Skip to content

Consent Landscape

In development

Consent Landscape is still in active development and is not yet generally available. What follows is a preview of what's coming, based on the current build — screens and workflows may change before release.

A cookie/website consent management platform (CMP) built into Dutro — build DPDPA/GDPR-style consent banners, track real visitor consent, and discover what trackers actually run on your site.

Everything in this section is scoped to a consent site — a registered website/domain. If you haven't created one yet, the Dashboard will prompt you to:

Field What to enter
Site name Anything recognizable, e.g. "Customer portal"
Hostname The actual domain, e.g. portal.example.com
Environment Development or Production
Support email Optional
Privacy policy URL / Cookie policy URL Optional but recommended

After creating a site you'll need to verify domain ownership by adding a one-time DNS TXT record (name and value are shown once — save them). Once verified, use the site switcher at the top of any Consent Landscape page to work on it.

Dashboard

Called "Consent Effectiveness Dashboard." Once your site is live, this shows:

  • Consent Receipts (last 30 days), Active Grants, Denied or Withdrawn (includes Global Privacy Control signals), and Publish Readiness %
  • Recent proof events (a feed of actual consent activity)
  • Domain coverage and verification status
  • Publish checks — a checklist of anything blocking you from going live (e.g. "Default language not reviewed")

Notice Builder

Configures the actual consent-banner logic for the site. Changes go through a Draft → Submit review → Approve workflow before they're live. Five tabs:

  • Categories — the consent categories shown in your banner (Strictly necessary, Functional, Analytics, Advertising by default). Exactly one category must be marked Necessary (always-on, no opt-out) — that's usually "Strictly necessary." Add more with + Add category.
  • Purposes — the business reasons you're processing data, which get tied to individual trackers later in Vendors & Tags. Add with + Add purpose.
  • Jurisdictions — region-specific consent rules: a Rule Name, the Countries it applies to (e.g. "IN, GB"), Mode (Opt in vs Opt out), Consent Lifetime in days, whether to honor GPC (Global Privacy Control), and a Priority if rules could conflict.
  • Domains — the domains registered to this site, with DNS verification status. Add more with the same Hostname/Environment fields as site creation.
  • Publish & versions — publishing creates a signed, immutable snapshot; a visitor's existing consent stays tied to whichever version was live when they gave it. Add a Change Summary describing what changed and why, then Publish version (requires review/approval first).

A visual banner builder with a live preview. Design on the left, see the actual banner render on the right ("optional processing starts denied" by default — privacy-by-default).

  • Appearance — Layout (e.g. Bottom bar), Accent/Background/Text colors, corner radius
  • Language copy — pick a language, then set the Title, Body text, and the four button labels (Accept all, Reject all, Manage preferences, Save preferences)

Click Save design to draft when done. At the bottom, Install on the registered site gives you a copyable <script> tag — place it immediately inside <head>, before any analytics or advertising scripts, and don't add async or defer. If you're hand-marking optional scripts on your site, they need type="text/plain" plus data-src and data-dutro-category attributes so Dutro can hold them until consent is given.

Called "Append-Only Consent Event Record." This is the tamper-evident proof log of actual visitor consent decisions — distinct from the Compliance Log, which tracks your team's internal activity. It deliberately stores only pseudonymous identifiers and chained proof hashes — no raw IP addresses or user-agent strings — so the proof record itself doesn't become a privacy liability.

Search by receipt, event, or proof hash; filter by event type. Export the evidence as CSV when you need to demonstrate compliance.

Vendors & Tags

Called "Vendor-to-Purpose Mapping." Discover which third-party trackers/scripts actually run on your site, and map each one to a vendor and a consent category. Three tabs:

  • Tracker inventory — everything discovered so far (Tracker, Type, Vendor, Category, Review status)
  • Scans — enter your site's URL and click Run isolated scan. The scanner captures cookies, client storage, and network requests before consent, after acceptance, and after rejection (it never stores the actual storage values, just what's present) — this is how Dutro tells you if a script is firing before consent when it shouldn't be
  • Vendors — register known third-party vendors manually (Name, Privacy policy URL, Domain patterns e.g. cdn.example.com, *.vendor.com) if you'd rather not wait for a scan to find them