Automated Loyalty Campaign Tools Indian Market: Consent & AI

Data Privacy Regulations Impacting Indian Retail Loyalty

The DPDP Act 2023 introduces a rights-based framework for personal data processing in India that directly dismantles the 'blanket opt-in' model most retail loyalty programmes have operated on. The Act classifies loyalty programme operators as Data Fiduciaries — entities that determine the purpose and means of processing personal data. That classification comes with hard obligations: obtain free, specific, informed, and unambiguous consent before processing; maintain a verifiable record of that consent; honour withdrawal requests without forcing customers through friction-laden processes; and implement technical and organisational measures to prevent data breaches. The Act also introduces the concept of 'Significant Data Fiduciaries' — high-volume processors that will face additional audit and algorithmic accountability requirements. A mall operator running a programme with one million-plus active members should assume they will be classified as significant.

For a retail marketing head, the practical implications are immediate. Consider how Pantaloons or Reliance Trends currently enrols a new loyalty member at a store counter: the cashier keys in a mobile number, the customer gets an OTP, they confirm, and enrolment is done. The consent captured is almost entirely implicit — there is rarely a screen that says 'we will use your transaction history to send you personalised offers via WhatsApp; you can withdraw this consent at any time by texting STOP.' That gap is now a regulatory liability. Under DPDP 2023, purpose limitation is explicit — you cannot use data collected for billing to run a remarketing campaign without separate consent for that purpose.

Beyond the DPDP Act, retail operators must also contend with TRAI's Commercial Communication regulations, which govern bulk SMS and voice calls; RBI's tokenisation guidelines if the loyalty programme is linked to co-branded cards or payment instruments; and ASCI guidelines on digital advertising targeting. The intersection of these frameworks means that a single WhatsApp campaign to a Manyavar or FabIndia loyalty base potentially touches four separate regulatory frameworks simultaneously. No manual compliance review process can keep pace with the cadence of AI-driven loyalty campaign management in India at scale. Automation of compliance is not a nice-to-have; it is the only operationally viable path.

The Data Protection Board of India, once constituted, will have the power to investigate complaints, summon data fiduciaries, and impose penalties of up to ₹250 crore per instance of non-compliance. Early enforcement actions — likely to focus on high-visibility consumer brands with large data footprints — will set precedent. Retail chains and mall operators that have not built consent management infrastructure before enforcement begins will face not just fines but reputational damage at a moment when consumer trust in data handling is becoming a brand equity variable, not just a legal checkbox.

Best Practices for Consent Collection and Management

The foundation of a compliant automated loyalty campaign tool in the Indian market is a Consent Management Platform (CMP) that treats consent as a first-class data object — not a field in a CRM, not a checkbox on a form, but a structured, versioned, auditable record that travels with every customer profile and governs every downstream campaign action. Here is what best practice looks like at each stage of the loyalty member lifecycle.

At enrolment, consent must be collected in plain language at the point of action. That means a mobile app or kiosk screen — not a PDF terms document linked in small print — that explicitly lists the data types being collected (transaction history, location, browsing behaviour on the mall app), the purposes for which they will be used (personalised offers, tier management, third-party brand communications), and the channels through which communications will be sent (SMS, WhatsApp, email, push). Each purpose and channel should be a separate, independently toggleable consent item. A customer who wants transaction-based tier benefits but does not want third-party brand offers must be able to get one without the other. Bundled consent is explicitly prohibited under the DPDP Act's 'free consent' requirement.

Post-enrolment, consent management is an ongoing operational discipline. Consent versions must be maintained — when your privacy policy changes, you need to re-obtain consent from the affected member segments, not just update a website footer. When a new campaign type is introduced (say, you want to start sending location-triggered push notifications to Apollo Pharmacy loyalty members near a store), that new purpose requires fresh consent. Withdrawal requests must be honoured within a timeframe that your operational infrastructure can meet — the current DPDP framework suggests processing within a reasonable period, and best practice is automated processing within 24 hours, with campaign suppression happening in real time.

