The monetisation mystery: Why consent managers would fail even before they start
Consent managers are the entities, recognised under DPDPA to act on behalf of data principals, to give, review, manage and withdraw consent. They provide an interoperable platform where it would be easy for data principals to give, manage, review and withdraw consent instead of visiting dozens of websites.
Under Schedule 1 of the DPDPA rules, it mandates having not less than two crore rupees of net worth to act as a consent manager. But still the chances of monetising are very less in this business model, as consent managers cannot sell data, use it for their own purpose or do any act with the provided data as they are completely “data-blind”.
The strong argument in favour of consent managers is interoperability. Imagine a person using three banking apps, two e-commerce shopping apps, five payment apps, six food delivery apps, and an insurance platform. Instead of managing consent through individual platforms, they can manage it through one common consent manager.
However, interoperability doesn’t happen automatically. Each data fiduciary may have different systems, databases, authentication mechanism, consent architecture and technical environments. Hence, someone has to build and establish a connection between them. Therefore, the very feature that makes the consent manager valuable is interoperability; meanwhile, it can also make the business expensive to operate.
Regulatory recognition can establish the role of the consent manager, define its roles and responsibilities, and set eligibility requirements. But it cannot guarantee consumer adoption, business adoption, commercial sustainability, and willingness to pay. This situation means its success cannot be measured using the same logic that was used for conventional data-driven businesses. Their commercial value has to come from selling trust, interoperability, and compliance infrastructure.
So the unanswered questions are
Can consent manager build sustainable revenue without monetising personal data?
Will the cost of integrations justify the benefits?
Perhaps, this is the real experiment behind the consent manager framework.
India has chosen to create a specifically recognised, regulated intermediary whose statutory role is to act on behalf of data principals in managing consent across various data fiduciaries. The consent manager framework is not replicated in GDPR, Singapore PDPA, the US privacy framework, or any other data privacy frameworks around the world, which allow data principals to continuously give, manage, review, and withdraw consent. Rather, they make data subjects/principals directly communicate with the data fiduciary/controller.
The core business problem is that all the costs have to be borne by the consent manager for building interoperability infrastructure, security safeguards, and compliance measures; additionally, infrastructure needed to be data-blind. But there are limited means to monetise.
The Consent Manager framework represents a distinctive approach to consent management under the DPDP framework. However, creating the regulatory framework is only the first step. The success of Consent Managers will ultimately depend on whether Data Principals adopt them, whether Data Fiduciaries are willing to integrate with them, and whether a commercially sustainable business model can emerge without relying on the monetisation of personal data.
The real question, therefore, is not whether consent managers can be created, but whether India's consent ecosystem can create enough participation, trust and economic value to make them viable in practice.