0→1 Concept · Self-initiated, not client work
One place for every "yes": a consent dashboard for Indian consumers
India's new data-protection law creates a role that doesn't exist yet — the Consent Manager. This is how I'd take a product into that space from zero: wedge, growth loop, go-to-market and the metrics that would tell me it's working.
TL;DR
- Under the Digital Personal Data Protection Act, people will be able to give, review and withdraw consent through a registered Consent Manager. Registrations open in November 2026; most obligations on businesses apply from mid-2027.
- The wedge: start where consent already has a working rail — financial data, where the Account Aggregator system has already fulfilled hundreds of millions of consents — and give people one dashboard across all of them.
- Distribution comes from banks and lenders, who need a compliant consent journey before the deadline. Every one that integrates brings its customers; every customer who uses the dashboard raises the bar for the next business.
The opportunity
The Digital Personal Data Protection Act, 2023 gives every person in India the right to give, manage, review and withdraw consent for how businesses use their personal data. It also creates a new kind of company to make that practical: a Consent Manager, registered with the Data Protection Board, acting as a single point of contact through an accessible, transparent and interoperable platform.
The rules were notified in November 2025 and phase in over 18 months. The provisions for Consent Managers take effect in November 2026; most of the obligations on businesses — notices, consent, security, the rights of individuals — apply from mid-2027. So there is a window, right now, in which the category exists in law but not yet in people's pockets.
Financial data shows what consent can look like at scale. Through India's Account Aggregator system, people already approve each sharing of their financial data with a specific, time-bound consent. Sahamati, the industry body, reports more than 369 million consents fulfilled and 930 live entities on the network. But a person's consents are scattered across whichever lender, app and aggregator they happened to use — there is no single place to see them all, and no single place to say "stop".
Target user & wedge
Who first: salaried, digitally active adults who have taken a loan, a card or an investment product through an app in the last two years. They have more consents in circulation than they remember, and they are the people the next wave of data-sharing will touch first.
The wedge isn't "manage all your privacy". That is too broad to build and too vague to sell. It is: see every financial-data consent you've given, in one list, and withdraw any of them in one tap — with a receipt. Financial consents are the right starting point because they already exist as structured, time-bound records, the stakes are high (your bank statements, your credit), and the businesses involved are regulated and used to compliance deadlines.
Solution concept
- One list. Every consent: who has it, for what purpose, which data, since when, until when.
- One-tap withdrawal, with a confirmation receipt — and a status that turns green only when the business has actually acted on it.
- A timeline of when each consent was used, so "why did this company see my statements?" has an answer.
- Plain-language notices at the moment of consent, in the user's language, so "yes" means something.
V1 scope: one category (lending and banking), two or three launch partners, Android first, English and Hindi. Prove that people use the dashboard and that withdrawals are honoured end to end before building anything wider.
Deliberately NOT in v1:
- Storing or reading anyone's personal data. The law requires the Consent Manager not to read the data it routes, and the product is stronger for it.
- Monetising user data or showing ads. The business model has to be paid by the businesses that need compliant consent, never by the user's data.
- Marketing preferences for every brand, cookies, or consents outside India — v2+ problems that only matter if the financial wedge works.
Product shape: an app, a feature, or infrastructure?
The obvious question: why not make this a feature inside a payments super-app that already reaches hundreds of millions of people and already connects to their banks?
That gives the reach of a feature without the conflict of interest — the same pattern the Account Aggregator network already uses, where a neutral, licensed layer sits between the apps people use and the institutions holding their data.
Growth loop & go-to-market
The growth loop is two-sided. Businesses bring users: a lender that integrates its consent journey brings every new borrower onto the dashboard at the moment of consent, with no separate acquisition cost. Users then bring businesses: once people can see and withdraw consents in one place, a lender that isn't on the dashboard looks like it has something to hide — so integration becomes a trust signal, not just a compliance cost.
Go-to-market sequencing:
- Now to November 2026: design partnerships with two or three digital lenders and one bank, who need a consent journey that will satisfy the Board and want to shape it rather than retrofit it.
- November 2026: register as a Consent Manager as soon as registrations open; launch the dashboard with the design partners' customers.
- To mid-2027: sell to the long tail of lenders and fintechs facing the main compliance deadline, with the launch partners as references.
Revenue comes from the businesses: a platform fee plus a per-consent charge, the same shape the Account Aggregator network already uses. The user never pays and is never the product.
Success metrics
- Activation: share of users who open their consent list within 30 days of their first consent through a partner.
- Engagement: share of active users who review or withdraw at least one consent each quarter — the sign that the dashboard is useful, not just installed.
- Integrity: share of withdrawals honoured downstream within the promised time — the metric the whole product's trust rests on.
- Business side: integrated businesses, consents under management, and the time a business needs to answer an audit question about a consent.
- Counter-metric: partners' consent completion rates must not fall — a dashboard that scares people off every consent helps no one.
What could kill it
- Timing. Rules phase in through 2027, and details such as interoperability standards are still to come. Mitigation: build with design partners now, ship when registration opens.
- Incumbents. Account Aggregators or large banks could build their own dashboards. Mitigation: the cross-business view is the point — no single business can show a person consents held by its competitors.
- Awareness. Most people don't yet know they have these rights. Mitigation: meet them at the moment of consent through partners, rather than trying to market a privacy app.
- Who pays. If businesses see consent only as a cost, adoption stalls until enforcement bites. Mitigation: sell lower audit effort and higher trust, not just compliance.
- The bar to entry. A Consent Manager must be an Indian company with a minimum net worth of ₹2 crore, pass independent certification of its platform, and accept audits by the Board. This is a funded, regulated business, not a side project.
What already exists
- Account Aggregators (for example OneMoney and Finvu) already let people view and revoke the financial-data consents given through that aggregator — proof the model works, but each shows only its own slice.
- UK Open Banking requires providers to give customers a dashboard to view and revoke the access they've granted, no more than two clicks from the home screen — the closest existing example of what "one place to say stop" looks like, mandated by a regulator.
- Enterprise consent platforms help businesses collect and record consent; in India, vendors such as Leegality's Consentin are already positioning to become Consent Managers. They start from the business's side; this concept starts from the person's.
- Government groundwork: India's digital-governance bodies have run a challenge for open-source consent-management code aimed at small businesses — a sign the consent layer is expected to be an ecosystem, not a single product.
Why I'd bet on this
I own a privacy-preferences platform for a large U.S. bank. The hardest problems there are exactly the ones this product lives on: a customer's choice that takes effect in one system and silently not in another, and proving to an auditor what a customer agreed to, and when. The pattern I'd bring is the same one that worked there — one place that decides what a consent means and makes every system honour it, with an audit trail.
What would be new for me is everything around it: no existing platform, no inherited backlog, a market that doesn't exist until a regulation switches on. That is the 0→1 muscle I want more reps on — and a category where knowing the regulation deeply is the advantage, not the obstacle.
Sources
- Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025 (notified November 2025)
- SCC Online, "Consent Manager under the DPDP Act" — role, obligations and the November 2026 start of the Consent Manager rules
- Sahamati, Varta newsletter, December 2025 — Account Aggregator ecosystem statistics
- DPDP Rules 2025, First Schedule (conditions and obligations for Consent Managers), as reproduced by DPDP Wiki — eligibility, net worth and conflict-of-interest rules
- Open Banking UK, Customer Experience Guidelines — consent and access dashboards
- Consentin (Leegality), "NeGD consent manager", January 2026 — vendor perspective on the open-source challenge and the Consent Manager market
A self-initiated concept, not affiliated with any company. Nothing here has been built or launched.