How To Clean Up App Permissions In India Right Now

Open Settings on the phone in your hand, then Privacy, then Location. The list that loads is the object worth looking at: every app that ever asked, with the answer you gave it, most of them on a screen you were trying to get past at the time. You can clean up app permissions on that list this week. The national dashboard that was supposed to do it for you is not ready.

What Does It Mean To Clean Up App Permissions?

It means going through the apps you still use, revoking the access they no longer need, and deleting the stored addresses, cards and history that sit behind a login you have not opened in years, one app at a time and by hand.

That is genuinely dull work, and it is also the only version available until a registered consent manager exists. A consent manager is not another privacy policy. Under the Digital Personal Data Protection Rules notified in November 2025, it is a licensed intermediary sitting between you and every company holding your data, and its duty runs to you rather than to them. One screen instead of forty settings pages.

The conventional read is that India is copying Europe, late. That gets it backwards. Europe handed people a right to withdraw and left them to exercise it company by company, which is exactly why almost nobody does. India's design is the more ambitious one, because it puts an institution in the middle whose whole job is to make a withdrawal travel. Ambitious is not the same as working, and a right you have to exercise forty times is a right in name.

Which Permissions Actually Cost You Something?

Location running in the background, contacts, and any saved payment method are the three that keep earning for somebody after you stop using an app, which makes them the first to revoke and the ones worth checking again every few months.

A LiveLaw analysis published in August 2026 found the Data Protection Board of India, the body that must register consent managers and hear complaints, had no appointed chairperson and no appointed members roughly ten months after the rules took effect. MeitY ran two nomination rounds, in May and June. No seat was filled. A vacant regulator does not collapse in public. It quietly converts a right into a queue, which is the same thing that happened to India's AI labelling rules at their six month mark, where a High Court ended up doing the regulator's job.

The Order To Work Through

Start with the apps holding money, then the ones holding an address, then everything you have not opened since last year, because that sequence removes the most exposure for the least time and you are unlikely to finish the list in one sitting.

About an hour, spread over a week, and it is the one hour that produces a result this year. Deleting the account is the strongest move on that list, because a revoked permission still leaves the company holding what it already collected. The weakest is anything that depends on a company acting after you close the tab, which is precisely the gap the consent manager was designed to close. Hardware rules ran into the same wall when India drafted 83 security requirements for phones and left the funding of that work to an industry with no reason to hurry.

What The November Deadline Does Not Do For You

Revalidation is a duty on companies, not a service delivered to you, so nothing lands in your inbox on 13 November and nothing appears on your phone, and no one holding statutory authority is currently in a position to check whether any of it happened.

• Registration is mandatory: until the Board is seated, no operator in India holds it, so treat any app calling itself a consent manager as a product claim.
• Withdrawal is not erasure: it stops future processing and leaves untouched any inference a company already drew from data it held lawfully.
• The entry bar is Rs 2 crore: a net worth requirement that prices out the small privacy startups most likely to build this well.
• We do not cover enterprise compliance: what a data fiduciary has to file is a different subject, and this site writes for the person holding the phone.

There is a second problem the industry prefers not to discuss. A consent manager is a new intermediary, and new intermediaries earn a living somewhere. The rules say it must be blind to the data it routes, which is the right instinct, but blindness is a technical property rather than a business model. Ask which fiduciaries any operator actually connects to, by name, before you trust the word interoperable. Account sprawl is how this gets away from people in the first place, the same drift described in Google's subscription push seen from the user's side.

Do not wait for the dashboard. Open the five apps you actually use, work down the order above, and close the accounts you stopped using while closing them is still something you can do by hand. The consent manager is a better answer than doing it yourself, and it is not an answer yet. Keeping your own record of what you revoked, and when, is the same habit that makes recording a price before the festive sale worth the minute it takes.