The recently unveiled draft rules governing the Digital Personal Data Protection (DPDP) Act has opened a new space for a host of startups to enter — consent management.

Venture capital-backed startups such as Leegality, Signzy, IDfy, and 1Kosmos are positioning themselves to tap this opportunity, which industry experts predict could be worth thousands of crores of rupees in the coming years.

The DPDP Act mandates the establishment of consent managers, entities that would act as single-point contacts for individuals — referred to as data principals — to give, manage, review, and withdraw consent through transparent and interoperable platforms. This development provides an opportunity for startups offering tools to simplify and streamline consent management for businesses.

Consent managers will play a pivotal role in helping data fiduciaries comply with the DPDP Act, starting with notifying users about their existing data and obtaining explicit consent for its continued use.

Leegality, a document infrastructure company backed by investors such as IIFL Fintech Fund and Mumbai Angels, is one such firm which indicated its intent to tap this opportunity. “We’ve been working on consent governance since the DPDP Act was introduced. Once the application process opens, we plan to register as consent managers,” said Shivam Singla, founder and CEO of Leegality. Singla outlined potential pricing models, suggesting a per-user charge ranging between Rs 2-10 per consent. 

The company is currently conducting proof of concepts for consent management solutions across sectors like banking, financial services, and insurance (BFSI) and plans to commercially launch its product by April.

Another firm to express interest is Signzy, which is a leading provider of digital identity verification and onboarding solutions. It already offers digital consent collection as part of its services.

“The key role of a consent manager is to provide an interoperable platform adhering to common standards across industries,” Manish Bharvey, product manager at Signzy, told FE. He added that the product will evolve with industry requirements and highlighted the revenue potential for consent management providers.

Signzy envisions pricing models based on a per-consent charge or bundled offerings with pre-defined user limits. Companies may also charge for managing the consent portal itself.

Similarly, IDfy, with its consent governance suite Privy, is focusing on a broader scope of compliance.

“Obligations on data fiduciaries to collect user consent via consent managers are just one piece of the puzzle,” said Nikhil Jhanji, senior product manager at IDfy. He highlighted additional compliance requirements like third-party risks, data deletion by processors, and impact assessments.

According to Jhanji, while the consent manager business as a licensed entity may have limited profitability, offering a complete consent governance suite represents a more lucrative opportunity. He also stressed the importance of interoperability among consent managers to allow users to track and manage all their consents across industries through a unified platform.

Also, 1Kosmos, a blockchain-based identity and authentication platform, is exploring its options under the DPDP Act.

“Currently, we act as a quasi-consent manager for enterprises in the US, using biometric authentication to secure explicit consent,” said Siddharth Gandhi, COO-Asia Pacific at 1Kosmos.

In India, 1Kosmos serves 22 clients, including banks, providing biometric-based, passwordless authentication. The company is evaluating whether to register as a consent manager or assist businesses with compliance without formal registration. Gandhi outlined two billing models: a subscription-based consent services or transaction-based charges per user.

While startups estimate substantial revenue opportunities, they are wary of potential pricing caps by the government, which could constrain profitability. Analysts compare the emerging consent manager ecosystem to the account aggregator framework in the financial sector, which facilitates over 150 million consents per month.

The industry has also sought clarity on whether existing account aggregators can pivot into consent management under the DPDP Act.

Sectors such as BFSI, gaming, social media, retail, and telecom are expected to adopt consent management solutions early. However, startups are still awaiting final guidelines from the government to finalise their strategies.