Consent Management for Telecom & ISPs
SecureCMS, the consent management platform by SecureDApp, helps internet service providers separate what their licence requires from what needs subscriber consent, record that consent across apps, franchisees and support channels, and keep audit-ready proof, built for the DPDP Act 2023 and DPDP Rules 2025.
DoT & DPDP Dual Compliance
Click to SimulateWhat is consent management for telecom and ISPs?
Consent management for telecom and ISPs is how an internet service provider records what each subscriber has agreed to beyond running their connection, such as marketing offers, OTT bundle sharing and usage analytics. SecureCMS, the consent management platform by SecureDApp, keeps these purposes separate from the KYC, log retention and interception duties your licence already requires, checks consent before data is used, and keeps tamper-proof records for DPDP audits.
The Section 6(10) Proof Mandate
Under the DPDP Act 2023, if a question ever comes up, the ISP has to prove that notice was given and consent was taken (section 6(10)). A signature on a paper CAF sitting in a franchisee drawer rarely proves consent for marketing or analytics.
The Telecom Billing Illustration
The DPDP Act's own illustration uses a telecom operator: a customer who switches from emailed bills to app-only bills, after which the operator and its processor must stop emailing. That is consent management in miniature, and it applies to every ISP.
Short, High-Speed Operational Flow
The subscriber deals with your self-care app, a franchisee or support. SecureCMS records the choice in one unified consent repository. Your billing, CRM, marketing tools and OTT partners check or receive that choice in real time.
DPDP obligations by ISP licence category
The DPDP Act applies the same way to every ISP, whether it holds a Category A national, Category B circle or Category C SSA authorisation. What changes with category is scale: national ISPs handle more subscribers and partners and are more likely to be notified as Significant Data Fiduciaries, while local ISPs often collect data through franchisees and cable partners.
Note: Under the Unified Licence, Category A is national, Category B covers a telecom circle or metro area, and Category C is an SSA (Secondary Switching Area, roughly district-level).
| Licence Category | Typical Profile | Main Consent Risk | SDF Likelihood | SecureCMS Fit |
|---|---|---|---|---|
Category A – NationalNational Authorisation | Large subscriber base, many partners, in-house compliance team | Marketing and OTT bundles at scale; usage analytics | Higher (may be notified as Significant Data Fiduciary) | Tenants with multiple apps, APIs, webhooks and an Auditor role; integrations scoped with your IT team |
Category B – Circle / MetroTelecom Circle / Metro | Regional brand, franchise or reseller network across telecom circle | Franchisee-collected KYC and consent across multi-city networks | Depends on subscriber scale and regional market dominance | Role-based access for franchise teams; OTP consent on partner journeys |
Category C – SSA (Local)SSA / District Level | Small team, local cable/LCO partners, cost-sensitive operations | Paper forms; WhatsApp-based collection and unverified signatures | Lower | Quick start with OTP on SMS or WhatsApp and a simple management dashboard |
What your licence requires vs what needs subscriber consent
ISPs do not need subscriber consent for processing that their licence or the law requires, such as customer verification (KYC), keeping IPDR and login logs for the required period, lawful interception and keeping data in India. Consent is needed for purposes beyond providing the connection, such as promotional offers, sharing data with OTT partners for bundles and analysing usage for marketing.
| ISP Purpose | Usual Legal Basis | What SecureCMS Does | Consent Required? |
|---|---|---|---|
| Subscriber KYC / customer verification | Licence and legal obligation | Records the purpose; no consent toggle (statutory notice only) | No (Licence Duty) |
| IPDR and login/logout logs (Min 2 years under DoT UL amendment of 21 Dec 2021) | Licence obligation | Keeps a legal-hold reason when subscriber erasure is requested | No (Licence Duty) |
| Lawful interception and government requests | Legal obligation | Sits strictly outside consent; authorized access is tamper-proof logged | No (Licence Duty) |
| Billing, installation, fault repair, outage alerts | Needed to provide the service (Contractual) | Kept completely apart from marketing channels | No (Licence Duty) |
| Plan upgrades and promotional offers (SMS, WhatsApp, calls) | Consent, plus TRAI commercial communication rules (TCCCPR) | Granular marketing opt-in; 1-click instant withdrawal | Yes (Opt-in) |
| Sharing data with OTT partners for bundles (Hotstar, SonyLIV, etc.) | Consent, or what the specific bundle chosen needs | Consent changes passed on instantly by API or webhook | Yes (Opt-in) |
| Usage analytics for marketing or profiling | Consent | Runtime check before data is sent to analytics pipelines | Yes (Opt-in) |
| Router/CPE diagnostics for network quality | Needed to provide the service | Strictly purpose-limited; prohibits marketing reuse | No (Licence Duty) |
| Referral programmes and customer rewards | Consent | Kept as a distinct, unbundled purpose toggle | Yes (Opt-in) |
IPDR and log retention vs erasure requests
When a subscriber leaves and asks for erasure, an ISP must delete data it no longer needs, but it must keep IPDR and login records for at least the period its licence requires. The Unified Licence sets that at a minimum of two years.
