Opt-in

What opt-in means, and what it does not

Opt-in is the moment a person does something deliberate that signals they want to hear from you, and the record you keep of that moment. The act is usually a checkbox, a button, a reply or a double confirmation, but the act is only half of it. The other half is the artefact: who agreed, to what wording, at which collection point, on which date, through which channel, and how they can reverse it. Without the artefact you have a feeling about your list, not a permission.

It is not the same as consent. Consent is the legal basis for processing under the DPDP Act; opt-in is one way to obtain and evidence it. Nor is it a preference centre, which is where someone narrows the topics they want after they have already agreed. Nor is it an unsubscribe link, which is the mirror image: the mechanism for taking permission away rather than giving it.

The distinction between opt-in and opt-out is a default. In an opt-out model, the person is on the list until they leave. In an opt-in model, they are off it until they join. India’s DPDP framework is an opt-in regime for consent-based processing, which means the default state is no. Any workflow that begins with a list and asks people to leave has started from the wrong end.

The DPDP test: five adjectives and one action

Section 6 of the Digital Personal Data Protection Act 2023 sets out what consent has to be. It must be free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and limited to the personal data necessary for the specified purpose. Each adjective rules out a familiar practice. Free rules out a consent that is a condition of service where the service does not need it. Specific rules out a single yes that covers everything the company might ever do. Informed rules out a checkbox with no notice behind it.

Unconditional is the one that surprises product teams. If the only way to download a whitepaper is to accept a year of marketing email, the consent is arguably conditional on an unrelated purpose, and the consent is defective. Unambiguous and clear affirmative action rule out pre-ticked boxes, implied consent from a website visit, and silence. A pre-ticked box is not an action, and an action that the person did not take cannot be theirs.

Limited to the necessary data is a separate constraint that often gets missed. A newsletter signup needs an email address and perhaps a name. Asking for a phone number, a job title and a company size at the same moment, then reusing that data for outbound sales, exceeds both the purpose and the necessity. The form field is not neutral; it is a purpose claim.

Notice first: you cannot agree to what you were not told

Section 5 requires a notice before or alongside the request for consent. It has to describe the personal data being collected, the purpose, how the person can exercise their rights, and how they can complain to the Data Protection Board. The notice has to be available in English or any language listed in the Eighth Schedule, at the person’s choice, and it has to be clear and plain. A link to a forty-page privacy policy at the bottom of the page is not a notice in the statutory sense, although it can be an annexe to one.

The practical instrument is a notice version. Give every notice a number and a date, store it immutably, and record the version that was on screen when each consent was captured. When you rewrite the notice, you do not silently upgrade everyone’s consent. Either the change is editorial and the purpose is unchanged, or it is a new purpose and it needs a new request. Most companies discover this during a due diligence exercise, when a buyer asks which wording a contact agreed to and the answer is a screenshot from a former employee’s laptop.

Language deserves specific attention in India. A Hinglish notice that says we will send you offers and updates is not the same as a Hindi notice that names the purpose. If you collect consent in one language and send marketing in another, the person may not have understood what they agreed to. Store the language of the notice alongside the version, and serve the same language in the withdrawal path.

Granularity: one purpose per permission

Specific consent means a person can say yes to one thing and no to another. In practice that means separate permissions for separate purposes: order updates, product announcements, offers from partners, and messages on a different channel. Bundling them into a single checkbox is convenient for the form and useless as evidence, because the moment a person objects to one stream you cannot tell whether they ever agreed to the others.

The test is simple. Can the person decline the marketing emails and still receive the invoice? Can they accept order updates and refuse the newsletter? Can they choose email but not WhatsApp? If the answer to any of those is no, the consent is not specific and the form is doing the work that a contract clause should not be doing. The remedy is more checkboxes, each with its own purpose name, which is uglier and legally stronger.

