Consent Management Platforms Powering Mall Loyalty Program Management

Why Consent Management Is Central to Mall Loyalty Program Management

Mall loyalty programs operate at an unusual intersection of data flows. Unlike a single-brand retailer — say, Lenskart running its own app loyalty programme — a mall operator is simultaneously a data controller for its own programme and a data processor for every tenant brand that participates. When a shopper at Lifestyle scans her mall loyalty card, she generates transaction data that goes to three places: the mall's central loyalty ledger, Lifestyle's own CRM, and potentially a co-marketing pool that the mall sells to FMCG brands for targeted promotions. Each of those data flows requires separate, explicit consent under DPDP 2023. A single enrolment form cannot cover all three.

This multi-party consent complexity is why standalone CRM tools like MoEngage, WebEngage, or Xeno — excellent as they are for single-brand engagement — cannot fully solve the consent problem for mall operators. They manage consent preferences as a field within a contact record. A purpose-built CMP manages consent as a sovereign data object that travels with the individual across every system in the ecosystem. The difference is architectural, not cosmetic.

The commercial stakes are equally significant. Research consistently shows that shoppers who actively consent to specific communications are more responsive to them. A loyalty member at a Pantaloons anchor store who has explicitly opted in to 'seasonal sale alerts' will open that WhatsApp message at rates two to three times higher than a member who was passively enrolled and received no consent-capture moment at all. Blanket opt-ins produce bloated member databases with low engagement rates — a metric every mall loyalty manager knows as 'zombie members.' India's average mall loyalty programme carries a 55–65% inactive member rate. Consent-first enrolment, where the shopper chooses what they receive, is one of the most effective levers for suppressing that figure.

Finally, consent management protects the tenant relationship. When a mall operator can demonstrate to FabIndia or Cafe Coffee Day that every communication sent on their behalf carries a valid, auditable consent record, it de-risks co-marketing programmes and opens new revenue streams. Tenant brands will pay a premium for access to a consented, segmented first-party audience. Malls that treat consent as infrastructure — not overhead — will find it becomes a monetisable asset.

DPDP 2023: What India's New Data Law Means for Shopping Mall Loyalty

The Digital Personal Data Protection Act, 2023 is not GDPR-lite. It has its own terminology, its own enforcement architecture, and — critically — its own definition of 'consent' that differs in important ways from European norms. For mall loyalty programme managers, four provisions deserve immediate attention.

First, the definition of 'Data Fiduciary' covers any entity that determines the purpose and means of processing personal data. A mall operating a loyalty programme is unambiguously a Data Fiduciary. This means the mall — not its technology vendor, not its data analytics partner — is legally responsible for ensuring every piece of shopper data was collected with valid consent. Outsourcing your loyalty stack to a vendor does not transfer your DPDP liability. Your vendor's compliance posture becomes your audit risk.

Second, DPDP 2023 requires that consent be 'free, specific, informed, unconditional and unambiguous.' The 'specific' requirement is the one most Indian mall loyalty programmes currently fail. Obtaining a single opt-in at enrolment and then using that opt-in to send promotional SMS from thirty tenant brands two years later is not specific consent. The law requires that the shopper understand, at the point of giving consent, exactly what data will be used for what purpose by which entity. Mall loyalty programmes that cross-sell tenant-brand promotions without purpose-specific consent are in clear breach.

Third, the right to withdraw consent must be as easy as the mechanism to give it. If a shopper enrolled via a mobile app, she must be able to withdraw consent via that same app. She cannot be required to call a helpline or visit the mall office. For technology teams, this means every consent-capture flow must have a corresponding withdrawal flow, and withdrawal must trigger real-time propagation across all connected systems — POS, CRM, WhatsApp business accounts, email service providers, and any third-party data clean rooms.

Fourth, the Act establishes a Data Protection Board with the power to levy penalties of up to ₹250 crore per incident. The Board is not yet fully constituted as of mid-2025, but enforcement is expected to accelerate through 2025-26. Mall operators who wait for the first enforcement action to trigger compliance investment will find the cost of reactive remediation — re-consenting hundreds of thousands of members, rebuilding data pipelines, managing regulatory correspondence — far exceeds the cost of building compliant infrastructure now. The window for proactive compliance is narrowing.

Fundle ConsentFirst: The Only DPDP-Native CMP Built for Loyalty Programs for Shopping Malls India

Fundle's ConsentFirst CMP is the only DPDP 2023–compliant consent solution in India fully integrated with loyalty. That is not a marketing claim — it is an architectural reality that stems from how the Fundle AI Platform was designed from its earliest versions. Consent is not a module plugged into the loyalty engine; it is the data layer on which every other function in the platform sits.

ConsentFirst operates on what the Fundle team calls a 'consent token' model. When a shopper enrols in a mall loyalty programme — whether at a self-service kiosk, on the Fundle-powered mall app, or via a QR code at a Reliance Trends checkout counter — the platform generates a unique, cryptographically signed consent token for each declared purpose. These tokens are stored in an immutable consent ledger that is fully separate from the shopper's PII (Personally Identifiable Information). This separation means that even if the marketing database is compromised, the consent audit trail remains intact and tamper-proof — a distinction that matters enormously during regulatory inquiry.

