Search for "consent management platform for DPDP" and you will find two very different products described with almost the same words.
One is the consent banner and preference tool you put on your website. The other is a Consent Manager: a company registered with India's Data Protection Board that lets people give, review and withdraw consent across many businesses from one place.
Under the DPDP framework these are not the same thing, and mixing them up leads to bad buying decisions. Some teams think a cookie banner makes them a Consent Manager. Others wait for registered Consent Managers before doing any consent work on their own site.
Quick answer: a website CMP is a tool you use as a Data Fiduciary to show notice, collect choices, block optional tracking until consent, handle withdrawal and keep records. A registered Consent Manager is a separate, regulated intermediary that acts on behalf of the individual. Most websites need the first today. The second is an option the law gives to individuals, with its rules switching on in November 2026.
This guide is an operational explainer, not legal advice. The sources are listed at the end.
What the DPDP Act actually says
The Digital Personal Data Protection Act, 2023 defines a Consent Manager in Section 2(g) as a person registered with the Board who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform.
Section 6 then adds three points:
- the Data Principal may give, manage, review or withdraw consent to a Data Fiduciary through a Consent Manager (Section 6(7));
- the Consent Manager is accountable to the Data Principal and acts on her behalf (Section 6(8));
- every Consent Manager must be registered with the Board (Section 6(9)).
Two other parts of Section 6 matter for any website, whether or not a Consent Manager is ever involved:
- Withdrawal: where consent is the basis of processing, the person can withdraw it at any time, and withdrawing must be comparable in ease to giving it (Section 6(4)).
- Proof: if a question arises in a proceeding, the Data Fiduciary has to prove that notice was given and consent was obtained (Section 6(10)).
So the Act gives individuals a new kind of intermediary, but it leaves the duty to collect valid consent and prove it with you.
What the DPDP Rules, 2025 add
The Digital Personal Data Protection Rules, 2025 were published in the Gazette in November 2025. The PIB backgrounder describes an eighteen-month period for phased compliance.
Rule 1 sets the order:
- Rules 1, 2 and 17 to 21 came into force on publication.
- Rule 4, on registration and obligations of Consent Managers, comes into force one year after publication, so in November 2026.
- Rules 3 and 5 to 16, which include the notice rule, come into force eighteen months after publication, so around May 2027.
Rule 4 lets a person who meets the conditions in Part A of the First Schedule apply to the Board for registration. Those conditions are demanding. The applicant must be a company incorporated in India, have a net worth of at least two crore rupees, have sound management and finances, and have its platform independently certified against the data protection standards the Board publishes.
Part B of the same Schedule lists the obligations. A registered Consent Manager must, among other things:
- let a person give consent to a Data Fiduciary onboarded on its platform, directly or through another onboarded Data Fiduciary;
- make sure it cannot read the personal data that is shared through it;
- keep a record of consents given, denied or withdrawn, the notices that came with each request, and any sharing with a transferee Data Fiduciary;
- give the person access to that record and, on request, a machine-readable copy.
That is a regulated account-to-account consent system, closer to India's financial Account Aggregator model than to a cookie banner.
Website CMP vs registered Consent Manager
Website CMP
- Used by: you, the Data Fiduciary, on your own site or app.
- Acts for: your business, to help meet your obligations.
- Registration: none with the Board.
- Typical job: notice, banner, category choices, blocking optional tags, a withdrawal link and a consent log.
- When it matters: now, for any optional tracking you run.
Registered Consent Manager
- Used by: the individual, across many onboarded businesses.
- Acts for: the Data Principal (Section 6(8)).
- Registration: required with the Board (Section 6(9) and Rule 4).
- Typical job: one platform to give, manage, review and withdraw consent, with consent records kept for the person.
- When it matters: Rule 4 is in force from November 2026.
A website CMP does not become a Consent Manager because it stores consent records. And registering as a Consent Manager is not something an ordinary website or SaaS business needs to do to collect consent on its own pages.
What to check before you choose a CMP for DPDP
If you are an Indian business, or you serve visitors in India, the practical question is whether your website consent setup will hold up. These checks matter more than any label on the pricing page.
1. It starts from what your site really loads
You cannot write an honest notice or set up categories without knowing which cookies, pixels, chat widgets, video embeds and analytics tools run on each page. Start with a scan, then review the results by hand. Our guide to what cookie scanners find and miss explains where manual review is still needed.
2. Optional tracking waits for a choice
Analytics, advertising and session-recording tags should not fire before the visitor decides, where consent is your basis for them. Test it: open the site in a private window, refuse optional categories and watch the network panel. If a marketing tag still loads, the banner is decoration.
3. Refusing and withdrawing are as easy as accepting
Section 6(4) asks for withdrawal that is comparable in ease to giving consent. In practice that means a visible way to refuse on the first screen and a persistent link, such as Cookie settings in the footer, to reopen choices later. The consent preference center QA checklist walks through those tests.
4. Records are good enough to prove consent
Because Section 6(10) puts the burden of proof on you, a consent log should show when the choice was made, what was chosen per category, and which version of your notice or policy was shown. Consent logging explained covers what a useful record contains.
5. The notice matches the tracking
The notice rule switches on in 2027, but it is easier to fix now. Each purpose in your banner and policy should match a real tool on the site. When marketing adds a new pixel, the notice, the category and the scan should be updated together.
6. It works for your stack and your languages
Check that the tool supports the platforms you actually run, from WordPress and Shopify to Next.js or a custom app, and that your banner text can be shown in the languages your visitors use.
7. It can talk to a Consent Manager later
You do not need a Consent Manager integration to collect consent on your own site. But if your business may later receive consent through a registered Consent Manager, keep your consent records clean and exportable so they can be matched with whatever the Board's standards require.
Where COKIQ fits
COKIQ is a website consent management platform. It is not a Consent Manager registered with the Data Protection Board, and it does not act on behalf of individuals across businesses.
What it does on your own site, as shown on the features page:
- scans your website for cookies, scripts and trackers, and flags unknown or unblocked marketing tags;
- shows a category-based banner with accept, reject and customise options and policy links;
- holds known analytics, marketing, chat, video, maps and embed scripts until the right consent state exists;
- passes consent state to Google tags through Consent Mode v2;
- records consent choices with timestamp, region, regulation profile, category choices and policy version, as described in the consent logs docs;
- re-scans after installation to confirm the setup is recording choices.
For the wider India context, read the DPDPA cookie consent guide and what the DPDPA means for cookie consent in India, or see the DPDPA page.
A simple plan for the next six months
- Now: scan your main domains, list every optional tool and its purpose, and fix any tag that fires before consent.
- Before November 2026: confirm your refusal and withdrawal paths work on desktop and mobile, and that your consent log captures the notice version.
- Before May 2027: rewrite your notice so each purpose is specific and understandable on its own, and match it to your categories.
- Every release: re-scan after new pixels, widgets or plugins go live.
If you want to see what your site loads today, run a free COKIQ scan and use the results as your starting inventory.
Sources
- Ministry of Electronics and Information Technology, Digital Personal Data Protection Act, 2023: Sections 2(g), 6(4), 6(7) to 6(10).
- Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025: Rule 1 (commencement), Rule 4 and the First Schedule (Consent Managers).
- Press Information Bureau, DPDP Rules, 2025 Notified (17 November 2025).