Consent Managers vs. CMPs: India's Regulated Approach to Consent

The global landscape of digital privacy is increasingly defined by the principle of consent, empowering individuals with greater control over their personal data. India, with the Digital Personal Data Protection Act, 2023 (DPDPA), has introduced a unique, regulated framework for managing consent through ‘Consent Managers,’ contrasting with the more market-driven Consent Management Platform (CMP) ecosystem prevalent under the EU’s General Data Protection Regulation (GDPR) and ePrivacy Directive. As of November 2026, the DPDPA and its associated Rules have cemented India’s distinctive approach, demanding a closer comparative look for businesses operating across these jurisdictions.

India’s Regulated Consent Managers: A Centralized Hub

The DPDPA 2023 lays the foundation for a robust consent framework. Section 6 mandates that consent must be freely given, specific, informed, unambiguous, and revocable. Crucially, the DPDPA Rules, operational since their notification, detail the structure and function of ‘Consent Managers.’ These entities are not merely technical tools but are envisioned as fiduciaries, registered with a designated authority (likely MeitY or an independent body), acting on behalf of Data Principals to manage their consent lifecycle with various Data Fiduciaries.

This framework draws inspiration from India’s existing Account Aggregator system regulated by the Reserve Bank of India (RBI), which facilitates consent-based data sharing in the financial sector. Consent Managers under DPDPA are expected to provide a centralized dashboard or interface where Data Principals can grant, manage, and revoke consent across multiple Data Fiduciaries. The DPDPA Rules prescribe stringent technical standards, interoperability requirements, and audit mechanisms for these Consent Managers, ensuring secure and standardized operations. Furthermore, the broader IT Rules, particularly those concerning intermediaries, could indirectly influence the operational compliance of platforms hosting or integrating with Consent Manager services.

EU’s CMP Frameworks: Market-Driven Compliance

In the European Union, the GDPR (specifically Article 6(1)(a) and Article 7) sets out the conditions for valid consent, mirroring many of DPDPA’s requirements: it must be freely given, specific, informed, and unambiguous. The ePrivacy Directive (often called the “Cookie Law”) further mandates consent for the use of cookies and similar tracking technologies. To meet these obligations, organizations typically deploy Consent Management Platforms (CMPs).

Unlike India’s Consent Managers, CMPs in the EU are not a legally mandated or centrally regulated class of entities. They are primarily technological solutions developed by the private sector to help Data Controllers (website operators, app developers) demonstrate compliance. Frameworks like the IAB Europe’s Transparency and Consent Framework (TCF) provide industry standards for how CMPs should collect and communicate user consent choices to advertisers and publishers. However, participation in TCF is voluntary, and many organizations use proprietary CMP solutions. The oversight of CMPs is indirect; supervisory authorities primarily assess whether the Data Controller’s use of a CMP results in valid consent under GDPR and ePrivacy, rather than regulating the CMP provider itself.

Key Comparative Differences and Trade-offs

1. Regulatory Mandate and Oversight: India’s DPDPA is significantly stricter. It explicitly mandates and regulates Consent Managers as a distinct, registered entity, subject to specific rules and oversight. The EU, in contrast, is looser; while consent is legally mandated, the mechanism (CMPs) is market-driven, with no direct legal requirement for CMPs or their central regulation.

2. Centralization of Control: India’s framework aims for stricter centralized control for the Data Principal. A single Consent Manager could potentially manage consent across numerous Data Fiduciaries, offering a unified view and revocation mechanism. EU CMPs, while providing granular control, typically operate on a per-website or per-service basis, leading to a more fragmented user experience where consent must be managed repeatedly across different sites.

3. Technical Standards and Interoperability: The DPDPA Rules are expected to enforce stricter technical standards and interoperability requirements for Consent Managers, fostering a more uniform ecosystem. In the EU, while industry standards like IAB TCF exist, they are voluntary. This can lead to variations in CMP implementations, user interfaces, and data portability.

4. Scope of Application: Both frameworks apply to the processing of personal data. However, the explicit role of Consent Managers in India extends to all forms of personal data processing requiring consent under DPDPA Section 6, whereas EU CMPs have historically been more prominently associated with website tracking (ePrivacy) and broader GDPR consent for specific processing activities.

5. Liability: Under DPDPA, Consent Managers will likely bear specific liabilities for breaches of their duties as fiduciaries. In the EU, the primary liability for obtaining valid consent rests with the Data Controller, with CMP providers typically acting as Data Processors whose liability is governed by contractual terms.

India’s approach represents a bold step towards a more structured and centrally managed consent ecosystem, potentially reducing “consent fatigue” and enhancing Data Principal autonomy. However, it also introduces complexity for businesses in terms of integration and compliance with a new class of regulated entities. The EU’s market-driven model offers flexibility but can result in inconsistent user experiences and compliance challenges for Data Controllers navigating diverse CMP solutions.

Practical Takeaway

Indian businesses, GCs, and DPOs must proactively prepare for the full operationalization of Consent Managers. This involves auditing existing consent mechanisms against DPDPA Section 6 and the new DPDPA Rules for Consent Managers. Understand how your organization will integrate with these regulated entities, both technically and operationally, to obtain and manage consent. For businesses operating globally, it’s crucial to recognize that simply porting an EU-compliant CMP solution to India may not suffice. The DPDPA’s explicit regulation of Consent Managers demands a distinct strategy, focusing on interoperability, adherence to prescribed technical standards, and understanding the specific liabilities associated with this new intermediary. Re-evaluate your data flows and consent processes to ensure they align with India’s stricter, centralized approach, while also maintaining compliance with EU standards for any cross-border data transfers or services offered to EU residents.