Skip to content

Playbook · 6 steps

Consent Manager

Also called: DPDP consent manager · Registered consent manager · Consent manager (DPDP Act)

6steps

Level
Expert
Reading time
About 6 min

Reviewed

Definition
A company registered with India's Data Protection Board that lets people give, review and withdraw consent to many businesses through one platform.

01 · How it works, in 6 steps

How does a consent manager work?

  1. 1

    The person opens the consent manager

    A data principal signs in to a registered consent manager's app or website — the single place where they can see consents across the businesses onboarded to it.

  2. 2

    A business's request appears with its notice

    A data fiduciary onboarded to the platform asks for consent for stated purposes, such as order updates or offers on WhatsApp, with the notice the DPDP Rules require.

  3. 3

    Consent is given, and only the decision travels

    The consent manager passes the decision and its scope to the business. It must not be able to read the underlying personal data shared through the platform.

  4. 4

    The business records and acts on it

    The business stores the consent, linked to the consent manager's reference, in its own consent records and lets the customer into the matching WhatsApp audience.

  5. 5

    Withdrawal flows back the same way

    If the person withdraws on the platform, the business must stop processing for that purpose within a reasonable time and make its processors — its BSP among them — stop too.

  6. 6

    Records stay reviewable for seven years

    The consent manager keeps every consent given, denied or withdrawn for at least seven years and shows it to the person, in machine-readable form on request.

02Try it

Hands-on: use the controls to work through it yourself.

Send each consent decision to the right business

8 / 8
Skills-based

Only agents with the required skill are eligible; the least busy of them wins.

Incoming · 0 left

  1. All 8 conversations have been routed.

Conversation 8 of 8 · Skills-based

Kiran · consent to bill alerts(needs telecom)goes toTelecom operator

Skills: needs telecom, and only Telecom operator has it.

  • Insurer

    2 of 3 open

    • insurance
    1. Meena · renewal reminders: yesneeds insurance
    2. Divya · withdraw renewal offersneeds insurance

  • Lending app

    2 of 3 open

    • lending
    1. Arjun · consent to loan updatesneeds lending
    2. Farhan · withdraw loan offersneeds lending

  • Fashion retailer

    2 of 3 open

    • retail
    1. Priya · withdraw WhatsApp offersneeds retail
    2. Priya · keep order updatesneeds retail

  • Telecom operator

    2 of 2 open

    Full
    • telecom
    1. Rahul · review what he agreed toneeds telecom
    2. Kiran · consent to bill alertsneeds telecom

Waiting · 0

  1. Nobody waiting: every conversation found an agent.
Each chip is one person's action on a consent manager's platform. Step through to see every decision reach only the onboarded business it concerns — the platform carries the decision, never the underlying data.

Conversation 8 of 8, Kiran · consent to bill alerts: Skills: needs telecom, and only Telecom operator has it.

03What is a consent manager?

Under India's Digital Personal Data Protection Act, 2023 (DPDP Act), a consent manager is a person registered with the Data Protection Board of India that acts as a single point of contact for an individual — the data principal — to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform (section 2(g)). It works for the individual: the Act makes it accountable to the data principal (section 6(8)), so its job is to carry that person's decisions to every data fiduciary onboarded to the platform, not to help businesses collect more consent.

The DPDP Rules 2025 set who may register (rule 4 and the First Schedule). The applicant must be a company incorporated in India, with sufficient technical, operational and financial capacity, a net worth of at least two crore rupees, and an interoperable platform independently certified against the Board's standards. Once registered it must make sure it cannot read the personal data shared through the platform, keep records of consents given, denied and withdrawn — with the notices behind them — for at least seven years, avoid conflicts of interest with the businesses it connects, run its own website or app rather than subcontract the role, and publish who owns and runs it. Registration provisions take effect on 13 November 2026.

A consent manager is not a consent management platform: the cookie-banner and preference tools businesses license act for the business and need no registration. Nor is it your Consent Record, the evidence you keep yourself — though a consent manager's records can corroborate it. The model is often compared with the Reserve Bank of India's account aggregators, which already move financial-data consent between institutions; the DPDP version is sector-neutral.

Key takeaways

  • A consent manager is a company registered with the Data Protection Board through which a person gives, reviews and withdraws consent to many businesses.
  • It acts for the individual, not the business, and must not be able to read the personal data that flows through its platform.
  • The DPDP Rules 2025 require an Indian company with a net worth of at least two crore rupees and an independently certified, interoperable platform.
  • Consent records on the platform must be kept for at least seven years and be available to the person they concern.
  • Consent-manager registration takes effect on 13 November 2026; using one stays optional for people and businesses.

