Data Sharing Consent Management - Detailed Explanation

Consent Management is the legal and technical process of obtaining, recording, managing, and proving user permission for collection, processing and sharing of personal data. Under modern privacy laws, it is not a checkbox - it is a governance system.

1. Core Concept

Data Sharing = Any disclosure of personal data to a third party distinct from the Data Controller / Data Fiduciary - ad networks, analytics vendors, payment processors, affiliates, data brokers.

Consent Management for sharing must answer 4 questions:

1. Who is sharing with whom?
2. What data categories?
3. Why - for what specific purpose?
4. How long and how to withdraw?

Under GDPR Article 4(11), consent is "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement".

2. Principles of Valid Consent - Universal Test

All major laws converge on this:

a) Freely given: No coercion, no detriment for refusal. You can't charge more or block service if user refuses non-essential sharing.
b) Specific: Separate consent for each purpose. Marketing vs analytics vs third-party sharing cannot be bundled.
c) Informed: Who you are, what data, why, retention period, third parties, right to withdraw. Vague language fails.
d) Unambiguous: Active opt-in. Pre-ticked boxes do not count.
e) Provable & Withdrawable: Controller must prove consent was obtained, and withdrawal must be as easy as giving it. This includes managing preferences at any time.

3. Legal Frameworks

A. EU GDPR + ePrivacy Directive
Strict opt-in model before any non-essential collection or sharing. Article 7 sets conditions for consent. ePrivacy requires consent for cookies/trackers.

B. US CCPA/CPRA
Opt-out model. Consent not required before collection except for under-16, but you must provide clear right to opt-out of sale/sharing.

C. India - Digital Personal Data Protection Act, 2023
This is now the most relevant for Delhi. The DPDP Act is consent-centric and builds directly on K.S. Puttaswamy v. Union of India (2017) 10 SCC 1, where Supreme Court held right to privacy is a fundamental right under Article 21.

Key innovations:

• Data Principal & Data Fiduciary model with trust and accountability.
• Consent must be free, specific, informed, unconditional, unambiguous.
• Section 6: Notice must be in plain language + itemized purposes.
• Consent Manager: A new regulated entity (Section 7) - an interoperable platform where a user can give, review, withdraw consent across multiple fiduciaries in one place. This is unique to India.
• Consent fatigue recognized as a legal risk - repetitive complex requests lead to uninformed decisions.
• Section 5(2): Even consent obtained before Act must be re-validated.

4. Consent Management Lifecycle

1. Discovery: Map all data flows and third parties.
2. Notice Layer: Layered privacy notice, granular purposes.
3. Capture: Consent Management Platform (CMP) - banner with Accept/Reject per purpose/vendor, no dark patterns.
4. Record: Timestamp, purpose, text shown, identity, proof.
5. Enforcement: Tag manager / SDK blocks third-party scripts until consent.
6. Sharing Control: For each third party, maintain Data Processing Agreement + TC String or consent signal pass-through.
7. Withdrawal & Audit: One-click dashboard, 72hr propagation to downstream vendors.

5. Landmark Case Laws

1. Planet49 GmbH (C-673/17) - EU, 2019

Facts: Planet49 used pre-ticked checkbox for cookies for online lottery.
Holding: CJEU held consent via pre-ticked box is invalid. Consent must be active opt-in. User must be informed about retention period and third-party access. Duration and whether cookies contain personal data is irrelevant.
Impact: Killed all pre-ticked consent boxes across EU.

2. Fashion ID GmbH & Co. KG v Facebook (C-40/17) - EU, 2019

Facts: Website embedded Facebook Like button, transmitting visitor data to Facebook without notice.
Holding: Website operator embedding third-party plugin is joint controller with Facebook for collection and transmission.
Impact: If you share data via SDK/plugin, YOU are liable for consent, not just the third party.

3. Orange România SA (C-342/21)

Facts: Orange required customers to sign contract containing consent clause for ID copy retention, with box saying they didn't consent if ticked.
Holding: Consent is not freely given if you must actively refuse. Controller must prove active behavior. Preselected or pre-ticked boxes categorically do not meet threshold.

4. IAB Europe - Transparency & Consent Framework (Belgian DPA 2022, CJEU C-604/22, Brussels Court of Appeal 2025)

Facts: IAB's TCF is used by 80% of EU websites to store consent signals (TC String) for Real-Time Bidding.
Holding: Belgian DPA fined €250,000 and ruled TCF violates GDPR. CJEU March 2024 (C-604/22) confirmed TC String is personal data and IAB Europe is a controller. 14 May 2025 Court upheld that TCF did not ensure informed, freely given, specific consent.
Impact: The backbone of adtech consent is illegal in current form. CMPs must be rebuilt.

5. Meta Platforms v Bundeskartellamt (C-252/21) - EU, 2023

Facts: German competition authority challenged Meta combining Facebook data with off- Facebook data (Instagram, WhatsApp, third-party websites).
Holding: Such combination only allowed with valid consent. Personalization does not make extensive collection contractually necessary unless objectively indispensable.
Impact: "Contract necessity" cannot be abused for data sharing.

6. Meta Ireland DPC Decisions - 2023 & 2025

Facts: Meta hid behavioral ad consent inside Terms of Service.
Holding: Irish DPC fined €390M in Jan 2023 for forcing users into personalized ads. EU Commission added €200M in 2025 for "Pay or OK" model - pay fee or consent to tracking - no genuine alternative.
Impact: Pay-for-privacy models are being struck down.

7. Grindr & Xandr Cases - Norway

Facts: Grindr shared user location and app identifier (indicating sexual orientation) with ∼100 ad partners including Xandr.
Holding: Norwegian DPA fined Grindr 65M NOK (€6.5M) in Dec 2021 for sharing without valid consent. Grindr's consent screen did not meet voluntariness. In 2024-25, Xandr fined record NOK 92M (€8.6M / $9.6M) as joint controller - it assumed Grindr had consent but failed to verify.
Impact: Data sharing chain liability: downstream vendor must independently verify consent and cannot rely on assumption.

8. K.S. Puttaswamy (Retd.) v Union of India (2017) - India

Facts: Challenge to Aadhaar scheme.
Holding: 9-judge bench unanimously held privacy is fundamental right under Articles 14,19,21. Laid proportionality test for State interference.
Impact: Genesis of entire DPDP Act 2023. Any data sharing without informed consent violates Article 21.

9. WhatsApp - Ireland DPC €225M (2021)

Facts: WhatsApp sharing data with Facebook group without transparent notice.
Holding: Violation of transparency obligations for data sharing - notices were opaque.
Impact: Notice for sharing must be specific about what is shared with which group company.

10. Clearview AI - Multiple EU DPAs (2022-23)

Facts: Scraping public facial images and selling to law enforcement.
Holding: France, Italy, Greece fined €20M+ each - no valid legal basis for sharing biometric data.
Impact: Publicly available data is still personal data; sharing needs consent.

6. Compliance Checklist for Data Sharing in India

1. Build Data Flow Map: Document all third-party sharing.
2. Implement DPDP-compliant notice in English + 22 languages.
3. Deploy Consent Manager integration - allow users to manage consent centrally.
4. Purpose granularity: Separate toggles for analytics, marketing, third-party sharing.
5. No pre-ticked boxes, no cookie walls.
6. Maintain consent proof logs for Data Protection Board audit.
7. DPA clauses with all third parties + obligation to delete on withdrawal.
8. Breach notification within 72 hours to Board if shared data compromised.