Designing consent and approval

India’s Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 (G.S.R. 846(E)). They give effect to the DPDP Act, 2023, with eighteen months for phased compliance. Every Data Fiduciary must give a separate, clear and easy-to-understand consent notice that explains the specific purpose for which personal data is collected and used.

The Act also sets the standard for leaving. Where consent is the basis for processing, a person may withdraw it at any time, “with the ease of doing so being comparable to the ease with which such consent was given.”

What we check: that a CRM can answer three questions about any contact: what they agreed to, when they agreed and through which notice. And that unsubscribing takes no more steps than signing up did.

The European Accessibility Act has applied since 28 June 2025. Products and services in its scope must meet its accessibility requirements to be sold in the EU. These include e-commerce, banking services, e-books, computers, smartphones and ticketing machines. Some services already in use have transition periods.

In practice, teams work to WCAG. The European standard EN 301 549 (V3.2.1) bases its web content requirements on WCAG 2.1 level AA. A revision based on WCAG 2.2 is in preparation.

What we check: that consent itself is accessible. Cookie banners, preference centres and sign-up forms are among the least accessible parts of most sites. A choice a person cannot operate is not a choice.

An AI agent that can send, buy, book or delete makes decisions on someone’s behalf. OWASP calls the failure Excessive Agency (LLM06:2025) and traces it to three root causes: excessive functionality, excessive permissions and excessive autonomy.

1. Sort every tool an agent can call into read, reversible and irreversible.
2. Let read and reversible actions run, and log them.
3. Have a named person approve every irreversible action, with the agent’s reasoning and the data it used on screen.

The record matters as much as the approval. Log every approval, refusal and override with who made it and what they saw, so each decision can be explained to the customer it affected.

What we check: that the approval step shows enough for a person to say no. An approve button with no context is a rubber stamp.

The last thing a reader sees from a brand is often its unsubscribe page. Gmail expects one-click unsubscribe from bulk senders. RFC 8058 defines how a mail client does it with a single HTTPS POST request, so a link scanner cannot unsubscribe someone by accident.

We built this newsletter’s sign-up and unsubscribe to the same standard. A confirmation email comes first, and you choose your topics with nothing pre-ticked. To leave, use one-click unsubscribe where your mail app supports it, or the link in every issue. A page confirms you have left without asking why.

What we check: that leaving is as well designed as joining. People remember both.