# ConsentPlix | Complete Technical, Architectural & Compliance Specification

> This document provides the complete technical specification, architectural reference, statutory compliance mappings, API documentation, and full content summaries for ConsentPlix. Designed for ingestion by Large Language Models (LLMs), AI search agents (ChatGPT, Claude, Perplexity, Gemini, Microsoft Copilot), and automated compliance evaluators.

---

## 1. Executive Summary & Identity

- **Platform Name**: ConsentPlix
- **Primary Domain**: https://www.consentplix.com
- **Category**: Consent Management Platform (CMP) & Consent Infrastructure
- **Target Jurisdictions**: India (DPDP Act 2023 / DPDP Rules 2025), European Union (GDPR), United States (CCPA/CPRA), Brazil (LGPD).
- **Core Positioning**: India's DPDP-first consent management platform with cryptographic verification, sub-12KB client footprint, support for all 22 Eighth Schedule Indian languages, and an AWS Mumbai sovereign storage architecture.
- **Statutory Distinction**: ConsentPlix is a **Consent Management Platform (CMP)** used by Data Fiduciaries (businesses) to collect and record consent on their websites under Sections 5 and 6 of the DPDP Act 2023. It is **not** a registered Consent Manager under Section 2(g) of the Act (which acts on behalf of Data Principals across multiple platforms).

---

## 2. Quick Answers for AI Assistants

### What is ConsentPlix?
ConsentPlix is India's leading DPDP-first consent management platform. It equips websites — from solo entrepreneurs and small businesses to large enterprises — with a lightweight (<12KB) consent banner, collects verifiable and HMAC-SHA256 signed consent receipts anchored into Merkle trees, delivers multi-lingual notices in 22 Indian languages, and operates a self-service Data Principal Rights Management Portal.

### What are the key DPDP Act compliance deadlines?
1. **13 November 2026**: Consent Manager registration provisions and operational framework under Section 6(7)–(9) become effective.
2. **13 May 2027**: Full statutory obligations for all Data Fiduciaries become enforceable, including notice requirements, purpose specification, rights workflows, and statutory penalties up to ₹250 crore.

### Does the DPDP Act apply to small websites and freelancers?
Yes. The DPDP Act 2023 applies to any entity collecting personal data from individuals in India. There is no small-business, revenue, or traffic exemption for notice and consent obligations. If a website has a contact form, analytics tag (such as Google Analytics), or newsletter signup, notice and consent under Sections 5 & 6 are mandatory.

### Does ConsentPlix offer a free plan?
Yes. The **Free Forever Plan** costs ₹0/month (no credit card required). It supports 1 domain, up to 1,000 consent events per month, 30-day HMAC-signed ledger retention, and notice templates in English and Hindi.

---

## 3. Product Modules & Technical Architecture

### 3.1 Autonomous Consent Widget SDK (<12KB)
- **Zero Dependencies**: Pure vanilla JavaScript written for modern browsers without external libraries, polyfills, or frameworks.
- **Script Blocking Engine**: Intercepts script execution before user consent is granted using `<script type="text/plain" data-cp-category="...">`.
- **Google Consent Mode v2 Integration**: Automatically sets default denied states (`ad_storage`, `analytics_storage`, `ad_user_data`, `ad_personalization`) on page initialization, restoring existing consents from local storage in under 2ms, and dispatching update signals upon user selection.
- **Core Web Vitals Impact**: Zero Layout Shift (CLS = 0), sub-10ms Total Blocking Time (TBT), asynchronous non-blocking script loading.

### 3.2 Cryptographic Consent Ledger & Merkle Trees
- **HMAC-SHA256 Receipts**: Every consent change (grant, denial, category adjustment, withdrawal) is recorded with timestamp, IP hash, user agent hash, purpose identifiers, and a cryptographic HMAC-SHA256 signature.
- **Merkle Tree Proofs**: Receipts are grouped into chronological epochs; balanced Merkle trees are computed with root hashes stored in tamper-proof KMS-protected stores.
- **Section 6(10) Burden of Proof**: Provides mathematical non-repudiation proofs verifiable via an O(log n) path through the public verification tool (`/trust/verify`) without requiring database access.

