Compare
TruePrivacy vs Cookiebot for DPDP
Cookiebot is a cookie consent management platform (CMP). Website consent matters under DPDP, but it is one part of the programme.
Short answer
Cookiebot is a cookie consent management platform (CMP). Under DPDP, a Consent Manager is a person registered with the Data Protection Board (s.6(9), Rule 4), so a CMP and a Consent Manager are different things. Website consent is also only one part of a DPDP programme, which includes notices (Rule 3), rights and grievances (Rule 14) and breach intimation (Rule 7).
Cookie consent is one part of DPDP
If a tracker on your website processes data about an identifiable person, that is personal data (s.2), and you need a lawful ground under s.4. Where the ground is consent, it must be free, specific, informed, unconditional and unambiguous with a clear affirmative action (s.6).
Most of a DPDP programme sits beyond the website: rights requests, grievances, breach intimation, children's data, retention and processors. Plan where each of these will run.
A CMP is not a DPDP Consent Manager
A Consent Manager is a person registered with the Board who acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent (s.2). Rule 4 registration starts on 13 November 2026. The First Schedule (Part A) conditions include incorporation in India and a net worth of not less than ₹2 crore.
As of 4 November 2026 the application form is not published. A CMP, including TruePrivacy's consent tools, is software, not a registered Consent Manager. Read the Consent Manager vs CMP guide.
Criteria side by side
| Criterion | Why it matters under DPDP | TruePrivacy | Ask Cookiebot |
|---|---|---|---|
| Website trackers | Trackers that process personal data need a lawful ground (s.4) | Website tracker scan that categorises trackers so they can become consent purposes | How are trackers found and grouped into purposes? |
| Banner and apps | Clear affirmative action (s.6); withdrawal as easy as giving consent (s.6(4)) | Web banner script with reject-all, plus SDKs for iOS, Android and React Native | Which platforms do you support beyond the website? |
| Languages | Notice readable in English or any Eighth Schedule language (s.5(3)) | Banner interface text in English and all 22 languages | Which of the 22 languages does your banner ship in? |
| Consent evidence | You must prove notice and consent (s.6(10)) | Record per person and purpose, event log, consent receipts | How do we prove one person's consent and its history? |
| Rights and grievances | Rule 14; grievance period of no more than 90 days | Privacy center, request tracking, grievance desk | Do you handle rights requests and grievances, and how? |
| Breach | Rule 7 intimations and the 72-hour report | Incident record and a clock per audience | Is breach intimation in scope for your product? |
| Children | Verifiable parental consent (s.9(1)); no tracking or targeted advertising directed at children (s.9(3)) | Guardian consent flow with timeline and evidence | How do you handle visitors under 18? |
Questions to ask Cookiebot
- How is a DPDP notice shown with the banner, and is it itemised as Rule 3 requires?
- Which Eighth Schedule languages does the banner ship in?
- How can a user withdraw consent as easily as they gave it (s.6(4))?
- Can we export one person's consent record as evidence (s.6(10))?
- Do you cover anything beyond the website, such as apps, rights requests or breach intimation?
- Where is consent data stored?
How to decide
If you choose a cookie tool, decide where rights, grievances, breach and retention will run, because DPDP still applies to them. If you want website consent and those duties in one product, compare on the full table.
TruePrivacy's cookie consent sits alongside rights requests and breach management. Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
Is a cookie banner enough for DPDP?
No. Website consent is one part. Notices, rights requests, grievances, breach intimation, children's data and retention also apply from 13 May 2027.
Is a CMP a Consent Manager under DPDP?
No. A Consent Manager must be registered with the Board under s.6(9) and Rule 4. A CMP is software.
Does TruePrivacy support mobile apps?
Yes. Alongside the web banner script, TruePrivacy has SDKs for iOS, Android and React Native.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin