digital environment where individuals may lack the information or practical freedom needed to make informed choices. The article therefore emphasises the need for clear privacy notices, responsible data processing, accessible grievance redressal and stronger institutional accountability. It concludes that meaningful data protection requires more than obtaining an individual's agreement; it requires a framework in which organisations are held responsible for how personal data is collected, used and protected.