Project Compliant — Zomato Case Study. 🛡️ Project Compliant — Making Zomato's Sign-Up Honest About Your Data

How I'd redesign the way Zomato asks for your data — so it follows India's new privacy law, without making the app annoying to use.

My role: Product Manager for data & privacy (case study) App: Zomato · What I focused on: the consent experience (how the app asks permission for your data) When: July 2026

The short version

Right now, when you open Zomato, there's one small line at the bottom of the login screen: "By continuing, you agree to our Terms, Privacy & Content Policy." That single tap says yes to everything — your live location, your order history being used for ads, your data being shared with Blinkit and District — forever, with no record and no way to undo it.

India's new privacy law (the DPDP Act) makes this illegal starting May 2027, with fines up to ₹250 crore. So this has to change.

I redesigned how Zomato asks for permission. The new version is clear, in your own language, and you can undo any choice with one tap. The catch most companies get wrong: they make it slow and annoying. Mine adds one screen, shown once, that takes about 15 seconds — and it never stops you from ordering food.

💡 The hard part: Following the law and keeping the app fast are usually enemies. Every extra screen loses some users — and in food delivery, people switch apps in a second. My whole job was to make the app follow the law and stay quick. Not pick one.

1. What's actually wrong

I opened the real Zomato app and took screenshots myself. Three things stood out:

You never really choose anything. Just using the app counts as agreeing to everything. Nobody reads that tiny line, and even if you did, it's all-or-nothing.
The privacy policy is out of date. It was last updated in July 2025 — before the government even published the new rules (November 2025). So it can't possibly follow them.
Zomato never asks your age. You sign up with just a phone number and an OTP. That means teenagers order every day, and the app treats them exactly like adults — tracking them and showing them ads. The new law says you can't do that to under-18s.

📸 I've attached my screenshots of Zomato's real login and OTP screens. That "By continuing, you agree…" line at the bottom is the exact problem — it's live in the app right now.

Why this matters:


The law	Fines up to ₹250 crore. The deadline is real: May 2027.
Trust	If ordering food feels creepy (spam calls, ads following you around), people just switch apps.
Kids	The law bans tracking under-18s — but Zomato can't even tell who they are today.

A few things I assumed (since I don't have Zomato's internal data):

Zomato has 100M+ users, so the "delete inactive accounts" rule applies to it
Sign-up is phone + OTP, no birthday asked (I checked on my own phone)