The DPDP Rules 2025 set a one-year floor for security logs and say a longer period under another law prevails, so for IPDR the licence figure is the one to follow. SecureCMS logs which records are held, the licence reason and the release date, and erases the rest.
Statutory Log Retention Hierarchy
Where ISPs collect subscriber consent
Subscriber consent is collected at many points, and the weak ones are usually the field and franchisee touchpoints rather than the app. Each row below is a place where an ISP typically loses the proof it will later need.
| Touchpoint | Common Problem Today | SecureCMS Solution |
|---|---|---|
| New connection form (field team or franchisee) | Paper KYC with one blanket signature covering connection and marketing | Mobile-based digital CAF with separate opt-in toggles and instant OTP proof |
| Local cable operator / LCO partners | No verifiable proof of what the subscriber actually agreed to | LCO partner portal with OTP verification sent directly to subscriber |
| Self-care app and website | Marketing and analytics opt-ins pre-ticked or bundled into terms | Unbundled, granular preference center with instant sync to billing |
| Call centre and WhatsApp support | Verbal or chat consent collected with no structured audit log | Agent-triggered SMS/WhatsApp consent approval links with real-time logs |
| Plan upgrades and OTT bundles | Subscriber data shared with third-party OTT partners without record | Automated partner webhook passing specific bundle entitlements only |
| Public Wi-Fi / hotspot login | OTP login mobile numbers harvested and reused for marketing blasts | Isolated hotspot consent directory; separate marketing opt-in checkbox |
| Existing subscriber base (Legacy) | Pre-DPDP forms that need fresh notice as soon as practicable (Section 5(2)) | Automated batch re-consent campaigns via WhatsApp & SMS with tracking |
Interactive Telecom & ISP Consent Engine Simulator
Test how SecureCMS locks statutory DoT licence duties, authenticates field franchisee CAF onboarding with OTP, executes partial erasure with 2-year IPDR legal holds, and dispatches sub-80ms OTT bundle webhooks.
Subscriber Consent Preference Center (ISP Self-Care / App)
Notice how DoT Unified Licence obligations are cryptographically locked, while commercial add-ons offer granular Section 6 consent toggles.
{
"subscriber_id": "SUB-TEL-98450",
"isp_licence_category": "CAT_B_CIRCLE",
"statutory_holds": {
"kyc_caf_status": "VERIFIED_DOT",
"ipdr_log_retention": "MANDATORY_24M",
"lawful_interception": "EXEMPT_FROM_CONSENT"
},
"consent_receipt": {
"marketing_promo": true,
"ott_bundle_sync": true,
"traffic_analytics": false,
"timestamp": "2026-10-17T06:00:00.000Z",
"immutable_hash": "0x89f4b...38ca"
},
"compliance_audit": {
"section_6_10_proof": "PASSED",
"tccCPR_aligned": true
}
}How SecureCMS manages consent for ISPs
SecureCMS keeps one consent record per subscriber across field teams, franchisees, apps and support. It separates licence duties from consent-based purposes, collects consent with OTP on email, SMS or WhatsApp, limits what each franchisee can see, passes opt-outs to marketing and partner systems in real time, and handles rights requests and grievances with DPO escalation.
