DPDP Consent Managers: What App Marketers Must Change

India notified its Digital Personal Data Protection Rules in November 2025. In mid-November 2026, consent managers can start registering. By May 2027, the core duties on notice, consent, withdrawal and erasure apply to every app that processes personal data in India.

That leaves app growth teams roughly six months after the consent-manager date to fix a stack that usually sends user-level data to an attribution SDK, three or four ad networks and a CRM tool, often before any consent screen has loaded.

This post is a working checklist for marketers, not legal advice. Every obligation below links back to the Act or the Rules, so your counsel can check the reading.

Disclaimer: this is a practical guide for marketing and growth teams, not legal advice. Confirm your obligations with qualified counsel.

What is a DPDP consent manager, and does your app need one?

Under India's DPDP Act, a consent manager is a company registered with the Data Protection Board that gives users one interoperable platform to give, manage, review and withdraw consent across the apps and services they use. The definition sits in section 2(g) of the Act.

What that means in practice:

• It is the user's tool, not yours. Section 6(7) says a user may give or withdraw consent through a consent manager. You are not required to buy one, but if a user withdraws through one, you must act on it.
• The bar to register is high. Rule 4 and the First Schedule require an Indian company, a net worth of at least ₹2 crore, a platform that cannot read the personal data passing through it, and consent records kept for at least seven years (KSK summary).
• Your consent management platform is not automatically a consent manager. A cookie or in-app consent banner vendor only becomes one by registering with the Board.

If you already handle consent for EU users, our guide to GDPR compliance in MMPs covers the overlap. DPDP differs in one useful way for planning: consent is the main basis for marketing processing, because the "legitimate uses" in section 7 are a closed list with no general legitimate-interest route.

Which dates matter, and what starts when?

The Rules start in three phases, counted from their publication in the Official Gazette. They were notified as G.S.R. 846(E), dated 13 November 2025. Law firms differ on whether publication counts from 13 or 14 November, so the later dates below are given as mid-month.

What this means for your roadmap:

• November 2026: consent managers can register and onboard apps. Expect partner and procurement questions, not enforcement.
• May 2027: the duties that touch your marketing stack apply. Engineering work on SDK gating and deletion pipelines needs to start well before then.

Attribution SDKs: consent before the first event

Your mobile measurement partner collects device identifiers, IP addresses and in-app events from the first app open. Under DPDP, that collection needs a notice and a consent that match.

• Itemise the data and the purpose. Rule 3 requires a standalone notice with "an itemised description" of the personal data and the specified purpose. "Analytics" is too vague; "measuring which ad brought you to the app" is closer.
• Gate the SDK on consent. Initialise attribution, or at least hold identifiers and events, until the user has consented. Our Android SDK setup guide shows where consent fits in the init sequence.
• Treat the vendor as your processor, under contract. Most attribution vendors process on your behalf. Section 8(2) allows that "only under a valid contract", and section 8(1) keeps you responsible for what they do.
• Switch off tracking for under-18s. Section 9(3) bars "tracking or behavioural monitoring of children or targeted advertising directed at children". Under DPDP, a child is anyone under 18. Edtech, gaming and fintech apps with younger users need an age gate before the SDK runs.

How to validate this in your MMP: install a fresh build, decline consent and check that no install or event reaches the dashboard for that test device. Then accept and confirm attribution resumes.

Tech Explainer: what Linkrunner's consent and hashing switches do. Linkrunner's SDK accepts a consent signal through setConsent, documented on the Send Consent page. Today it passes Google's consent parameters for EEA users, and the docs note that DPDP has no equivalent Google parameter, so DPDP gating still happens in your app's own consent flow. PII hashing is opt-in: when enabled, the SDK hashes emails and phone numbers with SHA-256 before they leave the device. It is off by default.

Ad-network postbacks: what you send, and on whose consent

A postback sends install and event data back to Meta, Google or TikTok so their algorithms can optimise. It often carries user-level data such as advertising IDs, IP addresses and hashed contact details.

• Name the purpose in the notice. "Sharing app activity with advertising partners to measure and improve our ads" should appear in the itemised notice, not only in the privacy policy.
• Ask counsel how each network is classified. Ad platforms use conversion data for their own optimisation, so they may not be a plain processor. The answer changes which contract and notice wording you need.
• Hashing is a safeguard, not an exemption. The Act has no carve-out for hashed identifiers. Treat a SHA-256 email as personal data unless your counsel says otherwise.
• Stop postbacks when consent goes. If a user withdraws, their later events should not reach any network.
• Send fewer events. Fewer mapped events means less data to explain. Our postback setup guide covers choosing the events that matter.