For mall operators managing hundreds of brand partners — Select CITYWALK has over 180 retail tenants — consent architecture must also address data sharing with third-party brands. When a mall shares a member's data with a tenant brand for a co-marketing campaign, the member's consent must explicitly cover that sharing. A data-sharing agreement between the mall and the tenant brand is a necessary but insufficient safeguard; the member must have consented to the specific sharing at the time of enrolment or through a subsequent consent refresh. Building this into the standard tenant onboarding playbook is both a compliance requirement and a commercial differentiator — brands are increasingly asking mall operators for evidence of consent coverage before agreeing to co-fund loyalty campaigns.

AI's Role in Ensuring Ethical Data Use in Automated Loyalty Campaigns

There is a productive tension at the heart of AI-powered customer engagement campaigns: the more data an AI system processes, the more accurate and commercially effective its personalisation becomes — but the more data it processes, the higher the regulatory exposure if consent management is not embedded in the processing logic itself. Resolving this tension is the central design challenge for any automated loyalty campaign tool in the Indian market today.

The most important architectural principle is that consent state must be a first-order input to every AI decision, not a post-processing filter. In most legacy implementations, a campaign AI builds its optimal audience segment — highest predicted RFM uplift, best send-time window, highest channel response probability — and then a compliance filter removes non-consenting members before send. This is legally acceptable but commercially wasteful, because the AI is optimising over a full population and then discarding a segment. A better architecture feeds consent state into the feature set that the AI uses to build segments in the first place. Non-consenting members are never in the optimisation universe; the AI learns to find high-value segments within the consented population, which is actually a more precise signal.

AI also has a direct role in consent health monitoring — a capability that most retail operators have never thought to build but that has significant commercial value. Consent fatigue is real: a loyalty member who opted in to all channels at enrolment two years ago but has opened zero emails and clicked no push notifications in the last six months is functionally a non-consenting member from a campaign ROI perspective, and they may also be a member whose preferences have changed without formal withdrawal. An AI-driven consent health model can identify these 'grey zone' members, trigger a lightweight re-consent flow (a single WhatsApp message with two buttons: 'Keep my preferences' and 'Update preferences'), and either re-activate them with fresh explicit consent or gracefully downgrade their contact frequency. Cafe Coffee Day's loyalty base, for example, has a large segment of members who enrolled during the brand's peak years and have since reduced visit frequency — a consent refresh campaign on this segment would simultaneously clean the data asset and potentially reactivate a portion of lapsed customers.

Finally, AI-driven loyalty campaign management in India must increasingly grapple with the ethics of inference. DPDP 2023 does not just regulate data that is explicitly collected — it has implications for data that is inferred. If your AI infers that a Lenskart loyalty member is likely pregnant based on purchase pattern changes (a classic retail analytics use case), that inference is sensitive personal data under the Act. Responsible AI design means building inference guardrails — rules that prevent certain sensitive inferences from being acted upon without an explicit, purpose-specific consent for that inference type — into the campaign engine itself, not as a manual review step.

KPIs to Track: Measuring Consent and Campaign Compliance at Scale

Most retail marketing heads track campaign KPIs obsessively — open rates, click-through rates, redemption rates, incremental revenue per campaign. Very few track consent KPIs with the same rigour. This is a gap that will become commercially painful as DPDP enforcement matures. Here are the metrics that a well-run loyalty operation should be tracking alongside standard campaign performance.

Consent Coverage Rate is the most fundamental metric: what percentage of your active member base has current, purpose-specific, channel-specific consent on record that meets your current policy version? A programme at 90% consent coverage with 10 lakh members has 1 lakh members it cannot legally contact for AI-driven campaigns — that is a real revenue gap, and it is also an opportunity to run a re-consent campaign that, if well-designed, can recover 40-60% of those members as fully compliant contacts. Phoenix Marketcity programmes that have run re-consent campaigns through properly designed flows have reported recovery rates of over 50% of lapsed-consent members within a 90-day window.