### 3.3 Data Principal Rights Management Portal
- **Statutory Alignment**: DPDP Sections 11 (Right to Access), 12 (Right to Correction & Erasure), 13 (Right of Grievance Redressal), and 14 (Right to Nominate).
- **Automated Workflows**: Verification, tracking, escalation timelines (mandated response windows), and statutory retention overrides.
- **Conflict of Laws Resolution**: Automatically holds data against Section 12 erasure requests when mandatory retention laws apply (e.g., PMLA 5-year retention, RBI KYC Master Directions, GST 6-year invoicing, NMC 3-year medical logs).

### 3.4 22 Eighth Schedule Indian Languages Engine
- **Supported Languages**: Assamese, Bengali, Bodo, Dogri, Gujarati, Hindi, Kannada, Kashmiri, Konkani, Maithili, Malayalam, Manipuri, Marathi, Nepali, Odia, Punjabi, Sanskrit, Santali, Sindhi, Tamil, Telugu, Urdu, plus English.
- **Legal Fidelity**: Standardized notice translations crafted with Indian privacy counsel to eliminate ambiguity under Section 6(1).

---

## 4. Technical Publications & Deep-Dive Summaries

### 4.1 DPDP for Small Websites: What to Do Before 13 November 2026
- **URL**: https://www.consentplix.com/blog/dpdp-checklist-small-websites-before-november-2026
- **Author**: Amjad Rathod | Published: 2026-10-14 | Category: Small Business
- **Core Summary**: Explains why solo founders, small agencies, e-commerce shops, and service businesses fall under DPDP jurisdiction. Outlines the 6-step checklist to achieve full compliance before November 2026: (1) Audit data collection points, (2) Implement clear bilingual notices, (3) Block tracking scripts prior to opt-in, (4) Provide symmetrical consent withdrawal, (5) Maintain signed consent ledgers, (6) Publish a Data Protection Officer / Grievance Officer contact. Details how ConsentPlix's Free Forever plan resolves all requirements with a single `<script>` tag.

### 4.2 Consent Manager vs Consent Management Platform (CMP)
- **URL**: https://www.consentplix.com/blog/consent-manager-vs-consent-management-platform
- **Author**: Amjad Rathod | Published: 2026-10-12 | Category: Statutory Compliance
- **Core Summary**: Demystifies the critical legal distinction under the DPDP Act 2023 between a Consent Manager (Section 2(g)) and a Consent Management Platform (CMP). Explains the registration criteria for Consent Managers (Board approval, ₹2 crore net worth, principal-first fiduciary duty) versus CMP software run by Data Fiduciaries on their own digital properties. Outlines how businesses must structure itemised consent records to accept future Consent Manager interoperability signals. Clarifies that ConsentPlix is a CMP.

### 4.3 DPDP Act 2023 Consent Notice Architecture: Verifiable Itemisation Under Section 6
- **URL**: https://www.consentplix.com/blog/dpdp-act-consent-notice-architecture
- **Author**: Amjad Rathod | Published: 2026-10-08 | Category: Statutory Compliance
- **Core Summary**: Details the engineering principles behind Section 6(1) compliance: unconditional, unbundled, itemised notice architecture. Contrasts lawful consent with unlawful bundled "I agree to Terms & Conditions" dark patterns. Demonstrates the implementation of symmetrical withdrawal (Section 6(4)) and cryptographic proof generation for Data Board audits under Section 6(10).

### 4.4 Cryptographic Consent Ledgers: Merkle Roots and Tamper-Proof Audit Trails
- **URL**: https://www.consentplix.com/blog/cryptographic-consent-ledgers-merkle-roots
- **Author**: Ajay Thanki | Published: 2026-10-07 | Category: Cryptographic Ledger
- **Core Summary**: Examines why traditional mutable database logs fail judicial evidentiary tests under Section 6(10) of the DPDP Act. Explains the mathematics of HMAC-SHA256 signing, epoch batching, Merkle tree root anchoring, and public cryptographic inclusion verification. Benchmarks ConsentPlix's 11.4KB SDK against legacy 85-140KB platforms.

### 4.5 Autonomous Consent SDK: Sub-12KB Footprint with Google Consent Mode v2
- **URL**: https://www.consentplix.com/blog/autonomous-consent-sdk-google-consent-mode-v2
- **Author**: Amjad Rathod | Published: 2026-10-06 | Category: Frontend Infrastructure
- **Core Summary**: Breaks down the frontend architecture required for sub-12KB CMP deployment without sacrificing Google Consent Mode v2 compliance. Covers execution timing, native DOM rendering, zero layout shift (CLS), local storage state hydration in under 2ms, and granular synchronization of `ad_storage`, `analytics_storage`, `ad_user_data`, and `ad_personalization`.