| ISP Problem | SecureCMS Module | Operational Result |
|---|---|---|
| One signature on the connection form | Purpose Management, Data Catalogue & Templates | Separate consent captured per distinct business purpose |
| Franchisee-collected consent with no proof | OTP on Email/SMS/WhatsApp, Redirect & Embedded Flows | Cryptographically verified consent receipt with timestamp and IP |
| Franchisees see all subscribers in region | Multi-role RBAC, Tenant Separation & Admin Controls | Each partner team sees only what its operational role allows |
| Promotions continue after subscriber opt-out | Instant Revocation & API/SDK Runtime Validation | Consent checked in real-time before each outbound campaign |
| OTT partners out of sync on plan downgrades | Real-time Sync, Outbound Webhooks & Partner APIs | Partners receive consent changes and de-provision bundles promptly |
| Erasure vs 2-year IPDR retention conflict | DSR Automation, SLA Tracking & Policy Versioning | Partial erasure executed; licence-mandated IPDR logs locked for 2 years |
| Complaints and regulatory escalations | Grievance Management & DPO Escalation Workflows | Documented, legally compliant grievance trail with SLA tracking |
| Evidence for audit or Board review | Blockchain-backed Logs, Reports & Auditor Role | Exportable, read-only evidence dossier ready for DoT and DPB audits |
| Subscriber data scattered across billing and CRM | AI Data Discovery, Classification & Data Inventory | Complete data map showing where every subscriber attribute resides |
Separating Licence Duties from Consent
Tag KYC, IPDR and interception as licence-duty processing, and everything else as a consent purpose. Subscribers see notice for the first group and real choice for the second in English or Indian Eighth Schedule languages.
Franchisee & Cable Partner OTP
The franchisee enters the subscriber's mobile number or email, and the subscriber confirms with an OTP on SMS, email or WhatsApp. The ISP gets a verified record, whoever held the form.
Marketing & OTT Bundle Consent
Promotions, WhatsApp offers and bundle sharing each get their own purpose, and withdrawal is as easy as opting in. Partner webhooks pass revocations to streaming platforms in real-time.
Evidence Ready for Audits
Every consent event goes into tamper-proof logs. Compliance reports can be exported, and an Auditor role gives read-only access without touching live billing or network data.
Security and data localisation for ISPs
SecureCMS secures consent data in layers, and that matters because the DPDP Act makes the Data Fiduciary responsible for reasonable security safeguards (section 8(5)). Failing that duty carries the Act's highest penalty, up to ₹250 crore.
Network Layer
Mutual TLS (mTLS) and IP whitelisting for all ISP API connections
Application Layer
Public key cryptography, secure JWT session tokens, and granular API rate limiting
Data Integrity Layer
Blockchain-based tamper-proof consent receipts with immutable cryptographic hashes
Access Control Layer
Multi-role RBAC, segregation of duties, franchise admin controls and super-admin logging
Testing & Release Layer
Periodic CERT-In empaneled VAPT, multi-level testing, isolated Dev/UAT/Prod environments
Hosting & Residency Layer
100% data localisation with consent records stored in Tier-IV Indian data centres (AWS Mumbai/MeitY empaneled)
Rollout plan by ISP category
A sensible rollout moves from mapping to evidence in six steps, and the order matters more than the speed.
Data Mapping & Systems Inventory
Map subscriber personal data across CAF forms, billing engines, CRM, network AAA/RADIUS logs, self-care apps, franchisees and OTT partners.
Tag Licence Duties vs Consent
Classify KYC, IPDR (2-year DoT hold) and interception as licence duties. Segregate marketing, OTT bundles and profiling into distinct consent purposes.
Replace Paper CAF with OTP Verification
Deploy OTP-confirmed consent on SMS/WhatsApp across field installation engineers, LCOs and franchise retail counters.
Connect CRM & OTT Partner Webhooks
Integrate billing and CRM pipelines with SecureCMS APIs. Configure outbound webhooks so opt-outs propagate to Hotstar, SonyLIV, etc. in <80ms.
Re-Notify Existing Subscriber Base
Execute Section 5(2) compliant multi-lingual notice campaigns to legacy subscribers via WhatsApp, email and self-care app banners.
Deploy DSR Portal & Evidence Drills
Activate self-service subscriber preference centers, grievance management with DPO escalation, and run mock DPB audit drills.
Full integration, high-volume API throughput, multi-tenant app segregation, and Significant Data Fiduciary (SDF) audit readiness.
Franchise controls first, circle-level RBAC segregation, and automated OTP consent on partner and field onboarding journeys.
Quick start with OTP on SMS or WhatsApp and a simple management dashboard, replacing unverified paper forms.
Frequently asked questions: consent management for telecom and ISPs
Answers to statutory questions regarding DoT licences, IPDR legal holds, franchisee duties, and DPDP Act enforcement.
DPDP resources for ISPs
Start with the official texts, then use our guides to plan the work.