Published Paper Details:

India's new data protection law, the Digital Personal Data Protection Act of 2023, and its 2025 Rules, create a new kind of intermediary called the Consent Manager. The idea is that instead of every individual having to deal separately with hundreds of companies that collect their personal data, a single registered platform will let the user give, review, manage, and withdraw consent across all of them. This article examines whether the design of the Consent Manager will actually work for ordinary Indians, particularly those who are poor, less digitally literate, do not read English or Hindi well, share their phones with family members, or live in remote areas. It traces the legal architecture of the Consent Manager through the DPDP Act and the 2025 Rules, compares it with the existing Account Aggregator framework in the financial sector, and tests it against the constitutional standards of equality and proportionality laid down by the Supreme Court of India. The argument is that the present design assumes a data principal who is literate, English-speaking, smartphone-owning, and individually situated. Most data principals in India are not all of these things. The article concludes with five concrete reforms that can be brought in through delegated rules and regulatory guidance, without amending the Act itself, to make the Consent Manager genuinely accessible to the populations it most needs to protect.