Granularity also has a cost. Every additional permission is a decision the person has to make, and form completion falls as the number of decisions rises. The resolution is not to merge the permissions but to ask for fewer at the point of collection. Ask for the essential one, then offer the others later, in context, when the person has a reason to say yes. A permission requested at the moment it becomes useful is worth more than four requested at the moment of signup.

Double opt-in: what it proves and what it costs

Single opt-in records the act at the form. Double opt-in sends a confirmation message and records the act when the recipient clicks. The difference is mailbox control. A single opt-in can be produced by a typo, a prank, a bot or a purchased list with valid addresses. A confirmation click proves that whoever controls that inbox wanted the subscription, which is a materially stronger claim and the reason German courts and many European senders treat it as the default.

The cost is drop-off. Some people never open the confirmation, some land in spam, and some change their mind in the ten minutes it takes. That lost volume is the point: those were the people least likely to engage, and engagement is what keeps a sender out of the spam folder. A smaller list that opens is worth more than a larger list that reports. The trade is not free, and the right answer depends on the channel: double opt-in for a newsletter, single opt-in plus a clear welcome for a transactional-triggered flow.

There is a middle path that gets most of the benefit: single opt-in with a delayed welcome series and a hard rule that a contact who has never opened anything in ninety days is suppressed from campaigns. You keep the volume, you stop mailing the dead, and you preserve the record. What you do not get is proof of mailbox control, so if your acquisition includes any source you did not generate yourself, the confirmation is worth the drop.

Channel rules stack: WhatsApp and DLT in India

Email consent does not authorise WhatsApp. Meta’s business messaging policy requires the business to obtain opt-in before sending a marketing template, and the opt-in has to be at the business level, not bought or scraped. The person should know they are opting in to receive messages from a named business, and the opt-out path has to be present and honoured. A phone number collected for order delivery is not a marketing opt-in, even though it is the same number.

Commercial SMS in India is a separate regime. TRAI’s regulations on unsolicited commercial communication require registration on DLT, the use of registered headers and templates, and consent records that can be produced when a complaint is escalated. The template is what gets checked, so an opt-in that permits informational messages does not permit a promotional template. If the consent record says order updates and the template says flat twenty percent off, the mismatch is the finding.

The operational lesson is that consent should be modelled per channel and per purpose, not as a single boolean on the contact. A schema with one column called subscribed cannot express the four permissions a modern Indian brand actually holds. It will be forced into one value, and that value will be wrong for some subset of the list at exactly the moment someone asks.

The artefact: what a real opt-in record contains

A defensible record has nine fields: the identifier of the person, the purpose code, the channel, the notice version and language, the timestamp in a fixed timezone, the collection point such as a landing page or a POS terminal, the method such as a web form or a paper form later digitised, the evidence such as a form submission identifier or confirmation click, and the withdrawal path that was offered. If a paper form is involved, the scanned image is the evidence and the digitised row is the index.

Store the record append-only. Consent is a sequence of events, not a state that gets overwritten. A person who opted in on the first of March, changed preferences in June and withdrew in September has three events, and the history is what proves the withdrawal was honoured. An update-in-place column destroys exactly the information you need. This is the same reasoning behind a consent ledger, and it is worth building once, properly, because every channel will use it.

Under the DPDP framework, Consent Managers registered with the Board are intended to let a person give, manage, review and withdraw consent through a single interface. That model makes the artefact interoperable rather than company-specific, which is a strong argument for a clean purpose taxonomy now. If your purposes are named after internal campaign codes, no consent manager, auditor or successor system will be able to map them.

Withdrawal has to be as easy as the yes

A permission that cannot be reversed is not consent. The DPDP Act requires that withdrawal be as easy as giving consent, and that the consequences of withdrawal be explained. In practice this means the exit must be available on the channel where the message arrived, in the language of the notice, without a login and without a survey. If opting in took one tap on a landing page and opting out takes a phone call during business hours, the design is non-compliant and everyone involved knows it.

