Every cookie is a consent decision. Prove you asked first.

There's no separate "cookie law" in India the way GDPR has the ePrivacy Directive. But a cookie or tracking pixel that resolves to an identifiable person - directly, or via a persistent device/browser identifier - is processing personal data under DPDPA S.4 and S.5. Firing that script before consent is the same S.5/S.6 violation as collecting an email address without consent; it's just running silently in the background instead of through a form.

Generic banner plugins are built around GDPR's category language and store consent in their own format, disconnected from anything else on your site. Shield CMP writes every cookie-consent decision into the same ConsentAuditLog your notice-based consent records use - one proof format, one audit trail, one DPO dashboard for both.

Any third-party script tagged with a data-category attribute stays out of the page until that specific category is granted. Necessary cookies always fire. Analytics, Marketing, Functional, and Unclassified categories are held back independently, so a partial decision - accept Analytics, reject Marketing - blocks exactly the right scripts instead of an all-or-nothing switch.

A headless crawl of your own site (up to 5 pages per run) reads every cookie that gets set and every third-party script domain that loads, then cross-references that against what you've already declared in the tracker registry. Your DPO only gets an email when the scan finds something genuinely new and undeclared - not a repeat alert for a tracker you already know about.

No - it's a core module, bundled free with every standard plan starting at Starter, including the automated scanner. The one exception is the standalone Shield Collect plans (Lite/Plus), which are a narrower forms-only product and don't include the full cookie-consent stack.