ConsentPlix is a consent management platform (CMP) built for India’s Digital Personal Data Protection Act, 2023 (DPDP Act). It also supports GDPR and CCPA, but every default is set for Indian law first.
This page explains what the platform does, which parts of the Act each feature covers, and how data moves through the system.
What ConsentPlix does
- Shows a clear consent notice for each purpose you process data for, in English or any of the 22 languages in the Eighth Schedule of the Constitution.
- Blocks non-essential scripts and cookies until the visitor opts in to that purpose.
- Signs every consent decision with HMAC-SHA256 and stores it in an append-only ledger, so you can show exactly what a person agreed to and when.
- Handles Data Principal rights requests for access, correction, erasure, nomination and grievances, with timers that track your response deadline.
- Sends signed webhooks so your CRM, CDP or data warehouse always has the current consent state.
How features map to the DPDP Act
| Section | What the Act requires | How ConsentPlix handles it |
|---|---|---|
| Section 5(1) | A notice listing the personal data and the purpose of processing | A separate, plain-language item for every purpose |
| Section 5(3) | The option to read the notice in English or any Eighth Schedule language | Notice engine with all 22 languages and automatic language detection |
| Section 6(1) | Consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action | Unticked, per-purpose toggles and no “by using this site” consent |
| Section 6(4) | Withdrawing consent must be as easy as giving it | A persistent consent button that reopens preferences in one click |
| Section 6(10) | The Data Fiduciary must prove consent was given | Signed, append-only consent records with notice version hashes |
| Sections 11–14 | Rights to access, correction and erasure, grievance redressal and nomination | Hosted rights portal with request tracking and response timers |
How data flows
- In the browser. The ConsentPlix script (
cp.min.js) loads first, holds back non-essential scripts and cookies, and shows the notice in the visitor’s language. - At the edge. The consent decision is sent over TLS 1.3 to an edge gateway. The gateway applies rate limits and bot checks, hashes the IP address and identifiers with a salt, and signs the record with HMAC-SHA256.
- In storage. The signed record is written to an append-only ledger in AWS Mumbai (ap-south-1). Records are grouped into Merkle checkpoints so any later change is detectable.
- To your systems. Webhooks send each consent change to your backend, CRM or CDP in real time.
Where to go next
- Quickstart: add the script to your site in a few minutes.
- Consent notices and languages: write notices that meet Section 5 and 6.
- Audit ledger: how records are signed and verified.
- Data Principal rights: set up access, correction and erasure requests.
- Webhooks and API: keep other systems in sync.
- Cookie and tracker blocking: stop scripts from running before consent.