Digital Consent in India: Legal Evolution from Traditional Contracts to Data Protection

Introduction

The evolution of consent from a traditional contractual principle to its contemporary digital manifestation represents one of the most significant transformations in contract law. In the digital age, digital consent in India has moved beyond the classical formalities of physical signatures and face-to-face negotiations to encompass electronic interactions, digital signatures, and online acceptances. This transformation reflects not merely a change in medium but a fundamental reimagining of how mutual agreement is established, authenticated, and enforced in commercial transactions. The Indian legal framework has responded to this metamorphosis through a combination of traditional contract principles enshrined in the Indian Contract Act, 1872, and modern legislation including the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023. Understanding this evolution requires examining both the continuity of foundational principles and the adaptations necessary for the digital realm.

The Traditional Foundation of Consent in India

The Indian Contract Act, 1872 establishes consent as a cornerstone of valid contractual relationships. Section 13 of the Act defines consent as occurring when two or more persons agree upon the same thing in the same sense, a principle known as consensus ad idem [1]. This requirement ensures that parties share a genuine meeting of minds regarding the essential terms of their agreement. The Act goes further in Section 14 to distinguish between mere consent and free consent, stipulating that consent is said to be free when it is not caused by coercion, undue influence, fraud, misrepresentation, or mistake. These provisions establish that valid consent must be voluntary, informed, and uninfluenced by improper pressures or deceptions.

The traditional understanding of consent emphasized physical manifestations of agreement such as signed documents, witnessed exchanges, and formal ceremonies. These tangible markers provided clear evidence of contractual intention and helped prevent disputes about whether agreement had been reached. The physical nature of traditional consent mechanisms also imposed practical limitations on the speed and geographical scope of commercial transactions, as parties typically needed to be in the same location or exchange physical documents through relatively slow communication channels.

Digital Transformation of Consent Mechanisms in India

The advent of electronic commerce necessitated a fundamental reconsideration of how consent could be manifested and authenticated in digital environments. This transformation raised critical questions about whether agreements formed through electronic means could satisfy the requirements of traditional contract law, particularly regarding the authenticity of parties’ identities and the integrity of their expressed intentions. The legal framework needed to address whether an email exchange, a website click, or a digital signature could constitute valid consent equivalent to traditional written agreements.

The Information Technology Act, 2000 provided the legislative foundation for recognizing electronic forms of consent in India [2]. This Act was enacted to give legal recognition to transactions carried out by means of electronic data interchange and other means of electronic communication, commonly referred to as electronic commerce. The Act established that contracts could be formed through electronic means and that electronic records and digital signatures would have legal validity equivalent to paper documents and handwritten signatures.

Section 10A of the Information Technology Act, 2000 explicitly recognizes the validity of contracts entered into through electronic means [3]. This provision states that where in a contract formation, the communication of proposals, the acceptance of proposals, the revocation of proposals and acceptances are expressed in electronic form or by means of an electronic record, such contract shall not be deemed to be unenforceable solely on the ground that such electronic form or means was used for that purpose. This provision removes any doubt about the legal enforceability of electronic contracts, provided they satisfy the essential requirements of the Indian Contract Act, 1872.

Electronic Signatures and Authentication

A central challenge in the digital transformation of consent in india has been establishing reliable methods for authenticating the identity of parties and ensuring the integrity of their expressed intentions. The Information Technology Act, 2000 addresses this challenge through its provisions on electronic signatures and digital signatures. Section 2(1)(ta) of the Act defines electronic signature as authentication of any electronic record by a subscriber by means of the electronic technique specified in the Second Schedule and includes digital signature [4]. Digital signatures use cryptographic techniques involving asymmetric key pairs to verify the authenticity and integrity of electronic documents.

The legal framework provides that electronic signatures issued by licensed certifying authorities carry a presumption of authenticity under Indian evidence law. Section 85B of the Indian Evidence Act, 1872, as amended, provides that courts shall presume the electronic signature is affixed by the person by whom it purports to have been affixed unless the contrary is proved. This presumption significantly reduces the burden of proof for parties seeking to enforce electronically signed contracts, as they do not need to establish the authenticity of the signature unless specifically challenged.