Withdrawal is also not the same as deletion. A person who withdraws from marketing may still be a customer whose invoices must be retained for tax purposes, and the law allows retention where another law requires it. What must stop is the processing for the purpose they withdrew from. A hashed suppression record, kept solely to honour the withdrawal, is a legitimate retention and is usually the only way to avoid re-contacting someone by accident.

The two mechanisms should share plumbing. Opt-in writes an event with a purpose; withdrawal writes a later event for the same purpose; every sender reads the current state before sending. If opt-in lives in the marketing platform and withdrawal lives in the email provider, the two will disagree, and the disagreement will surface as a message to someone who has already left.

What opt-in is not: four convenient fictions

The first fiction is that business email is exempt. The DPDP Act protects personal data of individuals, and a named person at a company is an individual. A generic role address may not identify a person, but a first name and a work email usually do. There is no general business-to-business carve-out, and a purchased list of Indian work addresses is not a lawful basis.

The second is that an existing customer relationship authorises everything. It authorises the purpose the data was collected for, and the Act does provide legitimate uses in specific situations such as employment, legal obligations and medical emergencies. It does not contain a general legitimate-interest balancing test of the kind GDPR practitioners are used to, which means you cannot self-certify a marketing purpose as legitimate. If you want to market a new category to an existing customer, ask.

The third is that a pre-ticked box, a banner that says by continuing you agree, or a terms-of-service clause counts as an affirmative action. None of them does. The fourth is that consent collected by a partner or an affiliate transfers to you because a contract says so. It does not. The notice has to name the entity that will send, and the person has to have agreed to that entity.

These fictions survive because they are cheap and because enforcement has been slow. They also collapse all at once, usually during a funding round, an acquisition or a complaint to the Board, when someone asks for the artefact and there is a spreadsheet with a column called opted in and a date that predates the current privacy policy.

Measuring opt-in quality, not list size

Opt-in rate is a form metric and it rewards bad behaviour. A confusing modal with a large green button will produce a high rate and a low-quality list. The metrics that predict whether the list is an asset are downstream. Confirmation rate, where double opt-in is used, tells you how many people meant it. Ninety-day open or reply rate tells you whether they still want it. Complaint rate per thousand delivered tells you how many regret it, and complaint rate by acquisition source tells you which source is producing the regret.

Segment everything by source. A list built from a webinar, a checkout flow, a retail insert and a lead-gen partner will have four different engagement curves, and the blended number hides all of them. When a source produces contacts who never open and occasionally complain, the correct action is to stop using the source, not to send more campaigns to lift engagement. Buying volume to fix a quality problem is how sender reputation dies.

Finally, measure the age of your permissions. A consent given four years ago for a purpose that no longer exists is not a current permission, and a re-permission campaign is cheaper than the reputational cost of mailing people who have forgotten who you are. Set a review horizon, typically twelve to twenty-four months for a promotional list, and treat silence as a signal rather than a licence.

Worked example: a five thousand contact starter list

Take a small D2C brand on the Starter plan, which includes 5,000 marketing contacts and 25,000 emails a month at ₹2,999 plus 18% GST, or ₹3,538.82 on the invoice. The founder has a spreadsheet of 4,200 addresses from three years of pop-ups, a marketplace export and one list bought before anyone read the DPDP text. The temptation is to import all of it and send a Diwali campaign, because the plan already pays for the contacts.

The defensible sequence is slower and smaller. Import only the addresses with a source and a date, which might be 1,800. Send a re-permission message to those, describing what will be sent and offering a one-click exit, and treat anyone who does not respond within thirty days as unsubscribed rather than as a soft yes. Run double opt-in on new signups from that point. The list shrinks to perhaps 900 engaged contacts, and those 900 are the ones who will open the Diwali campaign.

The arithmetic is uncomfortable and it is still correct. Mailing 4,200 addresses where 2,400 were never given with a purpose produces a complaint spike, a spam placement problem that lasts months, and no defensible answer if someone asks. Mailing 900 people who asked produces a smaller campaign with a real open rate and a list that can grow. The permission, not the contact count, is the asset, and the invoice is the same either way.