Pillar 1: Granularity
Each purpose needs its own consent. A single 'I accept the privacy policy' checkbox covering account creation, marketing, behavioural analytics, third-party sharing and cookie-based tracking will not survive Section 6 scrutiny. The user must be able to opt into account creation while opting out of marketing. They must be able to opt into newsletter while opting out of promotional SMS.
The minimum granularity we recommend: account/service consent, marketing channel-by-channel (email / SMS / push / WhatsApp), behavioural analytics, third-party sharing categorised by partner type. Five distinct switches, not one mega-switch.
Pillar 2: Withdrawal parity
Withdrawal must be 'as easy as giving' — same channel, same number of steps, same effort. If consent was a one-click toggle, withdrawal must be a one-click toggle. If consent was given by SMS opt-in (STOP keyword), withdrawal via the same STOP keyword must work. Hiding withdrawal three menus deep, or requiring email-to-support, is non-compliant.
Test: time how long it takes a non-technical user to withdraw a specific consent. If it's more than 30 seconds, your design is non-compliant.
Pillar 3: Dark pattern avoidance
The Rules don't use the term 'dark pattern' but Section 6's requirements (free, specific, informed, unconditional, unambiguous) create the same effect. Patterns to avoid:
- Pre-checked consent boxes
- 'Accept all' as a prominent button with 'Reject all' hidden in a sub-menu
- Coloured 'Accept' buttons against grey 'Reject' buttons
- Repeated re-prompts after the user has rejected
- 'Continue with limited features' framing that implies degraded service for refusing optional consents
- Bundling unrelated purposes into a single switch
Pillar 4: The audit trail
You must be able to evidence consent on demand. The minimum log entry per consent event:
- Hashed Data Principal identifier
- Timestamp (UTC + IST)
- Channel (web, app, in-call, SMS, paper)
- Purpose code
- Notice version shown
- Outcome (granted, denied, withdrawn)
Store the log for at least the lifetime of the relationship plus your retention period. A consent record without a notice version is significantly weakened — the version is what proves what the user was actually told.
The reference design
Our Consent UX Spec (Template 03) provides a full reference architecture covering the banner, the granular modal, the preference centre, the audit JSON schema, and the API contract. Use it as a starting point and adapt to your stack.