Choosing a Consent Management Platform in India: A Buyer's Guide
TL;DR
A consent management platform (CMP) for the DPDP Act must do much more than show a cookie banner. It should manage per-purpose consent across every channel, version multilingual notices, propagate withdrawals to downstream systems, support verifiable parental consent and rights requests, and keep a tamper-evident audit trail. Note that a CMP is software you use; a Consent Manager is a separate, Board-registered entity under the Act.
Who this is for: compliance, engineering and procurement teams evaluating consent management platforms for the DPDP Act.
The DPDP Act has created a wave of new consent tools, and many existing global tools are being repositioned for India. They are not equivalent. Some are cookie banners with a new label. Others are built for European rules and need significant work to fit Indian requirements. This guide sets out what a platform must do to support DPDP compliance, the questions to ask vendors, and the red flags to watch for.
For the standard consent must meet, see Valid Consent Under DPDP. For the architecture behind a strong platform, see The Consent Lifecycle.
First: CMP versus Consent Manager
The terms sound alike but mean different things under Indian law:
| Consent management platform (CMP) | Consent Manager | |
| What it is | Software a business uses for its own consent | An entity registered with the Data Protection Board (Section 6(7), Rule 4) |
| Who it serves | The Data Fiduciary | Data Principals, across many businesses |
| Registration | None required | Mandatory, with conditions including ₹2 crore net worth and data blindness |
| From when | Now | Registration opens 13 November 2026 |
A good CMP should be able to receive consents and withdrawals from registered Consent Managers. But buying a CMP does not make you a Consent Manager, and vendors should not describe themselves as one unless registered.
The capabilities that matter
Must-have
- Per-purpose consent across every channel: web, mobile apps, forms, branches, call centres and partner channels, not just cookies.
- Purpose registry: a central list of purposes, data items and lawful bases, ideally linked to your Record of Processing Activities.
- Versioned, multilingual notices: standalone, itemised notices that meet Rule 3, with English and Eighth Schedule language support, and version history.
- Withdrawal that propagates: withdrawal as easy as consent, pushed to downstream systems and processors through APIs, webhooks or events, with confirmation.
- Tamper-evident audit trail: append-only records of every consent event, notice version and configuration change, for the Section 6(10) burden of proof.
- Verifiable parental consent: age signals, parent routing and verification under Rule 10.
- Cookie consent: category-level choices, tag blocking before consent and consent logs.
- APIs and SDKs that your engineers can integrate without heavy custom work.
Strongly recommended
- Rights request handling for access, correction, erasure, grievance and nomination, linked to consent records
- Consent Manager interoperability for consents arriving from registered Consent Managers
- Data residency in India and security certifications appropriate to your sector
- Reporting on consent rates, withdrawals and request timelines
MeitY's June 2025 Business Requirement Document for consent management systems, though non-binding, is a useful benchmark. It describes lifecycle management from collection to withdrawal, user dashboards, grievance handling, cookie consent by category, multilingual support and tamper-resistant logging.
Questions to ask every vendor
- Show us a withdrawal in the app reaching our CRM. How long does it take, and how is it confirmed?
- If we change a notice, how do existing consents keep a link to the version the user saw?
- How is the audit trail made tamper-evident? Who can alter records?
- How do you support verifiable parental consent under Rule 10?
- Which Indian languages do notices support, and who maintains translations?
- Where is our data stored and processed? Who are your sub-processors?
- Can you receive consent events from a registered Consent Manager?
- How do you handle consent captured offline, in branches or call centres?
- What happens to our data, and our evidence, if we leave?
- How quickly do you update the product when the Rules or guidance change?
Red flags
- "Cookie banner" is the whole product. DPDP consent covers every channel.
- GDPR-only design. Legitimate interests options, 16-year age thresholds and portability workflows suggest the tool has not been adapted.
- Claims to be a "Consent Manager" without Board registration.
- No version history for notices and purposes.
- Editable consent records. Evidence that administrators can change is weak evidence.
- No downstream integration. Consent that lives only in the CMP cannot be honoured elsewhere.
Evaluation scorecard
| Criterion | Weight | Questions |
| Consent coverage across channels | High | Web, app, offline, partners? |
| Notices and languages | High | Rule 3, versioning, Eighth Schedule? |
| Withdrawal propagation | High | Events, confirmations, processors? |
| Audit trail | High | Append-only, tamper-evident, exportable? |
| Children | High (if relevant) | Rule 10 verification flows? |
| Integration | Medium | APIs, SDKs, connectors? |
| Rights requests | Medium | All DPDP rights, linked to consent? |
| Residency and security | Medium | India hosting, certifications? |
| Cost and support | Medium | Total cost, implementation help? |
How ConsentifyAI fits
ConsentifyAI is a consent management platform built specifically for the DPDP Act. It provides per-purpose consent across channels, a purpose registry linked to ROPA, versioned multilingual notices, event-based withdrawal, verifiable parental consent, cookie consent, rights requests and a hash-chained audit trail. We'd encourage you to test it against the questions above, just as you would any other vendor.
Sources & references
- DPDP Act, 2023 — Sections 5, 6, 9, 11–14
- DPDP Rules, 2025 — Rules 3, 4, 10, 14
- Other — MeitY/NeGD Business Requirement Document for Consent Management (June 2025)
Frequently asked questions
What is a consent management platform?
Software a business uses to present notices, collect and record consent, manage preferences and withdrawals, and prove consent across its websites, apps and systems.
Is a consent management platform the same as a Consent Manager?
No. A Consent Manager is a specific entity registered with the Data Protection Board under Section 6(7) and Rule 4 that acts on behalf of individuals. A consent management platform is software a business uses to meet its own obligations.
Is a cookie banner tool enough for DPDP?
Usually not. DPDP consent applies to every channel and purpose, including apps, forms, branches and call centres, not just website cookies.
What should we test in a demo?
Withdraw a consent and watch it reach a downstream system; change a notice and check old consents still point to the old version; and retrieve the full history of one individual's consent.
Should we build our own consent system?
It is possible, but requires a purpose registry, ledger, integrations, multilingual notices, parental consent and audit trail, plus ongoing maintenance as rules evolve. Compare the full cost before deciding.
Related reading
The Consent Lifecycle: How to Build Consent You Can Prove
Under the DPDP Act, consent has to be valid when given, honoured while it lasts, withdrawable at any time and provable afterwards. That makes it a lifecycle, not a checkbox. Design it as states and events: notice, capture, record, propagate, use, modify, renew and withdraw. A central registry of purposes, a consent ledger as the single source of truth, event-driven integrations and an audit layer turn that lifecycle into something your teams can operate.
ReadConsent Audit Trail: Prove Compliance When the Board Comes Asking
Section 6(10) of the DPDP Act puts the burden of proving notice and consent on the business. A consent audit trail is the evidence: an append-only record of every consent event, the notice version shown, the purpose, the method and every later change, including withdrawal. Making it tamper-evident, for example by hash-chaining records, turns it from a database into proof. Keep it for as long as you rely on the consent, plus the period in which it could be disputed.
ReadValid Consent Under DPDP: Why Your Checkbox Isn't Enough
Under Section 6 of the DPDP Act, consent is valid only if it is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. It must come with a standalone, itemised notice. It must be as easy to withdraw as to give. And the business, not the customer, must be able to prove all of this (Section 6(10)). A checkbox captures a click. It does not, by itself, meet any of these tests.
Read