IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Progressive profiling & clear consent
Maya wants to try your app. She does not want a 20-field form on day one. Ask for everything up front, and she leaves. Ask honestly, a little at a time, and she stays. Your goal: ask for data and consent in a way people trust.
- Ask for each detail at the moment you need it.
- Consent is a record: what, when and which version of the terms.
- Keep necessary data apart from optional data, with a switch for each.
- Saying no must be as easy as saying yes.
- A child and a parent are two linked identities.
Ask when it matters
Think of apps that ask for your location, contacts and camera the moment you open them. Did you tap Allow, or delete the app? Maya does the same.
Progressive profiling means collecting details slowly, only when you need them. On day one, ask only for an email. When Maya places her first order, ask for her address. When she joins a birthday reward, ask for her birthday. Each question comes when it makes sense. It feels like service, not spying.
a good host at a dinner party. The host does not meet you at the door with a clipboard. The host asks "Tea or coffee?" when you sit down. The giant form is the clipboard at the door.
Consent is a record
Each time Maya agrees to something, you must be able to prove it later. So consent is a record, not a checkbox on a screen. Store what she agreed to, when, and which version of the terms. Policies change. "She agreed" means nothing if you cannot say to what. Laws like GDPR and India's DPDP Act expect a clear yes, a purpose and proof. See the rules of the game. A stored consent receipt is this kind of record.
One switch for each choice
One big "I accept" tells Maya nothing. Honest consent is granular consent. Keep necessary data apart from optional data. Necessary data is what you need to run the service. Optional data is marketing mail, analytics and sharing with partners. Let her say yes to each one alone.
This goes with purpose limitation: do not collect what you have no clear use for. Unused data is only a risk on the day you are breached. A preference center is the page where Maya can see and change every choice.
Saying no must be as easy as saying yes
If opting in took one tap, opting out cannot need a support ticket and a five-day wait. Use a one-click switch in the preference center. At the extreme, let her erase her data (see the right to be forgotten).
Some designs push people to say yes. They are called dark patterns. Examples: a pre-ticked box. A bright "Accept all" beside a tiny grey "Manage". A decline button that is hard to find. They win this quarter's numbers and lose the customer later.
Children and family accounts
For a family account, model the parent and the child as separate identities. Link them with a guardian relationship. Do not share one password. The parent can then manage the child's settings and consent. When the child reaches the age limit, hand control to the child.
Honest, granular, in-context consent builds trust. Customers stay and recommend you when you never ambush them for data.
Go deeper: Privacy laws in short (as of October 2026)
This is a plain summary, not legal advice. Laws differ by country and change often. Read the official text and ask a lawyer for your case.
- EU: GDPR. You must be able to show that a person consented (Article 7(1)). Withdrawing must be as easy as giving consent (Article 7(3)). Consent is doubtful when a service is made conditional on data it does not need (Article 7(4)). Pre-ticked boxes are not valid consent. The EU Court of Justice decided this in the Planet49 case (C-673/17, 2019).
- India: DPDP Act 2023 and the DPDP Rules 2025. The Rules were notified on 13 November 2025. The rules for the Data Protection Board took effect at once. The rules for consent managers apply from 13 November 2026. The main duties apply from 13 May 2027. The Act says the notice must be offered in English or in any language of the Eighth Schedule of the Constitution (Section 5). These cover notice, consent, withdrawal, security, breach reporting and children's data. In January 2026 the government asked for views on shortening some of these dates. We found no notified change in October 2026. Check the government's website before you plan around any date.
- California: CCPA / CPRA. It gives rights to know, delete, correct, and opt out of the sale or sharing of data. Businesses must also honor opt-out signals from the browser, such as Global Privacy Control. The regulations were updated and apply from 1 January 2026. Consent that was won with a dark pattern does not count.
Sources: gdpr-info.eu (Articles 7 and 8), the DPDP Rules 2025 as published by the Government of India (MeitY), and cppa.ca.gov.
Go deeper: Age limits for children
Children need extra care. Under GDPR Article 8, a child can consent alone from age 16 by default. A member state may lower this age, but not below 13. Below that age, a parent or guardian must give or approve consent. You must make reasonable efforts to check this. In India, the DPDP Act treats anyone under 18 as a child. It requires verifiable consent from a parent or guardian, with some exemptions. In the US, the COPPA law covers children under 13.
🧪 Interactive lab — enable JavaScript to play with this one.
Before you trust a third-party app with customers' data, rank the scopes it asks for with Consent Check.