ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXA Consent Manager is a Board-registered platform that helps people give, review and withdraw consent across different companies. It is different from a cookie banner or CMP.Also known as: DPDPA Consent Manager, Consent Manager India, Consent Management Intermediary
The Digital Personal Data Protection Act, 2023 defines a Consent Manager as a person registered with the Board that acts as a single point of contact to enable a Data Principal to give, manage, review, and withdraw consent through an accessible, transparent, and interoperable platform.
In simple terms, a Consent Manager is intended to act as a central consent control layer for individuals.
Instead of managing consent separately across every service, the DPDPA model envisions an interoperable platform through which a Data Principal can manage applicable consent decisions.
A DPDPA Consent Manager can provide a central mechanism for Data Principals to:
The objective is to make consent management more transparent and give individuals greater control over their personal-data choices.
Under the DPDPA, a Consent Manager is not simply any company that provides a cookie banner or consent tool.
The Act defines a Consent Manager as a person registered with the Board and establishes the concept as an interoperable consent-management intermediary.
The detailed operational requirements, registration framework, and technical requirements are governed by the applicable DPDPA framework and Rules.
This distinction is important for businesses because the term “Consent Manager” under the DPDPA should not automatically be treated as another name for a website CMP.
A Consent Manager and a Consent Management Platform (CMP) can sound like the same thing, but they serve different roles.
| DPDPA Consent Manager | Consent Management Platform |
|---|---|
| Defined under India's DPDPA | General privacy technology category |
| Registered with the Board | May be provided by any qualifying technology vendor |
| Designed to be interoperable | Usually configured for a website, app, or organisation |
| Enables Data Principals to manage consent | Collects and enforces consent |
| Intended to work across Data Fiduciaries | Often manages consent for a specific property |
| Includes giving, managing, reviewing and withdrawing consent | Can include banners, preference centers, blocking and consent records |
A CMP can therefore support the technical consent layer used by a Data Fiduciary, while a statutory Consent Manager represents a distinct DPDPA concept.
A cookie consent banner is a user interface displayed on a website to inform visitors about cookies and collect applicable consent.
A Consent Management Platform can go further by managing preferences, blocking trackers, recording consent, and communicating choices to website technologies.
A DPDPA Consent Manager is different again. It is the specific regulated intermediary described by the DPDPA for enabling Data Principals to give, manage, review, and withdraw consent through an interoperable platform.
In other words:
Website consent interface
Consent collection and enforcement technology
Registered, interoperable consent intermediary
People may have to manage consent separately with every app, bank or online service. A Consent Manager puts these choices in one place. It works for the Data Principal, not for the company collecting the data. Users can see their active consents, change their choices and withdraw consent when needed.
The Data Principal is the individual to whom personal data relates.
The Consent Manager is designed to provide that individual with a mechanism to manage consent.
For example:
The Data Principal can use the Consent Manager to interact with consent decisions, while the Data Fiduciary remains responsible for the processing activities it determines.
This creates a separation between the individual managing consent and the organisations processing the individual's personal data.
A Data Fiduciary determines the purpose and means of processing personal data.
A Consent Manager provides the consent-management interface and interoperability layer contemplated by the DPDPA.
A simplified relationship can look like:
The Data Fiduciary may use Data Processors to process personal data on its behalf, while the Consent Manager serves a different function in the consent ecosystem.
Interoperability means that consent information can work across participating systems rather than being locked inside one organisation's technology environment.
For a Data Principal, this can potentially mean using a consistent consent-management mechanism across multiple services.
For businesses, interoperability can require systems that can reliably exchange and interpret consent information while maintaining appropriate security, authenticity, and auditability.
One of the important functions of a DPDPA Consent Manager is enabling Data Principals to withdraw consent.
The DPDPA provides that a Data Principal has the right to withdraw consent at any time, and the ease of withdrawing consent should be comparable to the ease of giving consent.
This makes consent withdrawal an important part of the consent lifecycle rather than an afterthought.
Businesses should therefore ensure that consent withdrawal can be propagated to the systems and processing activities affected by that withdrawal.
The Consent Manager concept is part of India's broader privacy and consent framework.
A business preparing for DPDPA compliance should consider:
Using a consent tool does not by itself make an organisation DPDPA compliant. Compliance depends on the organisation's actual processing activities, notices, consent practices, security controls, rights processes, and other applicable obligations.
Section 2(g) of the DPDP Act, 2023 defines the Consent Manager. Section 6(7)–(9) then sets out how the role works:
The DPDP Rules, 2025 were notified on 13 November 2025. They apply in phases, not all at once:
Businesses should plan against these dates rather than assume every obligation already applies.
No.
This is one of the most important distinctions to understand.
A CMP is a privacy technology platform used by organisations to collect, manage, store, and enforce consent.
A Consent Manager under the DPDPA is a specific statutory concept involving a registered and interoperable platform through which Data Principals can give, manage, review, and withdraw consent.
The two can work together, but they should not be treated as identical concepts.
Not every website should assume that installing a conventional CMP makes it a DPDPA Consent Manager.
The DPDPA defines a Consent Manager as a specific registered entity and establishes requirements around its role.
However, websites and applications can still need robust consent management even when they are not themselves Consent Managers.
Businesses should evaluate their processing activities, consent requirements, Data Principal rights, and applicable DPDPA obligations separately.
A Consent Manager is an entity/platform that enables Data Principals to manage consent.
A Consent Receipt is evidence or a record of a consent decision.
For example:
Provides the mechanism for managing consent.
Records evidence of what consent was given, when it was given, and other relevant information.
These concepts can work together but serve different purposes.
ConsentX provides consent-management technology that can help businesses build the technical layer around DPDPA consent.
ConsentX can help organisations:
ConsentX is a Consent Management Platform, not automatically a statutory DPDPA Consent Manager simply because it provides consent-management functionality.
This distinction allows businesses to use ConsentX as their organisational consent-management layer while keeping the DPDPA's separate Consent Manager concept clear.
ConsentX helps businesses collect meaningful consent, enforce privacy choices, manage withdrawals, and maintain audit-ready evidence across websites and digital services. Start free with ConsentX.
India's framework governing the processing of digital personal data and related privacy rights and obligations.
The individual to whom personal data relates under the DPDPA.
A person who determines the purpose and means of processing personal data.
A person who processes personal data on behalf of a Data Fiduciary.
Technology that helps organisations collect, manage, enforce, and document user consent and privacy preferences.
Consent relating to the processing of personal data under the requirements of the DPDPA.
A record containing evidence of a user's consent decision and related consent information.
Rights provided to individuals under the DPDPA, including applicable rights relating to access, correction, erasure, grievance redressal, nomination, and consent withdrawal.
A consent approach in which applicable non-essential processing or tracking is prevented until the required permission is obtained.