Bundled consent packs many data uses behind one Accept button. The Supreme Court of India has called that model theft of private information, and DPDP requires purpose-by-purpose consent in its place.
What WhatsApp did
One button. One click. A single accept covering more than a dozen distinct data processing purposes, backed by a privacy policy dozens of pages long. Most Indian apps run the same pattern: the popup nobody reads, the I Agree button that covers marketing, analytics, third-party sharing and cross-border transfer in one moment.
What the Court said
In February 2026 the Supreme Court heard Meta's appeal against a ₹213 crore penalty over how WhatsApp handles user data. Chief Justice Surya Kant's remarks from the hearing:
- "a decent way of committing theft of private information"
- "a mockery of the constitutionalism of this country"
The Court described bundled consent as manufactured consent: a user with no real, easy way to refuse has been coerced, whatever button they clicked.
Days later, Meta agreed to comply by 16 March. Every Indian WhatsApp user gets a fresh choice on sharing data with Meta's advertising systems, refusing keeps the app fully usable, and the 2021 policy acceptance counts for nothing.
What DPDP requires
Under the DPDP Act each purpose needs separate, specific consent that the person can withdraw:
- "We share your email with our email platform for newsletters." One consent.
- "We use your location for fraud detection." A second consent.
- "We send your data to a server outside India." A third.
Each one granted on its own, each one revocable on its own. The full mechanics live in our consent guide.
What this means for your product
I have audited dozens of Indian apps. Nine in ten run the one-button pattern WhatsApp just abandoned. Fixing it is a product build: consent captured per purpose, proof stored per user, withdrawal that actually works.
The timing matters. The Court grounded its language in Article 21, which is enforceable today. Companies that wait for the DPDP enforcement date are betting that no court reaches them first.
Test your own consent flow
Count the purposes hiding behind your Accept button.
Try refusing one purpose while keeping the service. Does the product allow it?
Find the stored record that proves one named user consented.
Withdraw consent as a test user and time what actually stops.
Read your privacy policy aloud. A school student should follow it.
Next step
Unbundling consent is a product change. We build it with your team.
Get implementation help →Related reading
Written by Sushant Pasumarty
DPDP consultant. Founder, Meridian Bridge Strategy. This page began as field notes from live client work.