Building a Consent Platform to Enhance Data Privacy Across All Products and Safeguard Company Reputation During IPO
Building a Consent Platform to Enhance Data Privacy Across All Products and Safeguard Company Reputation During IPO
User consent at Tokopedia was fragmented—each team built their own version, leading to inconsistency, compliance risk, and extra work. With ISO 27701 certification and IPO prep underway, we couldn’t afford
to patch things up.
The experience needed to be rethought from the ground up:
scalable, centralized, and adaptable for every product team.
User consent at Tokopedia was fragmented—each team built their own version, leading to inconsistency, compliance risk, and extra work. With ISO 27701 certification and IPO prep underway, we couldn’t afford
to patch things up.
The experience needed to be rethought from the ground up:
scalable, centralized, and adaptable for every product team.
COMPANY
Tokopedia
ROLE
Product Designer
SCOPE
UI Design, UX Design, Design System
PERIOD
Q4 2022 – Q2 2023
COMPANY
Tokopedia
ROLE
Product Designer
SCOPE
UI Design, UX Design, Design System
PERIOD
Q4 2022 – Q2 2023
Disclaimer: This is a high-level project overview. For the full case study or more details, feel free to reach out at olehabib98@gmail.com.
Disclaimer: This is a high-level project overview. For the full case study or more details, feel free to reach out at olehabib98@gmail.com.
Key Challenges
Key Challenges
Tokopedia needed to handle user consent properly across a vast, complex platform. But every tribe had different flows, needs, and priorities. Consent had to be secure, seamless, and scalable—without disrupting the user experience or slowing down product teams.
Tokopedia needed to handle user consent properly across a vast, complex platform. But every tribe had different flows, needs, and priorities. Consent had to be secure, seamless, and scalable—without disrupting the user experience or slowing down product teams.
01
01
How can we unify the consent experience across 11+ tribes without breaking their existing user journeys?
How can we unify the consent experience across 11+ tribes without breaking their existing user journeys?
02
02
How can we balance accessibility and legal security in the consent UI?
How can we balance accessibility and legal security in the consent UI?
03
03
How can we design a scalable platform that adapts to various use cases—while supporting fast team adoption and ISO 27701 compliance?
How can we design a scalable platform that adapts to various use cases—while supporting fast team adoption and ISO 27701 compliance?
Design Process
Design Process
01
Understand Brief
01
Understand
Brief
02
Design Workshop with 11 Tribes
03
Map Consent Collection Patterns
04
Ideate
Solutions
05
Create
Component
Variant
06
Define
Withdrawal Experience
07
Team
Feedback
08
Build Design Guideline
09
Establish Design Governance
02
Design Workshop with 11 Tribes
03
Map Consent Collection Patterns
04
Ideate
Solutions
05
Create
Component
Variant
06
Define
Withdrawal Experience
07
Team
Feedback
08
Build Design Guideline
09
Establish Design Governance
Key strategy
Key strategy
Make privacy usable: balance security, accessibility, and scalability across a complex ecosystem.
Make privacy usable: balance security, accessibility, and scalability across a complex ecosystem.
Key Solutions
Key Solutions
01
01
Consent Collection Patterns
The platform was built around two main consent patterns. Primary Consent uses a checkbox for stronger legal clarity, ideal for high-risk or mandatory cases. Secondary Consent uses just a statement and button, making it more accessible for complex or content-heavy flows. Both patterns work for single or multiple consent purposes, depending on the product need.
The platform was built around two main consent patterns. Primary Consent uses a checkbox for stronger legal clarity, ideal for high-risk or mandatory cases. Secondary Consent uses just a statement and button, making it more accessible for complex or content-heavy flows. Both patterns work for single or multiple consent purposes, depending on the product need.
02
02
Placement Rules
Clear usage guidance for bottom sheets, full pages, and dynamic contexts (e.g., mid-page interactions or error fallback states).
Clear usage guidance for bottom sheets, full pages, and dynamic contexts (e.g., mid-page interactions or error fallback states).
03
03
Consent Withdrawal
The consent withdrawal system was integrated into Tokopedia’s Privacy Center, where consents are organized by categories like Account, Financial Services, and more. Users can easily opt in or out using toggles, with confirmation prompts added to prevent mistakes. The flow adapts based on whether the consent is mandatory or optional, ensuring clarity and compliance.
The consent withdrawal system was integrated into Tokopedia’s Privacy Center, where consents are organized by categories like Account, Financial Services, and more. Users can easily opt in or out using toggles, with confirmation prompts added to prevent mistakes. The flow adapts based on whether the consent is mandatory or optional, ensuring clarity and compliance.
04
04
Design Guideline & Governance
A robust design documentation and adoption guide was created to help other teams integrate the platform autonomously while ensuring consistency, usability, and legal compliance.
Primary and secondary consent collection guide
Light and dark theme
Consent setting entry point
Design Guideline & Governance
Consent withdrawal
Withdrawal confirmation
Design Guideline & Governance
Outcome Highlights
Outcome Highlights
Based on 2023 data
Adoption
Adoption
1 consent live, 3 in testing, and 4 in dev showed strong early adoption. This proved the platform could scale across different features and teams.
1 consent live, 3 in testing, and 4 in dev showed strong early adoption. This proved the platform could scale across different features and teams.
Privacy Compliance
Privacy Compliance
Helped accelerate ISO 27701 certification by making consent handling consistent and trackable — boosting user trust and legal assurance.
Helped accelerate ISO 27701 certification by making consent handling consistent and trackable — boosting user trust and legal assurance.
Cross-Team Efficiency
Cross-Team Efficiency
With clear design guidelines, teams could implement consent on their own. This reduced bottlenecks and sped up rollout across the company.
With clear design guidelines, teams could implement consent on their own. This reduced bottlenecks and sped up rollout across the company.
Post-IPO Reputation
Post-IPO Reputation
Centralized and stronger data governance reinforced Tokopedia’s privacy commitment — helping protect its public image and long-term valuation.
Centralized and stronger data governance reinforced Tokopedia’s privacy commitment — helping protect its public image and long-term valuation.
Collaborator
Collaborator
Product Manager (Alman)
UX Writer (Nona)
Engineering Team
Data Privacy & Legal Team
Product Manager (Alman)
UX Writer (Nona)
Engineering Team
Data Privacy & Legal Team