ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXSimple definitions of DPDPA, GDPR, CCPA and important consent-management terms.
Privacy regulations continue to evolve, and businesses need to stay informed about the latest legal requirements. India's Digital Personal Data Protection (DPDP) Rules were notified on 13 November 2025, introducing important regulatory developments for organizations handling personal data in India.
Non-compliance with privacy regulations can result in significant financial penalties and regulatory action. Under the GDPR, certain infringements can lead to fines of up to €20 million or 4% of an undertaking's total worldwide annual turnover of the preceding financial year, whichever is higher, depending on the violation.
This glossary is regularly updated to reflect important regulatory changes and help businesses understand evolving privacy compliance requirements.
Privacy and consent terms affect more than legal compliance. They influence how businesses collect and process personal data, manage advertising operations - where signals such as Google Consent Mode v2 and Global Privacy Control (GPC) decide what is allowed to run - and comply with privacy regulations. Understanding these concepts helps teams make informed decisions about data collection, consent management, and privacy compliance.
A single mistake in privacy and consent operations, such as placing marketing cookies without the required Cookie Consent, letting a tag fire that Prior Script Blocking should have held back, or missing a DSAR deadline, can lead to serious consequences. These may include significant fines, intervention from data protection authorities, and damage to a business's reputation.
This glossary is useful for DPOs, compliance managers, marketers, developers, and founders who need to understand privacy requirements and apply them in their daily operations. ConsentX helps businesses implement and manage privacy and consent operations through its Consent Management Platform (CMP), down to the Consent Receipt that records what each visitor agreed to.
Privacy laws can be complicated because they include legal terms, acronyms, and complex requirements. ConsentX created this glossary to help people understand important privacy and consent terms in simple language and help businesses become more privacy-compliant.
The same simplified approach is used in ConsentX's consent management platform, helping businesses manage privacy and consent operations more easily and understand their compliance requirements.
A consent management platform (CMP) is software that collects, stores and enforces a user's choices about cookies and personal-data processing, and proves those choices to regulators.
Cookie consent is the user's permission to set non-essential cookies and trackers, which most privacy laws require you to obtain before those cookies load.
Prior consent means non-essential trackers must stay inert until the user agrees, and prior blocking is the technical enforcement that keeps them from firing on the first page view.
The DPDPA (DPDP Act 2023) is India's national data-protection law, requiring clear notice and free, specific, informed consent before processing personal data, with the DPDP Rules notified on 13 November 2025.
Under India's DPDPA, a Data Fiduciary is the entity that decides why and how personal data is processed, equivalent to a 'controller' under the GDPR.
Under India's DPDPA, a Data Principal is the individual whose personal data is being processed, equivalent to a 'data subject' under the GDPR.
Under India's DPDPA, a Data Processor is any person who processes personal data on behalf of a Data Fiduciary, broadly equivalent to a 'processor' under the GDPR.
Data Principal rights are the rights India's DPDPA gives individuals over their personal data: access to information, correction and erasure, grievance redressal, nomination and withdrawal of consent.
Under India's DPDPA, a Consent Manager is a registered, interoperable platform through which a Data Principal can give, manage, review and withdraw consent across Data Fiduciaries.
The Data Protection Board of India is the body that enforces the DPDPA, investigates breaches and consent complaints, and imposes penalties of up to ₹250 crore per instance.
The GDPR is the European Union's data-protection law, requiring a lawful basis (often consent) to process personal data, with fines up to €20 million or 4% of global turnover.
The CCPA, expanded by the CPRA, is California's privacy law giving consumers the right to opt out of the sale or sharing of their personal data and to access and delete it.
Cross-context behavioral advertising (CCBA) is targeting ads to a consumer based on their personal data gathered across businesses, websites or apps they do not control - a practice California's CCPA/CPRA lets consumers opt out of.
Google Consent Mode v2 is Google's framework for passing a user's consent choices to Google tags, which adjust their behaviour and (when consent is denied) use privacy-safe modelling instead.
Global Privacy Control (GPC) is a browser signal that tells websites a user wants to opt out of the sale or sharing of their personal data, and several US state laws treat it as a legally binding opt-out.
The IAB TCF is an ad-industry standard that captures and transmits user consent for advertising purposes and vendors in a structured 'TC string' across the programmatic supply chain.
A DSAR is a request by an individual to access, correct, delete or port the personal data an organisation holds about them, which must be answered within a statutory deadline.
A consent receipt is a tamper-evident, time-stamped record of exactly what a user agreed to, including the purposes, the policy version and a verifiable hash, used as proof of valid consent.
Legitimate interest is a lawful basis under the GDPR for processing personal data without consent when the organisation's interest is not overridden by the individual's rights, established through a balancing test.