Consent Withdrawal Rate gives you an early warning signal about campaign experience quality. If your withdrawal rate spikes after a specific campaign type — say, a third-party brand offer blast — that tells you members found those messages irrelevant or intrusive. Used correctly, withdrawal rate is a proxy for campaign relevance, not just a compliance metric. A withdrawal rate below 0.5% per campaign is a healthy benchmark for a well-segmented loyalty programme.

Time-to-Suppression measures how quickly your operational infrastructure processes a withdrawal request and removes the member from all active campaign queues. Best-in-class is under 24 hours, fully automated. Any programme still processing withdrawals manually should treat time-to-suppression as a critical infrastructure gap, not just a compliance risk. A member who withdraws consent and then receives a campaign message 72 hours later is both a regulatory exposure and a brand experience failure.

Consent Refresh Conversion Rate tracks the outcome of your re-consent campaigns — the percentage of members who, when presented with a clear, plain-language consent refresh request, actively confirm or update their preferences. This metric is a leading indicator of member trust. A high refresh conversion rate means your members understand and value your programme enough to actively opt in again. Programmes that invest in explaining the value exchange — 'share your preferences, get better offers' — consistently outperform generic consent reminder messages.

How Fundle solves this

Vineet Narang founded Fundle on the premise that India's organised retail sector deserved a loyalty and engagement platform built for the specific complexity of its market — hundreds of mall tenants, multilingual consumer bases, fragmented POS infrastructure, and now a rapidly maturing regulatory environment that demands consent-first data architecture. The result is the Fundle AI Platform: an end-to-end loyalty, consent, and campaign management system that treats DPDP compliance not as a bolt-on feature but as a foundational design principle embedded in every workflow.

The centrepiece of Fundle's compliance stack is ConsentFirst — a Consent Management Platform that is purpose-built for Indian retail loyalty operators. Fundle's ConsentFirst CMP guarantees DPDP 2023 compliance for over 1.33 crore members' loyalty data, making it the largest verified-compliant loyalty data asset under a single platform architecture in Indian organised retail. ConsentFirst captures consent as a structured, versioned object at every enrolment touchpoint — app, web, POS kiosk, WhatsApp OTP flow — and syncs consent state in real time to every downstream system on the Fundle Mall Loyalty and Fundle Brand Loyalty modules. When a member withdraws consent, suppression happens automatically across all active campaign queues within minutes, with a full audit trail available for Data Protection Board inspection.

Fundle AI Agents sit at the intersection of personalisation and compliance. These agents do not just optimise campaign targeting — they read consent state as a first-order input, build segments exclusively within the consented population, and apply inference guardrails that prevent sensitive data inferences from being acted upon without explicit purpose-specific consent. Fundle Agentic AI goes further: it runs continuous consent health monitoring across the entire member base, identifies members approaching consent fatigue, and triggers Fundle AI Workflow automations that send plain-language consent refresh requests through the member's preferred channel at the optimal engagement window. The result is a consent coverage rate that improves over time rather than decaying as campaigns run.

For mall operators managing multi-brand tenant programmes — the core use case for Fundle Mall Loyalty — ConsentFirst also governs data sharing at the API level. Before any member data leaves the Fundle AI Platform for a tenant brand's campaign system (a Capillary integration, a MoEngage flow, a Xeno audience sync), the API checks that the member has explicitly consented to data sharing with that specific brand category. Tenant brands receive only the data they have consent coverage for, and that coverage is documented in the data-sharing agreement audit log. This is a materially different level of protection than the B2B contractual model most mall operators currently rely on, and it is increasingly what enterprise brand partners — particularly those with their own DPDP compliance obligations — are demanding before signing co-marketing agreements. For the retail marketing head who needs both commercial impact and regulatory defensibility from their automated loyalty campaign tools in the Indian market, Fundle is the architecture that makes both possible simultaneously.