India's Digital Personal Data Protection framework opens registration for "consent managers" on 13 November 2026 — a new institutional layer that brokers permissions in a structured, machine-readable, auditable form, and it is the closest thing yet to the consent plumbing that AI likeness rights desperately need.
What exactly is a consent manager under the DPDP rules?
A consent manager is a registered intermediary that lets a person grant, track and withdraw data permissions from a single interoperable dashboard. As explained in analyses by ELP and AZB, the DPDP Rules require these entities to be India-incorporated with a minimum net worth of ₹2 crore, and to run a "data-blind" transport layer so they route consent and data without reading the contents. Registration opens twelve months after notification — 13 November 2026.
Why does data-protection plumbing matter for likeness and voice?
Because consent to use your face or voice is, at bottom, a data-permission problem. Your likeness and voice are personal data; an AI system that trains on or regenerates them is processing that data. The DPDP framework does not yet contain a dedicated likeness clause, but its machinery — notice, purpose limitation, the right to withdraw — maps almost perfectly onto the problem of AI reuse. Our explainer on generative AI and rights unpacks why consent, not the technology, is the real battleground.
How is machine-readable consent different from a signed release?
A PDF release is a static, human-language document; machine-readable consent is a structured record a system can query, honour and revoke automatically. The difference is enormous when AI is involved. A studio can technically regenerate a cloned voice thousands of times, so consent has to travel with each use — specifying the exact project, language, duration and territory, and flipping off the instant permission is withdrawn. That is what a consent-manager architecture makes possible at scale, and it is the idea behind how the Zimorta model works: register, set consent, price, license, detect.
Will consent managers cover AI likeness use directly on day one?
No — and that gap is the point. The November 2026 window covers registration; interoperability standards and most substantive obligations arrive later, with hard enforcement widely expected around May 2027. The DPDP Board has not published likeness-specific formats, so structured consent for face and voice will, for now, live in private platforms rather than a government standard. Talent should not wait for the state to build this; the market is already assembling it. Meanwhile, the scale of what unlicensed AI misuse looks like is visible in our India deepfake statistics.
What should Indian talent and creators do before November?
Start treating consent as structured data now, not paperwork later. Map out the terms you would actually grant — which uses of your likeness and voice are allowed, at what price, for how long — and record them in a form that can be enforced and audited rather than buried in email. A creator who arrives at the consent-manager era with clean, itemised permissions and a defensible rate is positioned to license; one with a drawer of vague releases is positioned to be copied. Our likeness licensing rate benchmarks give the pricing half of that record a data-backed starting point.
The takeaway
November 2026 will not solve AI likeness misuse by itself, but it signals the direction: consent in India is becoming infrastructure — structured, portable and revocable. The talent who model their permissions that way today will simply plug into the system when it matures, while everyone else scrambles to translate old contracts into a machine-readable world.
