Rethinking Consent: A Critical Study of Consent Mechanisms in Mobile Applications Under Indian Data Protection Law

The smartphone, not the desktop browser, is now the principal site at which Indian data principals encounter data processing. This paper undertakes a critical study of the consent mechanism embedded in the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, with specific reference to its operation inside mobile applications. It argues that while the statute constructs a formally consent-centric regime — dispensing with any "legitimate interest" basis and mandating granular, itemised, revocable consent — the architecture was conceived without adequate reference to the technical and interface realities of the mobile ecosystem: the coexistence of operating-system permission layers with statutory consent layers, the opacity of embedded third-party software development kits, and the susceptibility of small-screen interfaces to dark-pattern design. The paper traces the doctrinal foundations of the consent requirement, examines its statutory architecture, evaluates its operation in the mobile context, situates it comparatively against the General Data Protection Regulation and the California Consumer Privacy Act, and concludes with regulatory recommendations for the phased implementation period running to May 2027.