Introduction
The emergence of Consent Managers under India’s Digital Personal Data Protection (DPDP) framework creates new commercial opportunities in the data protection ecosystem.
Companies may develop platforms that enable individuals to give, manage, review and withdraw consent across different Data Fiduciaries.
However, an important commercial and legal question arises:
Can a Consent Manager make money by selling user data, sharing consent records or monetising consent metadata?
The question is particularly relevant because Consent Managers will handle sensitive consent-related information and maintain records of individuals’ decisions concerning personal data processing.
The DPDP Rules, 2025 establish specific restrictions and obligations that significantly influence the commercial models available to these entities.
1. Understanding consent metadata
Before examining monetisation, it is important to understand what consent metadata means.
Consent metadata refers to information associated with a consent transaction or consent-management activity.
It may include:
- The identity or identifier of the individual.
- The organisation requesting consent.
- The purpose for which consent is requested.
- The date and time of a consent decision.
- Whether consent was granted, denied or withdrawn.
- Information concerning the accompanying notice.
- Details of personal data sharing with another organisation.
For example, imagine an individual using a Consent Manager to provide consent to a financial institution for accessing certain financial information.
The Consent Manager may maintain information about the organisation requesting consent, the relevant notice, the individual’s decision and the subsequent sharing activity.
Such information may be valuable to businesses because it can reveal customer preferences and patterns of interaction.
However, commercial value does not automatically create a legal right to exploit that information.
2. What does the DPDP framework require?
Part B of the First Schedule to the DPDP Rules, 2025 contains several important obligations.
One of the most significant is Item 2.
It requires the Consent Manager to ensure that the manner in which personal data is made available or shared is such that the contents are not readable by the Consent Manager.
This is an important safeguard.
The Consent Manager is expected to facilitate the consent-management process without obtaining access to the readable contents of the personal data being shared through its platform.
For example, where an individual authorises a bank to share a bank statement with another organisation through the prescribed mechanism, the Consent Manager must ensure that the sharing arrangement does not make the contents of the statement readable to it.
This restriction is particularly relevant when evaluating business models based on access to personal information.
3. Can a Consent Manager sell personal data?
A Consent Manager cannot treat its position as an unrestricted licence to sell or commercially exploit personal data.
The Rules require it to act in a fiduciary capacity in relation to the Data Principal.
Further, the Consent Manager has specific responsibilities concerning the handling of personal data and consent records.
The statutory requirement that the contents of personal data being shared must not be readable by the Consent Manager creates a significant restriction on any business model dependent on accessing and selling that information.
Additionally, the Consent Manager must comply with the applicable requirements of the DPDP Act when processing personal data.
It cannot assume that an individual’s use of its platform amounts to blanket permission for unrelated commercial exploitation.
A consent-management service and a personal-data marketplace are fundamentally different business models.
4. What about monetising consent metadata?
This is a more complicated question.
The DPDP Rules do not contain a single provision expressly stating that every form of monetisation of consent metadata is prohibited.
However, that does not mean all such monetisation is permissible.
The legal position depends on the nature of the metadata, whether it identifies or relates to an identifiable individual, the purpose of processing and the applicable statutory obligations.
For example, consider a Consent Manager analysing how frequently users withdraw consent from particular categories of Data Fiduciaries.
If the information is linked to identifiable individuals, it may constitute personal data under the Act.
Its commercial use would therefore need to be examined against the applicable requirements of the DPDP framework.
Even where information is aggregated, organisations should carefully examine whether individuals can reasonably be identified from the information or whether the data has genuinely been rendered non-identifiable.
Simply removing names or telephone numbers does not necessarily make a dataset anonymous.
5. Does acting in a fiduciary capacity restrict commercial exploitation?
Yes, it creates an important governance constraint.
Item 8 of Part B of the First Schedule requires a Consent Manager to act in a fiduciary capacity in relation to the Data Principal.
This obligation must be considered alongside the requirements to avoid conflicts of interest with Data Fiduciaries.
Why is this important?
Imagine a Consent Manager earning additional revenue by sharing information about individuals who frequently withdraw consent from particular businesses.
Such an arrangement could create incentives that are inconsistent with the individual’s interests.
Similarly, if a Consent Manager uses its position to favour organisations that provide higher commercial payments, questions may arise regarding its independence.
The fiduciary obligation and conflict-of-interest requirements are therefore important safeguards against misuse of the Consent Manager’s position.
6. What business models can Consent Managers explore?
The Rules do not prescribe a single commercial revenue model for Consent Managers.
Therefore, there may be scope for revenue-generating services, provided they remain consistent with the statutory framework.
Potential business models could include:
Enterprise service fees: Charging onboarded Data Fiduciaries for legitimate platform integration and technical services.
Platform subscriptions: Offering subscription-based services to enterprise customers.
Technology infrastructure: Providing interoperable consent-management infrastructure and related technical services.
Implementation services: Providing integration and operational support within the permitted regulatory framework.
However, these are potential commercial models, not revenue streams expressly approved by the DPDP Rules.
Each model must be assessed against the applicable requirements, including fiduciary obligations, data protection safeguards and conflict-of-interest restrictions.
A commercial arrangement cannot be used to circumvent statutory requirements.
7. What should Consent Managers avoid?
Consent Managers should be particularly careful about:
- Selling identifiable consent records without a lawful basis.
- Making readable personal data available for unrelated commercial purposes.
- Using consent histories to create commercial profiles without a valid legal basis.
- Sharing individual-level consent metadata with advertisers for unrelated purposes.
- Favouring particular Data Fiduciaries because of financial relationships.
- Using personal information collected for consent management for incompatible purposes.
The key consideration is that the Consent Manager’s position must not be misused to undermine the individual’s control over personal data.
Conclusion
The DPDP framework creates a distinction between operating a commercial consent-management platform and commercially exploiting the personal information entrusted to that platform.
A Consent Manager may explore legitimate revenue-generating services, but it cannot assume that its regulatory position permits unrestricted monetisation of personal data or consent records.
The restriction on reading the contents of shared personal data, the fiduciary obligation towards Data Principals and the conflict-of-interest requirements are central to this analysis.
Ultimately, the long-term success of Consent Managers will depend on public trust.
An individual should be able to use such a platform with confidence that their consent decisions are being managed in their interests, rather than converted into another commercial product.
