Cookie Consent (Shield CMP)

A cookie or tracking pixel that resolves to an identifiable person is processing personal data under DPDPA - the same S.5/S.6 obligation as any other consent, just running in the background. Shield CMP is a separate SDK from the consent-notice widget: it renders a category-based cookie banner, blocks third-party scripts until the relevant category is granted, and writes every decision to the same audit trail your notices use.

Installation

<script
  src="https://api.dpdpashield.in/sdk/cmp-sdk.min.js"
  data-tenant-id="YOUR_TENANT_ID"
  data-api-base="https://api.dpdpashield.in/api/v1"
></script>

Add this tag before your closing </body>. Your tenant ID is on Settings → Organisation- unlike the consent SDK, this embed identifies your tenant directly rather than via an API key, since the banner needs to render before any purpose-level consent flow exists on the page.data-api-base defaults to the production API and only needs to be set for local/staging testing.

Categories & configuration

Configure categories from Cookie Manager in the dashboard (under Consent Management). Each category is independently enabled (shown in the banner at all) and toggleable (visitor can turn it on/off - NECESSARY is always non-toggleable).

Config response shape

The SDK fetches this on load from GET /cmp/config/:tenantId.

{
  "data": {
    "tenantId": "uuid",
    "categories": {
      "NECESSARY":  { "enabled": true,  "toggleable": false },
      "ANALYTICS":  { "enabled": true,  "toggleable": true },
      "MARKETING":  { "enabled": true,  "toggleable": true }
    },
    "defaultDeny": true,
    "childDirected": false,
    "bannerTheme": { "position": "bottom", "primaryColor": "#4F46E5" },
    "languages": ["en", "hi"],
    "reconsentDays": 180,
    "scanEnabled": true,
    "scanUrls": ["https://yoursite.com"],
    "trackers": [
      { "domain": "google-analytics.com", "cookieName": "_ga", "category": "ANALYTICS", "vendor": "Google" }
    ],
    "labelSets": { "en": { "labels": { "...": "..." }, "status": "REVIEWED" } },
    "showPoweredBy": true,
    "brandName": null,
    "logoUrl": null
  }
}

Blocking third-party scripts

Tag any script with type="text/plain" and a data-category attribute. The SDK holds it out of the DOM and only activates it once that category is granted.

<!-- Blocked until the visitor grants ANALYTICS -->
<script type="text/plain" data-category="analytics" src="https://www.googletagmanager.com/gtag/js?id=G-XXXXXXX"></script>

<!-- Blocked until the visitor grants MARKETING -->
<script type="text/plain" data-category="marketing">
  fbq('init', 'YOUR_PIXEL_ID');
  fbq('track', 'PageView');
</script>

Category keys are case-insensitive - the SDK normalises data-category to uppercase before matching against your configured categories. Scripts without a data-category attribute are left untouched - only tag scripts you actually want gated.

Child-directed mode (DPDPA S.9(3))

Turning on Child-Directed Mode in Cookie Manager hard-blocks the ANALYTICS and MARKETING categories - no toggle is rendered for them at all, and the SDK client-side mirrors the same rule the server enforces.

Server-side tracking

If your backend fires a tag itself - a Conversions API call, a server-side GTM container - check the visitor's consent decision first with the same visitor ID the SDK stores in its browser cookie, then log whether you actually fired the tag for audit evidence.

1. Check consent before firing

const res = await fetch(
  `https://api.dpdpashield.in/api/v1/cmp/consent-status?visitorId=${visitorId}`,
  { headers: { 'X-API-Key': process.env.DPDPA_API_KEY } }
)
const { found, categories } = (await res.json()).data

if (found && categories.MARKETING) {
  // fire the server-side Conversions API call
}

2. Log what you did

await fetch('https://api.dpdpashield.in/api/v1/cmp/server-event-log', {
  method: 'POST',
  headers: { 'X-API-Key': process.env.DPDPA_API_KEY, 'Content-Type': 'application/json' },
  body: JSON.stringify({
    visitorId,
    trackerName: 'meta_capi',
    fired: true,
    category: 'MARKETING',
  }),
})

Automated tracker scanner

Turn on Scan enabled and add up to 5 URLs in Cookie Manager. A headless crawl reads every cookie set and every third-party script domain that loads, cross-references it against your declared tracker registry, and emails your DPO only when it finds something genuinely new and undeclared.

Translations

The banner supports any of the 22 languages in the Eighth Schedule. Draft a translation with one click from Cookie Manager (AI-assisted), then review and mark it REVIEWED before it goes live - DRAFT translations are visible to the SDK but flagged internally for review.

Endpoints reference

Full parameter tables are on the API Reference page. Summary below.

Common issues