Consent and Algorithmic Decision-Making under the DPDP Act, 2023: A Regulatory Paradox

Abstract

The Digital Personal Data Protection Act, 2023, also called the DPDP Act, is based on a consent-focused vision of data regulation, where the consent is the default rule of data processing, as well as the main manifestation of informational independence. The paper explores the performance of such an architecture in a situation whereby individual information is persistently embedded within algorithmic systems that categorize, rank, and make predictions on individuals in a manner that influences access to opportunities and services. The paper asserts that, in modern platform space, the consent is frequently manufactured,
instead of meaningfully exercised: interface design, defaults, bundling, and functional dependency structure, choose, and computational inference is increasing the range of that which is actually processed by anything beyond what a user can reasonably anticipate at the time of collection. Consent is therefore more than a processing gateway, it is a decision ecosystem gateway based on inference downstream. Furthering this, the paper finds the source of a temporal discrepancy in the core of consent- based legitimacy: at onboarding, autonomy manifests episodically, whereas algorithmic assessment proceeds continuously in the long term. Although the DPDP Act provides a set of conditions under which valid consent and notice can be given, it does not introduce a broader statutory framework of exclusively automated decision-making, such as rights to explanation, contestation or meaningful human review, which is similar in logic to Article 22 of the GDPR. The article includes a doctrinal and structural criticism of the idea of entry-based accountability and suggests specific reforms, namely, anti-dark-patterns consent rules, profiling/inference transparency requirements, and review-and-contestation protections against significant-effect automated decisions.