Legal, Risk & Compliance · Module
Consent Management
What each person was told, agreed to and withdrew, enforced everywhere data is used
Consent Management gives the tenant one defensible record of notices, grants and withdrawals per person and purpose. Enforcement runs at the Action Bus, and withdrawal is designed to propagate to every app and agent.
What it does
Consent Management is designed to give the tenant one defensible record of what each person was told, what they agreed to and what they withdrew, and to enforce it everywhere personal data is used across One3. The ledger itself is the platform consent record. This module never writes it directly; it calls the platform consent Actions and stores the returned record id, so there is exactly one consent ledger in the tenant.
Purposes and notices
A purpose registry lists purposes such as marketing email, WhatsApp marketing, voice calls, profiling, likeness use and background verification, each with lawful basis, data categories, retention, owning app and jurisdiction. The notice builder produces versioned notices per purpose set, entity and language, with plain-language sections required by the configured regime and approval before publishing. Notices in Indian languages use reviewed translations, and the person chooses the language.
Capture and withdrawal
Consent can be captured through an embeddable web widget, form fields, a portal step, a WhatsApp opt-in flow, a voice consent script, in-person tablet capture or the API. Each grant, denial or withdrawal records notice version, channel, contact point, evidence, time and actor, and the person receives a receipt. Withdrawal works through the preference centre, a link in every message, a WhatsApp keyword, voice, email reply parsing or a staff-recorded request.
Enforcement and propagation
The Action Bus checks consent before any personal-data Action tagged with a consent-gated purpose, and fails closed. A withdrawn event is consumed by Marketing, CRM, Service Desk, agents, the Avatar Rights Registry and Voice; queued sends are cancelled and confirmations recorded. The enforcement check is deterministic code, never AI.
GA and later
GA adds children and guardian consent flows, integration with registered Consent Managers (to be verified), cookie and SDK consent for tenant sites, consent analytics, re-consent campaigns and a register of non-consent bases. Expiry and refresh, agency sub-account views and global jurisdiction packs follow in W4. Planned for W3 (Year 2); DPDP mapping must be verified with counsel.
Features
What Consent Management includes
Purpose registry
Purposes with lawful basis, data categories, retention, owning app and jurisdiction.
Notice builder with versions
Immutable notice versions per purpose set, entity and language with approval before publish.
Capture points
Web widget, forms, portal step, WhatsApp opt-in, voice script, tablet capture and API.
Consent ledger writes
Grant, deny and withdraw per purpose with notice version, channel, contact point, evidence, time and actor.
Withdrawal everywhere
Preference centre, message links, WhatsApp keyword, voice, email reply parsing and staff-recorded requests.
Enforcement check
Action Bus consent check before personal-data Actions, cached per person and purpose, failing closed.
Propagation
Withdrawal events consumed by Marketing, CRM, Service Desk, agents and Voice, with queued sends cancelled.
Preference centre and receipts
OTP-verified portal showing current consents and history, with receipts for every grant and withdrawal.
Consent import
Historical consent with original timestamps, notice versions and evidence, marked as imported.
Indian-language notices
Reviewed translations through the Localization glossary, with the person choosing the language.
Children and guardians
Age gating and verifiable guardian consent linked to a guardian relationship.
Consent Manager and cookie consent
Honour artefacts from registered Consent Managers (to verify); cookie banners with category consent and script blocking.
Analytics and re-consent
Opt-in and withdrawal rates, enforcement blocks and propagation latency; re-consent campaigns when notices change.
Workflow
Capture and enforce
- 1
A purpose and a versioned notice are published after approval
- 2
A person sees the notice in their language at a capture point
- 3
The grant is recorded with evidence and a receipt is sent
- 4
Later Actions using that purpose pass the Action Bus consent check
- 5
Without valid consent, the Action is blocked
Workflow
Withdrawal propagation
- 1
The person withdraws through any channel
- 2
Keyword withdrawals apply immediately; free text becomes a staff proposal
- 3
The ledger records the withdrawal
- 4
Subscribed apps and agents receive the event and cancel queued sends
- 5
Confirmations are recorded and a receipt is sent
AI
AI skills and Digital Employees
Notice drafting and readability
Plain-language notice drafts checked against required sections; publish by a different approver.
Translation assistance
Glossary-based translation drafts, always reviewed before publish.
Withdrawal intent detection
Proposes withdrawals found in free-text replies; never applied without staff review.
Purpose mapping suggestions
Suggests purposes and data categories for new forms and capture points.
Digital Employees that use this module
They act through the same governed Actions as people; risky steps wait for approval.
Frequently asked questions
Is there one consent ledger or one per app?
One. Every app uses the platform consent ledger, and this module calls its Actions rather than keeping a copy.
Can AI decide whether consent exists?
No. The enforcement check is deterministic and fails closed. AI only drafts notices and proposes withdrawals found in free text.
Will it integrate with DPDP Consent Managers?
Integration with registered Consent Managers is planned for GA. Technical availability must be verified first.
What happens if our subscription lapses?
Consent enforcement never switches off. Data becomes read-only and exportable.
See Consent Management in your workflow
Tell us about your team and the outcomes you want. We will walk you through the apps, the Digital Employees and the plan for your industry.