ConsentXDPDPA is being phased in. Scan your site to see where you stand. Scan now
ConsentXAn honest view of what ConsentX does today and what we are still building toward.
All four consent signals are supported, with defaults set before any tags fire so tracking respects consent from the first page view.
Region-aware policy across GDPR, UK GDPR, CCPA/CPRA, DPDPA, LGPD and more, so each visitor sees the experience their jurisdiction requires.
Tags and trackers are blocked before consent is given, so nothing non-essential runs until the visitor opts in.
Consent receipts and audit logs are bound into a per-record SHA-256 hash chain, so any change to a record is detectable and your evidence is provable.
Data subject and grievance requests are tracked end to end with statutory SLA timers, so deadlines are visible and nothing is missed.
Data is encrypted in transit with TLS, and data at rest is encrypted using the storage-layer encryption of our cloud provider.
Payments are handled by Stripe. ConsentX does not store card data on its own systems.
The items below are planned or under way. ConsentX does not hold these certifications or registrations today, and they are labelled accordingly so you always know where things stand.
Registration as a Transparency and Consent Framework CMP is on our roadmap. ConsentX is not a registered TCF CMP today.
Support for the Global Privacy Platform string is planned. It is not yet available.
Our application to the Google CMP Partner Program has been submitted and is under review. Membership is not yet granted.
A SOC 2 Type II audit is planned. ConsentX does not hold a SOC 2 report today.
Certification to ISO/IEC 27001 and the 27701 privacy extension is planned. ConsentX is not yet certified.
Registration as a DPDPA Consent Manager is planned, subject to the registration framework being opened by the regulator.
Work toward WCAG 2.2 AA conformance for the consent banner is in progress. A formal conformance claim is not yet published.
Europrivacy certification under GDPR Article 42 is planned. ConsentX does not hold this certification today.
ConsentX can act as your GDPR Article 27 representative arrangement where you have no establishment in the relevant region, so you have a point of contact for supervisory authorities and data subjects. Contact us to confirm the current scope for your jurisdiction.
Our Data Processing Agreement (DPA) is available for your legal team to review and sign. The providers in our supply chain are published on our subprocessors page.
Start free or book a walkthrough of how ConsentX makes consent provable.