Consent in the Age of AI: Can the DPDPA Keep Up with Generative AI?
You open an AI chatbot and type: “Help me draft a response to this medical report.” You upload the document, ask a few questions and close the tab. But what exactly did you consent to?
Did you consent merely to the AI analysing the document and generating an answer? Did you also agree to its storage, subsequent processing, or use for improving an AI system? More importantly, can consent designed for conventional digital services meaningfully govern technologies that learn, infer and generate? This is where India's Digital Personal Data Protection Act, 2023 (DPDPA) encounters the complicated world of generative AI.
The DPDPA's Idea of Consent
Section 6 of the DPDPA establishes a seemingly strong standard. Consent must be free, specific, informed, unconditional and unambiguous, expressed through clear affirmative action. Crucially, consent must relate to a specified purpose, and the personal data collected must be limited to what is necessary for that purpose. The Act also allows individuals to withdraw consent, with withdrawal required to be as easy as giving it.
The Digital Personal Data Protection Rules, 2025 further strengthen the notice architecture. Notices are expected to clearly identify the personal data involved and explain the purpose for which it will be processed. On paper, this sounds reassuring. Generative AI, however, complicates the very idea of a specified purpose.
When Today's Data Creates Tomorrow's AI
Traditional consent assumes a relatively predictable transaction: I give you X data so that you can provide Y service. Generative AI does not always fit neatly into that equation. Data submitted for one immediate purpose may potentially move through complex processing chains. AI systems can also derive information rather than merely reproduce what a user provides. A seemingly harmless collection of inputs may reveal patterns, preferences or characteristics that were never expressly stated.
This creates what may be called the consent paradox of generative AI: how can consent be genuinely informed and specific when the individual may not reasonably understand all the ways an AI ecosystem could process or derive information from their data?
Withdrawal creates another conceptual difficulty. The DPDPA requires processing based on consent to cease within a reasonable time after consent is withdrawn, subject to lawful exceptions.
But AI raises a harder question: what does withdrawal mean once personal data has already contributed to the development or behaviour of a model?
Stopping future processing and reversing what has already influenced a complex AI system are not necessarily the same thing.
Consent Cannot Carry the Entire Burden
This does not make the DPDPA's consent framework irrelevant. Purpose limitation, data minimisation, accessible notices and easy withdrawal are particularly valuable precisely because AI encourages enormous volumes of data processing. But generative AI demonstrates why consent alone cannot become the legal system's answer to every form of data processing. India's emerging privacy framework may eventually need to think beyond the familiar “I Agree” model towards stronger principles of privacy by design, meaningful transparency, data minimisation, accountability and AI-specific governance.
The DPDPA gives India an important foundation for protecting digital personal data. The next challenge is ensuring that its understanding of meaningful consent evolves as quickly as the technology asking for it. Because in the age of AI, perhaps the real question is no longer simply: “Did you consent?”
It is: “Could you reasonably understand what you were consenting to?”
This blog has been written by Akshay Aggarwal, Global Finance & Operations Associate at Boston Consulting Group, Former Senior Analyst at KPMG.
Comments