04 · Why it matters

Why does a consent manager matter?

For a business messaging customers on WhatsApp, consent managers change where consent can come from and where withdrawals arrive. A customer may grant permission for offers on a consent manager's app rather than in your checkout, and may later withdraw it there. Your opt-in store and Suppression List then need a second, authenticated input that you do not control, and they must act on it as quickly as on a STOP reply in chat — otherwise the next campaign messages someone who has already said no, through a channel built to prove they did.

05 · Key facts

A consent manager: key facts and limits

Defined in
DPDP Act sections 2(g) and 6(7)–6(9)
Registered with
Data Protection Board of India
Who can register
A company incorporated in India
Minimum net worth
Two crore rupees
Records kept
At least 7 years
Reads the personal data?
No — it must not be able to
Registration rules in force
From 13 November 2026

06 · In code

A consent manager in code

// Illustrative only: the Board has not published a standard API, and each
// consent manager will define its own. The shape of the job stays the same.
type ConsentEvent = {
  ref: string;                      // consent manager's reference for this consent
  phone: string;                    // E.164, e.g. "+919812345678"
  purpose: "order_updates" | "offers";
  action: "granted" | "withdrawn";
  at: string;                       // ISO 8601 timestamp from the platform
};
 
export async function onConsentEvent(e: ConsentEvent) {
  if (await consentLog.has(e.ref, e.action)) return;  // idempotent
  await consentLog.append({ ...e, source: "consent_manager" });
  if (e.action === "withdrawn") {
    await suppression.add(e.phone, e.purpose);        // checked before every send
    await bsp.suppress(e.phone, e.purpose);           // processors must stop too
  }
}

Append to your own consent log, then suppress before the next send.

07 · Mistakes to avoid

Common mistakes with a consent manager

  • Confusing it with a cookie consent tool

    A consent management platform you license works for you and needs no registration. A DPDP consent manager is registered with the Board and works for the individual; buying software does not make you one.

  • Building a consent store with one input

    If only your own forms and STOP replies can change consent, withdrawals from a consent manager get lost. Design the store for several authenticated sources from the start.

  • Forgetting the processors

    A withdrawal must reach your BSP, CRM and campaign tools, not just your database. Push suppressions to every system that can send, and test it end to end.

  • Treating its records as yours

    The consent manager's records support you, but you still need your own Consent Record proving notice and consent. Keep both and link them by reference.

08Example: A withdrawal that never touches WhatsApp

A Chennai insurer onboards to a registered consent manager once the regime opens. A customer who agreed on the platform to policy-renewal reminders and offers on WhatsApp later withdraws consent for offers there — not by replying STOP in chat. The insurer's integration receives the withdrawal, removes the customer from marketing segments within minutes, tells its BSP to suppress the number for marketing templates, and leaves renewal reminders running because that purpose was not withdrawn. When the customer later asks why the offers stopped, support can point to the consent manager's record and the insurer's own matching entry.

09Consent Manager FAQs

Do businesses have to use a consent manager under the DPDP Act?+
No. The route is optional for both sides: a person may manage consent through a consent manager, and businesses can keep collecting consent directly. A business onboarded to one must still act on consents and withdrawals that arrive through it.
Is a consent manager the same as a consent management platform?+
No. A consent management platform is software a business licenses to collect consent, such as a cookie banner. A DPDP consent manager is a company registered with the Data Protection Board that acts for the individual across many businesses.
When can consent managers register in India?+
From 13 November 2026, when the consent-manager provisions of the DPDP Rules 2025 take effect. Applicants must meet the First Schedule conditions, including Indian incorporation and a net worth of at least two crore rupees.
Can a consent manager see my customers' data?+
It must not be able to. The DPDP Rules require a consent manager to ensure the personal data shared through its platform is not readable by it; what it handles is the consent decision and its record.

10 · Pro tips

Best practices for a consent manager

  • Store the consent manager's reference alongside each consent so the two records can be matched in a dispute.
  • Keep purposes granular — order updates and offers separately — so a withdrawal removes only what the person withdrew.
  • Watch the Board's notices for the first registrations before promising customers a consent-manager option.

See InfiQ pricing

From definition to your first message

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms