DPDP Consent for Mobile Apps: Android and iOS Guide

The short answer

The DPDP Act treats an app the same way it treats a website. If your Android or iOS app collects personal data from people in India, you need an itemised notice and valid consent before your analytics, attribution or ad SDKs start collecting. These duties apply from 13 May 2027.

OS permission prompts are not DPDP consent

Android runtime permissions and iOS prompts such as App Tracking Transparency ask for access to a device feature or for tracking. They do not tell users each purpose or the personal data you collect, and they do not give a way to withdraw that matches Section 6(4).

App store privacy labels (Google Play’s Data safety section, Apple’s privacy details) are disclosures to the store. They are useful, but they are not the notice Section 5 asks for.

You still need your own notice and consent screen inside the app.

What your app must do

1. Show an itemised notice on first launch

List each type of personal data and the purpose for it, how to withdraw consent, how to raise a grievance, and how to complain to the Board. Generate the wording with the free DPDP privacy notice generator.

2. Hold back SDKs until consent

Many SDKs start collecting the moment the app opens. Initialise analytics, attribution and advertising SDKs only after the user agrees to that purpose. Most major SDKs have a setting to delay collection or start with consent denied. Check each one.

3. Ask per purpose, with equal choices

Separate toggles for analytics, personalisation and advertising, none pre-ticked, with Accept and Reject equally visible. See dark patterns to avoid.

4. Offer Indian languages

Under Section 6(3), users must have the option to read the notice in English or any of the 22 Eighth Schedule languages.

5. Put withdrawal in settings

A “Privacy choices” screen in settings, reachable in a couple of taps, where users can change or withdraw consent at any time.

6. Keep proof

Record what notice version each user saw and what they chose, with a timestamp. Section 6(10) puts the burden of proof on you.

Children

If your app may be used by people under 18, Section 9 requires verifiable parental consent, and Section 9(3) bans tracking, behavioural monitoring and targeted advertising directed at children. Rule 10 sets out how to verify the parent. See verifiable parental consent.

Common app mistakes

• Ad SDKs that start on launch before any consent screen.
• A single “I agree to the Terms” checkbox covering everything.
• Withdrawal that needs an email to support.
• Notices only in English with no language option.
• Keeping data after the account is deleted. See handling deletion requests.

Web and app together

If you run a website and an app, keep consent in sync so a user who withdraws on one does not keep being tracked on the other. ConsentPlix handles consent on the web today and streams every decision through signed webhooks to your backend, which your app can read. Talk to us about your app setup.

Checked against Act No. 22 of 2023 and the DPDP Rules 2025, as of October 2026.