The platform supports eleven consent categories out of the box — from basic transactional alerts to location-based offers, tenant brand communications, third-party analytics sharing, and personalised recommendations — each toggleable independently by the shopper. Mall operators can configure which categories are required for programme participation and which are optional, striking the balance between data richness and enrolment friction. In Fundle's deployment data, malls that offer granular consent controls at enrolment see a 12–15 percentage point uplift in active consent rates compared to malls using a single opt-in checkbox.

Fundle Brand Loyalty and Fundle Mall Loyalty both inherit the ConsentFirst layer natively, which means tenant brands enrolled in a mall's ecosystem receive only the data for which the shopper has granted explicit downstream consent. The Fundle AI Agents that power personalised campaign triggers — sending a birthday offer from Apollo Pharmacy, a weekend dining recommendation from a food court operator, or a new-arrival alert from Manyavar — will not fire unless the relevant consent token is active. The orchestration is automated; the compliance is guaranteed. This is what Fundle Agentic AI brings to consent-driven loyalty: not manual suppression list management, but an AI-governed consent check embedded in every workflow step.

KPIs That Prove Consent-Driven Loyalty Is Delivering: What to Track

Most mall loyalty dashboards track enrolment numbers, points issued, redemption rates, and tenant footfall attribution. Very few track consent health as a primary business metric — and that gap is where compliance risk accumulates invisibly until it becomes a crisis. Adding six consent-specific KPIs to your monthly operating review transforms consent from a legal obligation into a performance lever.

The first KPI is the Active Consent Rate (ACR) — the percentage of your total loyalty member base that holds at least one active, purpose-specific DPDP-compliant consent token. For a mall with 500,000 enrolled members, an ACR below 60% means 200,000 members cannot legally be contacted for any promotional purpose. That is dead weight in your database and a direct driver of zombie-member statistics. Target ACR above 75% within six months of CMP deployment.

The second KPI is Purpose Consent Depth — the average number of distinct consent purposes a member has actively approved. A member who has consented only to transactional alerts but not to promotional offers or tenant co-marketing generates minimal revenue for the programme. A member with four or five active purpose consents is your highest-value loyalty asset. Tracking this metric reveals whether your consent capture flows are effectively communicating the value exchange of broader data sharing.

The third KPI is Consent-to-Engagement Conversion — the ratio of members who received a campaign communication to members who completed the desired action, segmented by whether they provided purpose-specific consent versus a legacy bulk opt-in. This metric typically shows a 2–3× performance gap in favour of consent-specific communications, providing the commercial justification for the CMP investment to your CFO.

The remaining three KPIs are operationally critical: Withdrawal Rate by Channel (to identify which touchpoints are creating consent fatigue), Consent Audit Trail Completeness (the percentage of member records with a full, exportable consent history — your regulatory safety net), and Re-Consent Campaign ROI (measuring the incremental programme revenue generated by the cohort that was successfully re-consented after the DPDP migration). Fundle Mall Loyalty surfaces all six of these natively in its compliance analytics dashboard, requiring no custom BI work from the mall's technology team.

How Fundle solves this

Vineet Narang founded Fundle on the conviction that loyalty in Indian retail had to be rebuilt from the data layer up — that programmes which treated consent as a legal formality rather than a trust signal would eventually collapse under the weight of their own member churn and regulatory exposure. That conviction is now embedded in every product decision the Fundle team makes.

The Fundle AI Platform delivers end-to-end consent-native loyalty infrastructure through four integrated components. Fundle Mall Loyalty handles the shopper-facing programme — points, tiers, tenant coalition management, and the ConsentFirst consent capture flows — with DPDP 2023 compliance built into every enrolment journey. Fundle Brand Loyalty extends the same consent architecture to individual tenant brands who want to run their own CRM programmes on top of the mall's data layer, ensuring that brand-specific personalisation never breaches the consent perimeter established by the shopper at the mall level.

Fundle AI Agents and Fundle Agentic AI bring intelligence to consent-governed engagement. Rather than a marketing team manually checking suppression lists before each campaign send, the Fundle AI Workflow orchestrates every communication trigger against the live consent token state of each member. An AI Agent managing a weekend footfall campaign for a Phoenix Marketcity property will automatically skip any member whose promotional consent token is inactive, substitute a transactional notification if that consent is available, and log the decision in the compliance audit trail — all without human intervention. This is not rule-based suppression; it is AI-governed consent compliance at scale.

For mall technology teams currently running on POS middleware like POSist, GoFrugal, or Wondersoft, Fundle AI Platform provides pre-built consent-aware integration connectors that ensure transaction data flows only for members with active transactional consent. For malls evaluating competitive loyalty platforms — Capillary, EasyRewardz, Customer Capital, or Almonds.ai — the key question to ask is whether consent is a native data object in their architecture or a field in their CRM. The answer will tell you how much custom integration work DPDP compliance will require. With Fundle, the answer is that consent has always been the foundation. Everything else is built on top of it.