Privacy Glossary

Consent Manager

A platform or system used to capture, record, version, and manage individuals' consent for data processing activities.

GDPRDPDP ActePrivacy

Full Definition

A Consent Manager is a technology solution that enables organisations to collect, store, and manage consent from individuals for various data processing activities. It typically captures the consent signal along with metadata — what was consented to, the version of the notice shown, when consent was given, and from which channel. A good consent manager supports consent withdrawal, re-consent workflows when notices change, and provides auditable records. Under regulations like GDPR and the DPDP Act, the organisation must be able to demonstrate valid consent, making a robust consent manager operationally essential.

How each law treats it

DPDP Act§ 6(7) + Rule 4

The DPDP Act and Rules create a registered-intermediary category — Consent Managers — that let Data Principals manage consents across many Fiduciaries from one place. Registration opened 13 November 2026 under the DPBI.

GDPRArticle 7 (contextually)

No named Consent Manager role, but the Article 7 requirement for demonstrable, revocable consent is what the Consent Manager pattern operationalises.

ePrivacy DirectiveArticle 5(3) + TCF 2.2

The IAB TCF is a de-facto Consent Manager framework for the ad-tech ecosystem; EU DPAs have found specific TCF deployments unlawful but not the model itself.

In practice

Every modern consent manager stores at least: subject identifier, timestamp, purpose, consent version, source channel and withdrawal timestamp.
Immutability is the audit baseline — append-only logs, cryptographically signed receipts, and no retroactive edits.
Multi-channel propagation is the hard part: a web banner change has to reach the mobile SDK, the server analytics stack and the vendor pipeline within seconds.

Common pitfalls

Treating implied consent as DPDP-compliant — DPDP consent is explicit, specific and informed; implied consent is not acceptable.
Logging only the first consent and not every change — regulators ask for the consent as it was at the time of a specific event.
Mixing consent evidence with marketing suppression lists — they serve different legal bases and should live in different ledgers.

Frequently asked questions

Do I need to use a DPDP-registered Consent Manager?+

No, it's optional. You can run your own in-house consent capture that satisfies the DPDP standard. Registered Consent Managers are useful when your users already have one — the subject carries their consent profile across Fiduciaries.

What's the difference between a Consent Management Platform (CMP) and a Consent Manager?+

CMP is the ad-tech / cookie-banner term (TCF / IAB space). Consent Manager is the DPDP-specific registered intermediary role. The two overlap operationally but have different legal footprints.

How long do I keep consent records after withdrawal?+

As long as you need the evidence that consent was lawfully obtained for the processing you did — typically the limitation period for complaints (5–7 years for GDPR, longer under sectoral rules).

Back to all terms