Building a Consent Platform to Enhance Data Privacy Across All Products and Safeguard Company Reputation During IPO

User consent at Tokopedia was fragmented—each team built their own version, leading to inconsistency, compliance risk, and extra work. With ISO 27701 certification and IPO prep underway, we couldn’t afford to patch things up.

The experience needed to be rethought from the ground up: scalable, centralized, and adaptable for every product team.

Company
Tokopedia
Role
Product Designer
Scope
UI Design, UX Design, Design System
Period
Q4 2022 – Q2 2023
Building a Consent Platform to Enhance Data Privacy Across All Products and Safeguard Company Reputation During IPO cover

Disclaimer: This is a high-level project overview. For the full case study or more details, feel free to reach out at olehabib98@gmail.com.

Key Challenges

Tokopedia needed to handle user consent properly across a vast, complex platform. But every tribe had different flows, needs, and priorities. Consent had to be secure, seamless, and scalable—without disrupting the user experience or slowing down product teams.

  1. 01

    How can we unify the consent experience across 11+ tribes without breaking their existing user journeys?

  2. 02

    How can we balance accessibility and legal security in the consent UI?

  3. 03

    How can we design a scalable platform that adapts to various use cases—while supporting fast team adoption and ISO 27701 compliance?

Design Process

  1. 01Understand Brief
  2. 02Design Workshop with 11 Tribes
  3. 03Map Consent Collection Patterns
  4. 04Ideate Solutions
  5. 05Create Component Variant
  6. 06Define Withdrawal Experience
  7. 07Team Feedback
  8. 08Build Design Guideline
  9. 09Establish Design Governance

Key strategy

Make privacy usable: balance security, accessibility, and scalability across a complex ecosystem.

Key Solutions

  1. 01

    Consent Collection Patterns

    The platform was built around two main consent patterns. Primary Consent uses a checkbox for stronger legal clarity, ideal for high-risk or mandatory cases. Secondary Consent uses just a statement and button, making it more accessible for complex or content-heavy flows. Both patterns work for single or multiple consent purposes, depending on the product need.

  2. 02

    Placement Rules

    Clear usage guidance for bottom sheets, full pages, and dynamic contexts (e.g., mid-page interactions or error fallback states).

  3. 03

    Consent Withdrawal

    The consent withdrawal system was integrated into Tokopedia’s Privacy Center, where consents are organized by categories like Account, Financial Services, and more. Users can easily opt in or out using toggles, with confirmation prompts added to prevent mistakes. The flow adapts based on whether the consent is mandatory or optional, ensuring clarity and compliance.

  4. 04

    Design Guideline & Governance

    A robust design documentation and adoption guide was created to help other teams integrate the platform autonomously while ensuring consistency, usability, and legal compliance.

Primary and secondary consent collection guide
Light and dark theme
Consent setting entry point
Design Guideline & Governance
Consent withdrawal
Withdrawal confirmation

Outcome Highlights

Based on 2023 data

  • Adoption

    1 consent live, 3 in testing, and 4 in dev showed strong early adoption. This proved the platform could scale across different features and teams.

  • Privacy Compliance

    Helped accelerate ISO 27701 certification by making consent handling consistent and trackable — boosting user trust and legal assurance.

  • Cross-Team Efficiency

    With clear design guidelines, teams could implement consent on their own. This reduced bottlenecks and sped up rollout across the company.

  • Post-IPO Reputation

    Centralized and stronger data governance reinforced Tokopedia’s privacy commitment — helping protect its public image and long-term valuation.

Collaborator

  • Product Manager (Alman)
  • UX Writer (Nona)
  • Engineering Team
    Data Privacy & Legal Team