Ask most D2C founders if their store is handling customer data properly and they will point to a link in the footer that says "Privacy Policy." That link is a notice. It is not consent. Confusing the two is the single most common mistake founders make when they first look at the DPDP Act, and it is worth untangling properly, because the law treats them as two separate acts with two separate requirements.
Notice: telling the shopper
A notice is a statement. It says, in plain language, what data your store collects, why it collects it, and who else sees it. Under the DPDP Act, that notice needs to be genuinely understandable, not a wall of legal text copied from a template nobody read. It should name the actual third parties your data goes to, Meta Pixel, your email tool, your WhatsApp provider, your logistics partner, rather than a vague reference to "trusted partners."
A notice is a one-way communication. The shopper reads it, or does not. Either way, publishing it is something the store does entirely on its own, without needing the shopper to do anything back.
Consent: the shopper agreeing
Consent is different. It is the shopper's affirmative answer to a specific question, at a specific moment, that gets recorded. Did they agree to their data being used for marketing. Did they agree to it being shared with a given processor. The Act requires this answer to exist and to be provable, not assumed from the fact that a notice existed somewhere on the site.
This is the part that catches founders out. A store can have a beautifully written privacy notice and still have zero actual consent on record, because nobody built a mechanism to ask shoppers and log the answer. The notice satisfies "did we tell them." It says nothing about "did they agree."
Why a store needs both, not either
Picture a Mumbai apparel store that publishes a thorough, accurate privacy notice listing every tool it uses. If that store has no consent banner, no log of who clicked yes, no record distinguishing a shopper who opted into marketing from one who did not, it has done half the job. It can show what it told shoppers. It cannot show what shoppers agreed to.
The reverse gap is just as real. A store with a consent banner but a stale or inaccurate notice behind it is asking shoppers to agree to something that is not an honest description of what actually happens to their data. Consent collected against a wrong notice is not solid consent.
What this means day to day
The practical fix is sequencing: get the notice right first, because it has to accurately describe your actual data flows, and then build the mechanism that captures and timestamps a shopper's answer to it. Skipping straight to a consent banner without first knowing your real processor list just means you are collecting agreement to a notice that does not reflect reality.
This is the exact sequence Consent Jet runs: it scans your store to find the actual tools your data goes to, builds the notice from what it finds, and only then puts a consent banner on your storefront that logs every shopper's answer as tamper-evident proof.