We have all been there. You download a new app, a pop-up appears with a wall of legal text, and you tap "Agree" just to get past it. But as recent global events show, that tap might not count as real consent anymore.
Here is a breakdown of what is happening with global regulators, what the law demands, and why Indian companies need to pay attention right now.
Q: What is going on with Meta and user consent?
A: Meta has been repeatedly penalized by regulators for how it collects user data for targeted advertising.
In 2023, Ireland’s Data Protection Commission fined Meta €390 million, ruling that the company forced users into accepting personalized ads by hiding data-tracking consent inside its Terms of Service. In 2025, the European Commission added another €200 million fine because Meta’s "pay or okay" model left users with no genuine alternative besides accepting constant tracking or paying a fee.
Q: Are these issues limited only to Europe?
A: Not at all. The legal pressure is mounting globally:
- In the US: A New Mexico jury found that Meta misled users regarding their privacy, leading the state to seek between $35 billion and $40 billion in penalties. Additionally, a judge slapped Meta with a $567 million penalty for harms caused to children, alongside a separate $17.1 billion settlement with dozens of US state attorneys general over addictive design claims.
- Across the globe: More than 14 regulatory bodies—from Norway and Germany to the UK and the US FTC—are actively cracking down on deceptive consent models.
Q: What does this mean for companies operating in India?
A: It is a major wake-up call. Under India's Digital Personal Data Protection (DPDP) Act, 2023, consent must be free, specific, informed, unconditional, and unambiguous.
Burrying data permissions inside a lengthy Terms and Conditions document is no longer legally acceptable. With most corporate obligations under the DPDP Act kicking in by May 13, 2027, Indian businesses must overhaul how they handle user permissions before regulators come knocking.
Q: What specific steps should businesses take right now to stay compliant?
A: If you run a business or manage user data in India, you need to check these six core requirements immediately:
- No pre-ticked boxes: Users must actively opt-in; pre-selected permissions violate the rule of free consent.
- Offer a real choice: You cannot use a "take it or leave it" approach where a user must accept tracking just to use your service.
- Make withdrawal easy: Withdrawing consent must be just as simple and frictionless as giving it.
- Protect children: Never track minors or serve them targeted advertisements. Violating children's data provisions can lead to penalties as high as ₹200 crore.
- Delete data when done: Stop retaining user data once its stated purpose has been fulfilled.
- Appoint a contact person: Name a designated Data Protection Officer or point of contact whom customers can reach out to regarding their data.
The digital landscape is shifting rapidly. Your users care about their privacy, and regulators are watching closely. Fixing your consent mechanisms today is far easier than defending them in court tomorrow.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