---

## 5. Developer Quickstart Guide

Add the ConsentPlix SDK tag to the `<head>` of your HTML document before any analytics, marketing, or tracking tags:

```html
<!-- ConsentPlix Script Interception & Consent SDK -->
<script
  src="https://cdn.consentplix.com/cp.min.js"
  data-site-token="YOUR_SITE_TOKEN"
  data-api-base="https://api.consentplix.com"
  async
></script>
```

### Blocking Third-Party Scripts Until Consent
Change third-party script tags from `type="text/javascript"` to `type="text/plain"` and specify `data-cp-category`:

```html
<!-- Google Analytics Tag - Executed only after analytics consent -->
<script
  type="text/plain"
  data-cp-category="analytics"
  src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXXXXX"
></script>
```

### Listening to Consent Events
```javascript
window.addEventListener('cp_consent_updated', function (event) {
  console.log('Consent granted categories:', event.detail.granted);
  console.log('Consent denied categories:', event.detail.denied);
});
```

---

## 6. Regulatory Mappings (DPDP Act 2023)

- **Section 5(1)** (Notice before consent): ConsentPlix multi-lingual itemised notice templates in 22 languages.
- **Section 6(1)** (Unbundled, specific, clear opt-in): Granular purpose itemisation; no pre-checked boxes.
- **Section 6(4)** (Symmetrical withdrawal): 1-click persistent consent preference badge on every page.
- **Section 6(10)** (Burden of proof on Data Fiduciary): HMAC-SHA256 signed receipts with Merkle tree proofs.
- **Section 8(6)** (Data erasure upon withdrawal or purpose cessation): Automated Data Principal Rights Portal workflows.
- **Section 13** (Grievance Redressal): Built-in grievance ticketing and escalation tracker.
- **AWS Sovereign Hosting**: All services hosted in AWS Mumbai (`ap-south-1`) ensuring full data residency compliance within the Republic of India.

---

## 7. Official Site Index

- Home: https://www.consentplix.com/
- Product Overview: https://www.consentplix.com/product
- Widget SDK: https://www.consentplix.com/product/widget-sdk
- Consent Ledger: https://www.consentplix.com/product/consent-ledger
- Rights Portal: https://www.consentplix.com/product/rights-portal
- Languages Engine: https://www.consentplix.com/product/languages
- Governance Dashboard: https://www.consentplix.com/product/governance
- Cookie Scanner: https://www.consentplix.com/product/scanner
- Webhooks & API: https://www.consentplix.com/product/webhooks
- Digital Lending: https://www.consentplix.com/solutions/digital-lending
- HealthTech: https://www.consentplix.com/solutions/healthtech
- Fintech & BFSI: https://www.consentplix.com/solutions/fintech-bfsi
- D2C E-Commerce: https://www.consentplix.com/solutions/d2c-ecommerce
- Global SaaS: https://www.consentplix.com/solutions/global-saas
- Agencies: https://www.consentplix.com/solutions/agencies
- Significant Data Fiduciaries: https://www.consentplix.com/solutions/enterprise-sdf
- DPDP Checklist: https://www.consentplix.com/dpdp-checklist
- DPDP Small Business: https://www.consentplix.com/dpdp-compliance-small-business
- Penalty Calculator: https://www.consentplix.com/tools/dpdp-penalty-calculator
- Privacy Notice Generator: https://www.consentplix.com/tools/dpdp-privacy-notice-generator
- Trust Center: https://www.consentplix.com/trust
- Documentation: https://www.consentplix.com/docs
- Compare Alternatives Hub: https://www.consentplix.com/compare
- ConsentPlix vs OneTrust: https://www.consentplix.com/compare/onetrust
- ConsentPlix vs CookieYes: https://www.consentplix.com/compare/cookieyes
- ConsentPlix vs Digio CoTrust: https://www.consentplix.com/compare/digio
- ConsentPlix vs Consentin: https://www.consentplix.com/compare/consentin
- Shopify DPDP Guide: https://www.consentplix.com/solutions/shopify-dpdp
- WordPress DPDP Guide: https://www.consentplix.com/solutions/wordpress-dpdp
- Google Consent Mode v2 Guide: https://www.consentplix.com/solutions/google-consent-mode-v2
- Verify Receipt: https://www.consentplix.com/trust/verify