Consent management
Consent management under DPDP
Consent under India's DPDP Act has to be free, specific, informed, and revocable—and you need proof of what each person chose. This page covers what consent management means in practice and how to make it hold up.
What consent management actually means
Three things happen at the moment of consent: the person sees a clear notice of what you collect and why, they make a deliberate choice, and you keep a record of both. The record matters most, because it is what survives a dispute or an audit.
The conditions that decide whether consent counts
DPDP Section 6 asks for consent that is free, specific, informed, unconditional, and unambiguous, given by clear affirmative action. Each condition maps to a product decision: don't trap people into consenting, say what each purpose is for, don't bury the notice, and don't treat silence as yes.
What a banner alone cannot do
A banner that just records 'accepted' or 'rejected' leaves you with no proof of what the person saw, no way to show a version of the notice from six months ago, and no effect on your backend systems. That is the gap most consent tools never close.
- No proof—you cannot reconstruct what was shown and chosen.
- No versioning—wording changes rewrite history.
- No downstream effect—backend systems never learn about the choice.
What a proper consent layer adds
Versioned notices that receipts point back to, per-purpose choice, a way to withdraw as easily as accept, and a webhook so your own systems can act on the choice. Those four pieces are what turn a banner into something you can defend.
How Erasure fits
Erasure's consent product, Accord, covers the collection and proof side:
- Publish versioned notices; receipts lock to the version the person saw.
- Browser SDK for banner, preference modal, and hosted preferences.
- Withdrawal that creates a new receipt—history is never rewritten.
- consent.updated webhooks (HMAC-signed) so backend systems react.
- Privacy-preserving receipts: no IP, user id, or fingerprint required.
Read more
Consent Database Schema: How to Store Consent So You Can Prove It Later
A consent record that survives scrutiny needs three things: what the user saw, what they chose, and when. Here is a schema design that keeps all three, append-only.
Verifiable Parental Consent Under DPDP: What It Means for Your Product
DPDP defines a child as under 18 and requires verifiable parental consent for processing a child's data. Behavioural monitoring and targeted ads to children are prohibited outright.
Cookie Banners in India: DPDP Notice vs GDPR-Style Consent
India's DPDP Act requires notice and consent differently from GDPR. Here is what a compliant Indian cookie banner or consent surface looks like, and where GDPR patterns mislead.
Consent Receipts: Why Proof of Consent Is the Real Compliance Asset
A consent receipt records what a user saw, what they chose, and when, in a form that survives configuration changes. Under DPDP, the receipt is the difference between a banner and a defense.
What Is a Consent Manager Under DPDP? Definition and Requirements
DPDP defines consent managers as fiduciaries that enable data principals to give, manage, and withdraw consent through a single platform. Registration opens November 2026.
Consent Under DPDP: The Five Conditions That Decide Whether It Counts
DPDP Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, given by clear affirmative action. Here is what each condition means for product design.
Docs
What this does not solve
Accord does not scan cookies or auto-detect third-party trackers, and it is not a consent manager under the DPDP registration regime. It records and proves consent for the flows you publish; you configure the purposes and the notice.
Invite-only beta
Try it on your own stack
Erasure is invite-only in beta. Request an invite and we will walk you through the parts that matter for your product.