The practical effect of these provisions is to place electronic signatures on equal legal footing with handwritten signatures for most commercial purposes. Organizations conducting business electronically can rely on digital signatures to authenticate contracts, purchase orders, and other commercial documents without requiring physical signatures. This has facilitated the growth of electronic commerce by removing legal uncertainty about the enforceability of digitally signed agreements.

Judicial Recognition of Electronic Consent

The evolution of consent in the digital age has been significantly shaped by judicial interpretation of how traditional contract principles apply to electronic communications. The landmark case of Trimex International FZE Ltd. v. Vedanta Aluminium Ltd. (2010) represents a watershed moment in the judicial recognition of electronic consent [5]. In this case, the Supreme Court of India addressed whether a contract had been validly formed through an exchange of emails between parties negotiating the supply of bauxite.

The facts of the case involved Trimex offering to supply bauxite to Vedanta through email communications, which Vedanta accepted after several email exchanges confirming the supply of five shipments. Although a formal written contract had been drafted, it had not been executed before disputes arose. Vedanta subsequently denied the existence of a binding contract, arguing that no formal agreement had been signed. The Supreme Court rejected this argument and held that a valid contract had been concluded through the email exchanges.

The Court’s reasoning emphasized that once essential terms including price, quantity, product specifications, delivery and payment terms, discharge port, shipment lots, demurrage rate, and quality benchmarks had been agreed upon through email communications, a binding contract came into existence. The Court found that the minute-by-minute email correspondences between the parties clearly demonstrated that both parties were aware of the various terms and were in agreement regarding those terms. The communication of acceptance was complete when Vedanta’s email stating “we confirm the deal for five shipments” came to the knowledge of Trimex, satisfying the requirement of absolute and unconditional acceptance under Section 7 of the Indian Contract Act, 1872.

This decision established several important principles regarding electronic consent. First, it confirmed that emails constitute valid means of communicating offers and acceptances under contract law. Second, it held that the absence of a formally signed document does not invalidate a contract when the essential terms have been agreed upon through electronic communications. Third, it recognized that the exchange of emails can provide sufficient evidence of consensus ad idem, or meeting of minds, between parties. These principles have provided a solid foundation for the enforceability of contracts formed through electronic communications in India.

Free Speech and Digital Expression

The evolution of digital consent in India has intersected with fundamental rights in unexpected ways, as illustrated by the landmark case of Shreya Singhal v. Union of India (2015) [6]. While this case primarily concerned freedom of speech rather than commercial contracts, it has important implications for understanding consent in digital environments. The case challenged Section 66A of the Information Technology Act, 2000, which criminalized sending offensive messages through electronic communication services.

The Supreme Court struck down Section 66A as unconstitutional, finding it violated the right to freedom of speech and expression guaranteed under Article 19(1)(a) of the Constitution of India. The Court held that the provision was vague and overbroad, using undefined terms such as offensive, menacing, annoyance, and inconvenience that could encompass a vast amount of protected speech. Justice Nariman, writing for the Court, emphasized that restrictions on speech must be narrowly tailored and clearly defined, not capable of arbitrary application by law enforcement authorities.

This decision has implications for digital consent because it recognizes that individuals’ expressions and communications in digital environments deserve the same constitutional protections as traditional forms of communication. When individuals provide consent through digital means, whether for contracts or data processing, their ability to express themselves freely and without fear of arbitrary prosecution is protected. The decision also establishes that laws regulating digital conduct must be clearly defined and not susceptible to vague or arbitrary application, a principle that extends to regulations governing how consent is obtained and expressed in digital contexts.

Data Protection and Informed Consent

The most recent and comprehensive evolution of digital consent in India appears in the Digital Personal Data Protection Act, 2023, which came into force through phased implementation beginning in November 2025 [7]. This Act fundamentally reconceptualizes consent as it applies to the processing of personal data in digital form. Unlike earlier legislation that focused primarily on commercial transactions, the Digital Personal Data Protection Act centers on the relationship between individuals as data principals and organizations as data fiduciaries who process personal data.

Section 6 of the Act requires that consent for processing personal data must be free, specific, informed, unconditional, and unambiguous with a clear affirmative action [8]. This standard represents a significant evolution from traditional contract law concepts of consent. The requirement that consent be specific means that blanket permissions for undefined purposes are insufficient; data fiduciaries must obtain consent for each distinct purpose for which they intend to process personal data. The informed requirement mandates that individuals receive clear notice of what personal data is being collected, for what purposes, and what consequences may follow from providing consent.

The unconditional nature of required consent under the Act means that data fiduciaries cannot condition the provision of services on consent to data processing that is unnecessary for providing those services. For example, an e-commerce platform cannot require customers to consent to sharing their purchase history with third parties for marketing purposes as a condition of making a purchase if such sharing is not necessary to complete the transaction. This prevents the coercive bundling of necessary and unnecessary data processing under a single consent framework.

The requirement for clear affirmative action ensures that consent cannot be inferred from silence or inaction. Pre-checked boxes, default opt-ins, and similar mechanisms do not constitute valid consent under the Act. Instead, individuals must take a positive action such as clicking a button or selecting an option to indicate their agreement to data processing. This requirement recognizes that in digital environments, interface design choices can strongly influence behavior, and genuine consent requires active choice rather than passive acceptance of default settings.

Regulatory Framework and Compliance Requirements

The Digital Personal Data Protection Rules, 2025, published in November 2025, provide detailed operational requirements for obtaining and managing consent under the Digital Personal Data Protection Act [9]. These rules establish a phased implementation timeline extending through May 2027, giving organizations time to adapt their consent mechanisms and data processing practices to the new requirements. The rules specify that privacy notices must be provided in clear and plain language, available in English or any of the twenty-two languages listed in the Eighth Schedule of the Constitution of India.

Data fiduciaries must provide itemized descriptions of the personal data they collect and specific explanations of the purposes for which each category of data will be processed. The rules require that privacy notices include readily accessible means for individuals to withdraw consent, exercise their rights under the Act, and file complaints with the Data Protection Board of India. This emphasis on accessibility and clarity reflects a recognition that consent is meaningful only when individuals genuinely understand what they are agreeing to and can exercise control over their personal data.

The rules establish special protections for children and persons with disabilities, requiring verifiable parental or guardian consent before processing their personal data. Data fiduciaries must implement age verification mechanisms and may not engage in behavioral monitoring, tracking, or targeted advertising directed at children. These provisions recognize that certain populations require enhanced protections because they may be less able to provide informed consent or more vulnerable to manipulation through data processing practices.

Intersection of Contract and Data Protection Law

The contemporary legal framework governing digital consent in India now operates at the intersection of three major legislative schemes: the Indian Contract Act, 1872, the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023. These frameworks are complementary but address different aspects of consent in digital environments. The Indian Contract Act provides the foundational principles of offer, acceptance, and free consent that apply to commercial transactions regardless of the medium through which they occur. The Information Technology Act establishes the legal validity of electronic forms and signatures for conducting those transactions. The Digital Personal Data Protection Act imposes specific requirements on how consent must be obtained for processing personal data, which often occurs as part of digital transactions.

This intersection creates both opportunities and challenges for organizations operating in digital environments. On one hand, the legal framework provides clear recognition that digital forms of consent are valid and enforceable, facilitating electronic commerce and data-driven services. On the other hand, organizations must navigate multiple layers of requirements to ensure their consent mechanisms satisfy the standards of all applicable legal frameworks. A digital service provider, for example, must ensure that its terms of service constitute a valid contract under traditional principles, that electronic signatures are obtained in compliance with the Information Technology Act, and that consent for data processing meets the heightened standards of the Digital Personal Data Protection Act.

Practical Implications of Digital Consent in Indian Commerce

The evolution of consent from traditional contractual principles to digital performance mechanisms in India has significant practical implications for how organizations design their digital interfaces and business processes. Organizations must implement consent mechanisms that are not only legally compliant but also user-friendly and aligned with business objectives. This requires careful attention to interface design, information architecture, and the user experience of providing consent.

Best practices for obtaining digital consent include providing layered privacy notices that offer brief summaries with options to access detailed information, using clear and simple language rather than legal jargon, presenting consent requests at contextually appropriate moments rather than overwhelming users with information at initial registration, and providing granular choices that allow users to consent to specific data processing purposes rather than offering only all-or-nothing consent options. Organizations should also implement robust consent management systems that track when and how consent was obtained, what specific purposes were consented to, and when consent was withdrawn or expired.

The requirement for ongoing consent management represents a significant operational challenge. Unlike traditional contracts where consent is typically obtained once at the formation of the relationship, digital consent under data protection law is dynamic and revocable. Individuals have the right to withdraw consent at any time, requiring organizations to implement systems that can process withdrawal requests and cease the relevant data processing activities. Organizations must also be prepared to renew consent when purposes change or when legal requirements mandate periodic reconfirmation of consent.

Conclusion

The transformation of consent from a traditional contractual principle to a digital performance mechanism represents a fundamental evolution in how commercial relationships are formed and maintained. This evolution preserves core principles of voluntary agreement and meeting of minds while adapting them to the realities of electronic commerce and data-driven services. The Indian legal framework has responded to this transformation through a combination of legislative innovation and judicial interpretation, establishing that electronic forms of consent are legally valid while imposing enhanced requirements to ensure such consent is genuinely informed and freely given.

The contemporary landscape of digital consent in india is characterized by the intersection of multiple legal frameworks that complement and reinforce each other. The Indian Contract Act, 1872 provides timeless principles of offer, acceptance, and free consent that continue to govern commercial relationships regardless of medium. The Information Technology Act, 2000 removes legal barriers to electronic transactions by recognizing the validity of electronic records and signatures. The Digital Personal Data Protection Act, 2023 imposes heightened standards for consent in the context of personal data processing, reflecting increased societal awareness of privacy concerns in the digital age.

Looking forward, the evolution of consent is likely to continue as new technologies and business models emerge. Artificial intelligence, machine learning, and automated decision-making systems raise novel questions about how consent can be obtained and maintained when data processing purposes may change or evolve over time. The rise of decentralized technologies and blockchain-based systems may create new mechanisms for expressing and managing consent. The legal framework will need to continue adapting to ensure that the fundamental principle of voluntary, informed agreement remains meaningful in increasingly complex digital environments.

Organizations operating in digital environments must recognize that obtaining valid consent is not merely a legal compliance exercise but a fundamental aspect of building trust with customers and users. Consent mechanisms that are transparent, user-friendly, and respectful of individual autonomy not only satisfy legal requirements but also contribute to positive user experiences and long-term business relationships. As digital commerce continues to grow and evolve, the ability to obtain and manage consent effectively will remain a critical organizational capability that bridges legal compliance, user experience, and ethical data practices.

References

[1] Indian Contract Act, 1872, Section 13 & 14. Available at: https://www.indiacode.nic.in/bitstream/123456789/2187/2/A187209.pdf 

[2] Information Technology Act, 2000. Available at: https://www.indiacode.nic.in/handle/123456789/1999 

[3] Information Technology Act, 2000, Section 10A. Available at: https://www.meity.gov.in/content/information-technology-act-2000 

[4] Information Technology Act, 2000, Section 2(1)(ta). Available at: https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf 

[5] Trimex International FZE Ltd. v. Vedanta Aluminium Ltd., (2010) 3 SCC 1. Available at: https://indiankanoon.org/doc/658803/ 

[6] Shreya Singhal v. Union of India, (2015) 5 SCC 1. Available at: https://indiankanoon.org/doc/110813550/ 

[7] Digital Personal Data Protection Act, 2023. Available at: https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf 

[8] Digital Personal Data Protection Act, 2023, Section 6. Available at: https://prsindia.org/billtrack/digital-personal-data-protection-bill-2023 

[9] Digital Personal Data Protection Rules, 2025. Available at: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190655