Registration for Consent Managers under DPDP opens on 13 November 2026. Most marketing teams have filed this under legal. That is a mistake, because the Consent Manager sits directly between your forms and your CRM.
What it actually is
A Consent Manager is a registered intermediary giving people one place to give, review, manage and withdraw consent across every organisation they deal with. Closer to a portable consent wallet than a cookie banner. The individual sees every permission they have granted and can revoke any of them without going to each company separately.
The registration bar is meaningful. A Consent Manager has to be incorporated in India, meet a net worth threshold, be interoperable, and keep consent records the individual can inspect. This is not a plugin you install.
Why it changes marketing operations
Today consent lives inside whatever system captured it. Your email tool knows about email consent. Your WhatsApp provider knows about WhatsApp consent. Your ad platform knows nothing and assumes you handled it. These systems do not talk, which is why unsubscribing from a newsletter rarely stops the SMS.
Once consent is portable and centrally visible, that fragmentation becomes visible too. Someone who revokes through a Consent Manager expects it to take effect everywhere, quickly. If your stack cannot receive that signal and act on it, you will be processing data you no longer have permission to process, with a timestamped record proving it.
Three things to check in your own stack
Can your systems receive a withdrawal signal from outside? Most Indian marketing stacks have no inbound path for “this person revoked consent elsewhere”. Suppression happens through manual list uploads. You need an API.
Do you have one customer identifier across tools? If the same person is an email address in one system, a phone number in another and a cookie ID in a third, you cannot reliably apply a withdrawal across all of them. Identity resolution stops being a personalisation nice-to-have and becomes a compliance dependency.
How long does suppression take today? Measure it. From the moment someone unsubscribes to the moment every system stops sending, how many hours pass? Many teams find the answer is days, because suppression lists sync nightly.
The sequence
You do not need to pick a Consent Manager yet. What you need before November 2026 is a stack that can honour an external signal. Build the plumbing first: a canonical identifier, an inbound suppression API, and a propagation time you are willing to defend. Choosing a provider is a decision you make after that.
General information, not legal advice. Rules current as of July 2026.