Statutory Text (Official Gazette)
Section 6(1): The consent given by the Data Principal shall be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and shall signify an agreement to the processing of her personal data for the specified purpose and be limited to such personal data as is necessary for such specified purpose.
Illustration.—X, an individual, downloads Y, a telemedicine app. Y requests the consent of X for (i) the processing of her personal data for making available telemedicine services, and (ii) accessing her mobile phone contact list, and X signifies her consent to both. Since phone contact list is not necessary for making available telemedicine services, her consent shall be limited to the processing of her personal data for making available telemedicine services.
What Section 6(1) Means in Plain English
Section 6(1) is the legal foundation for every cookie banner, sign-up form, and tracking script in India. It establishes that consent must be an active, intentional choice by the user.
The 5 Legal Pillars of Section 6(1):
- Free: The user must have a genuine choice. You cannot penalize a user or deny them core access to your site simply because they refuse marketing cookies.
- Specific: Consent must be given for a defined task (e.g. “order delivery notifications”), not a blanket open-ended claim to “improve our services”.
- Informed: Before agreeing, the user must be told what data is collected, why it is needed, and how to contact your grievance officer.
- Unconditional: You cannot bundle marketing trackers into essential website functionality. If someone wants to read your blog or buy a product, you cannot require them to accept advertising pixels.
- Clear Affirmative Action:
- What is ILLEGAL: Continuing to browse, scrolling, pre-checked checkboxes, or banners saying “By continuing you accept”.
- What is LEGAL: The user clicking a dedicated button like “Accept” or “Save Preferences”.
Purpose Limitation (Data Minimization)
Under the final clause of sub-section (1), you can only collect the data points strictly required for that specific task. Collecting location coordinates for a basic calculator app directly violates Section 6(1).
Real-World Example: E-Commerce Store
- Non-Compliant Setup: An online store loads Facebook Pixel and Google Analytics the second a user arrives. The banner says “We use cookies, close to continue”. (Penalty Exposure: Section 6(1) violation up to ₹50 Crore).
- Compliant Setup: The store holds back all marketing scripts until the user clicks “Accept” on an itemized banner. Shopping cart and checkout cookies load normally as strictly necessary items.
Engineering Checklist for Section 6(1)
- Zero-latency script blocking: Ensure advertising tags (Meta Pixel, Google Ads, LinkedIn Insight) do not fire until the user clicks an affirmative button.
- Uncheck all optional boxes: Ensure all marketing and analytics toggles are unchecked by default.
- Data minimization review: Audit database schemas to remove unnecessary user attributes that are not required for your core service.
Check if your website complies with Section 6(1)
Scan your domain in seconds to detect tracking cookies, third-party analytics pixels firing before consent, and missing regional notices.