DPDP compliance for Next.js and React apps
Engineering teams usually get consent wrong in one of two directions: they build a bespoke banner that nobody maintains and that stores nothing an auditor would accept, or they bolt on an enterprise CMP that adds 90KB to the critical path.
For a Next.js or Vite app the pragmatic answer is a small third-party script that owns the UI, the storage format and the audit trail, and exposes a programmatic API your code can call.
Check this site free — DPDP, GDPR & CCPA score in 10 seconds
No signup for the score. Takes about 10 seconds. We only read your homepage.
What valid consent looks like under the DPDP Act
Section 6 of the DPDP Act is unusually specific about consent. It must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited strictly to the personal data necessary for the stated purpose. Bundled consent — one checkbox covering analytics, advertising, marketing email and profiling — does not satisfy this test.
The Act also requires that withdrawal be as easy as giving consent. In practice that means if a visitor could accept tracking with one click on a banner, they must be able to withdraw it with roughly one click too, at any time, from any page. A buried link in a privacy policy is not equivalent.
- No pre-ticked boxes and no implied consent from continued browsing
- Separate opt-in per purpose: analytics, marketing, functional, advertising
- A notice, in plain language, available in English and the Eighth Schedule languages
- A standing, always-reachable way to withdraw consent
- A record of what was consented to, when, and against which notice version
Installing a DPDP-ready consent banner on Next.js
The mechanics on Next.js are deliberately boring: AssentRepo is a single script tag under 3KB that loads asynchronously, blocks non-essential scripts until consent is recorded, and posts every decision to an audit log. There is no build step and no plugin conflict surface.
- Render the AssentRepo script in app/layout.tsx (or _document.tsx) inside <head>
- Use strategy="beforeInteractive" with next/script so it precedes analytics
- Gate your own analytics init on window.AssentRepo consent state
- Call AssentRepo.openPreferences() from a footer link for one-click withdrawal
- Call AssentRepo.openDataRequest('delete') from your account settings page
Google Consent Mode v2 without the glue code
If you run Google Ads or GA4, Consent Mode v2 is not optional for measurement quality. AssentRepo pushes ad_storage, analytics_storage, ad_user_data and ad_personalization signals to the dataLayer on load and on every change, so Google receives the default-denied state before any tag fires and modelled conversions keep flowing.
Data Principal rights and the request queue
Chapter III of the Act gives every Data Principal the right to access a summary of their personal data and the processing performed, the right to correction and completion, the right to erasure, and the right to nominate someone to exercise those rights on their behalf. You must publish a way to make those requests and you must respond within a reasonable period.
For a small team, the failure mode is not refusing a request — it is losing one. Requests arrive by email, WhatsApp, a contact form and Instagram DM, and nobody owns the spreadsheet. A single intake endpoint with an auditable status trail removes that risk entirely, which is why the AssentRepo banner ships a built-in DSAR form alongside the cookie controls.
You have to be able to prove it
The obligation that catches most teams out is evidentiary. Under Section 8, the Data Fiduciary — you — is responsible for demonstrating compliance, including that valid consent was obtained. If the Board asks and your answer is "our banner was live", that is not evidence.
A defensible consent record contains, at minimum: a stable visitor identifier, the categories accepted and rejected, a UTC timestamp, the version of the notice shown, the policy text hash, and enough network context to establish the request was genuine without storing raw personal identifiers. AssentRepo writes exactly this record for every consent event and one-way hashes the IP address with a server-side salt, so the log is useful to an auditor and useless to an attacker.
Frequently asked questions
Does it work with server-side rendering?
Yes. The script is client-only by design and does not affect your server render or hydration; it mounts its own DOM node after load.
Can I style the banner to match my design system?
Yes — colours, radius, position, copy and language are all configurable from the dashboard customizer, and Pro removes the AssentRepo badge entirely.
What are the penalties?
Section 33 of the DPDP Act allows the Data Protection Board to impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹50 crore for failing to meet obligations to Data Principals.
Get DPDP-ready in five minutes
One script tag: consent banner, audit log, DSAR queue. Free up to 1,000 consent events a month.