CRM and engagement tools: the forgotten processors

Engagement platforms such as MoEngage, CleverTap and WebEngage often hold more personal data than the MMP: phone numbers, emails, push tokens and full event histories. Most teams connect them in an afternoon and never revisit the contract.

• List every tool that receives user data. Include warehouse syncs and webhooks, not just SDKs. Our guide to tools that stack with your MMP is a useful map of the usual suspects.
• Check each one has a processing contract. Section 8(2) applies to every processor, not just the attribution vendor.
• Separate service and promotional purposes. An OTP or order update and a win-back campaign are different purposes. Users can withdraw from one without losing the other.
• Wire withdrawal into each tool. If a user withdraws marketing consent, the CRM audience, the Meta and Google custom audiences and any remarketing cohorts must all update.

Consent records, withdrawal and erasure: the plumbing

DPDP turns consent from a banner into a data model. You need to know who agreed to what, when and under which version of the notice.

Withdrawal must be as easy as consent. Section 6(4) says withdrawal must be "comparable to the ease with which such consent was given". One tap to accept means no email-us-to-opt-out.

• Keep a consent log. Store user, purpose, notice version, timestamp and channel (in-app, web or consent manager).
• Propagate withdrawal to processors. Section 6(6) requires you to "cease and cause its Data Processors to cease" processing within a reasonable time.
• Erase, and make processors erase. Section 8(7) requires erasure once consent is withdrawn or the purpose is served, unless another law requires retention.
• But keep the minimum log trail. Rule 8(3) requires personal data, traffic data and processing logs to be kept for at least one year from processing, for the purposes in the Seventh Schedule. Work out with counsel what moves out of active marketing use and what stays in restricted storage.
• Large platforms have an inactivity clock. Under the Third Schedule, e-commerce and social media platforms with 2 crore or more users and gaming platforms with 50 lakh or more must erase data after three years of inactivity (MediaNama). Rule 8(2) requires a notice at least 48 hours before erasure.

Linkrunner's Trust Center lists DPDPA alongside ISO 27001:2022, SOC 2 Type 2 and GDPR. For teams that want raw events and PII to stay inside their own cloud, Bring Your Own Cloud deployment keeps them there.

A 10-point checklist before May 2027

1. Map every SDK, webhook and sync that receives user data.
2. Rewrite the in-app notice: itemised data, specified purposes, withdrawal link.
3. Gate attribution and analytics SDKs on consent.
4. Add an age gate and turn off tracking and targeting for under-18s.
5. Sign or update processing contracts with your MMP, CRM and analytics vendors. Our MMP contract checklist lists the clauses worth reviewing.
6. Agree with counsel how each ad network is classified, and update notice wording to match.
7. Decide which identifiers you hash, and switch hashing on where your MMP supports it.
8. Build a consent log with notice versions.
9. Make withdrawal one tap and propagate it to every processor and audience.
10. Build an erasure job that respects the one-year minimum log retention and, if you qualify, the three-year inactivity rule.

FAQ

Do apps have to integrate a consent manager by November 2026? No. The Act makes consent managers optional for users, and nothing in the Rules requires an app to buy one. You do need to honour consent or withdrawal that reaches you through one.

Does the DPDP Act apply to hashed emails and phone numbers? Assume yes. The Act has no exemption for hashed identifiers, and a hashed email can still be matched to a person by an ad platform. Hashing reduces risk; it does not remove the need for consent.

Will attribution numbers drop if users decline consent? Yes, for the users who decline. Expect fewer attributed installs and fewer signals sent to ad networks, so watch modelled and aggregate reporting alongside user-level counts.

What are the penalties under the DPDP Act? The Schedule to the Act sets penalties that may extend to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for breaches of the children's obligations.

Is Linkrunner a registered consent manager? No. Linkrunner is a mobile measurement partner that processes attribution data on an app's behalf, with an India-first set-up that fintech teams facing RBI and DPDP checks often ask about. It accepts consent signals from your app; the consent decision and records sit with you.

The bottom line

The consent-manager date in November 2026 is the visible headline, but the work that matters for marketers lands in May 2027: notices, SDK gating, processor contracts, withdrawal and erasure. Start with the data map, because every other item on the checklist depends on knowing where user data goes.

If you are reviewing your attribution set-up as part of that work, request a demo from Linkrunner to see how consent signals, opt-in hashing and exports fit your stack. Then run the 10-point checklist above with your engineering lead and counsel.