DPDP, operational tool
Cookie Consent
Scans what your website and your app actually run, serves a banner that blocks before consent, records every choice as a receipt, and tells a hospital, a bank or a school which page is leaking an identifier to a third party.
What it does
- Scans a site and sorts what it finds into strictly necessary, functional, analytics and marketing, against a tracker knowledge base and a signature library of more than 200 cookie names and patterns tuned for India.
- Runtime browser scans that load the page, run its scripts and watch the cookies actually set; scripted journeys through login and checkout; geographic scans; differential scans between releases; a crawler for property discovery; scheduled rescans with drift alerts.
- A banner served from the scan, in English and the scheduled languages, with accept all, reject non essential and choose by category, layout templates in your brand, a first party memory of the choice and a receipt for each.
- Prior blocking: known third party scripts and iframes are neutralised before they load and released per category after consent, so a site with hard coded tags is compliant without engineering. Consent state pushed to Google Tag Manager and Adobe Launch, with Consent Mode v2.
- Sensitive data leakage control: finds every route by which a sensitive value could reach a third party (beacons carrying the URL and title, session replay, referrers, identifiers in the URL), judges the page against a sector policy pack, and produces the safe redacted URL and title.
- Six India sector packs: healthcare, banking and finance, education, ecommerce, telecom, travel, each knowing the identifiers and the sensitive journeys of its sector.
- Mobile app SDK scanner for Android APK and iOS IPA files: the third party SDKs compiled in, the permissions declared, the App Tracking Transparency and SKAdNetwork settings.
- A cookie notice generated from the approved register, an approval and quarantine workflow for unknown cookies, and an operator console with organisations and roles.
How it maps to the law
| Obligation | Where | What the product does | Status |
|---|---|---|---|
| Specific and informed consent per purpose | Section 6(1) | Category banner built from what the site actually runs. | Built |
| Withdrawal as easy as consent | Section 6(4) | Reject and re-open controls, choice remembered first party. | Built |
| Demonstrable consent | Section 6(10) | Receipt per choice with the notice version seen. | Built |
| Nothing runs before consent | Section 6(1) | Prior blocking of third party scripts and iframes. | In build, September 2026 |
| Notice accurate to processing | Section 5 | Cookie notice generated from the approved register. | Built |
| No tracking or targeted advertising of children | Section 9(3) | Education pack prohibits analytics, advertising and session replay on a student journey. | Built |
| Reasonable security safeguards | Section 8(5), Rule 6 | Leakage control with sector policy packs and redaction previews. | Built |
| Notice in the scheduled languages | Rule 3 | Banner in English and the scheduled languages. | In build, September 2026 |
Putting the banner on a site
<script src="https://YOUR-API/banner.js" data-api="https://YOUR-API" data-scan-id="1"></script>
<script>
PricorisConsent.onGranted("analytics", function () { /* load your analytics here */ });
</script>
One tag before the closing body tag. The banner loads the categories from the scan, records the choice and exposes the gating controls.
Honest limits
- The sector dictionaries are a strong Indian starting set and are extended per client; a finding is something to review and fix, not a legal conclusion.
- IAB TCF consent strings are not generated; they matter for programmatic advertising in Europe and add nothing under the DPDP Act. We will build them when a customer needs them.
- The mobile scanner is a static first pass; runtime behaviour of an app needs an instrumented device.
Deployment
FastAPI and PostgreSQL, React console, optional headless browser for runtime scans. The banner is a single self contained script. Self hosted or hosted by us, India region.
Scan your site now
Send the address. The demo shows what it sets, what it leaks, and the banner it would serve.