Defaults and limits

Every default and limit in the product: settings, rate limits, sizes, durations, retries and retention. The operator of a deployment can change some of them; Configuration lists those.

Project settings#

Set under Settings.

Setting	Default	Choices or limit
Privacy contact	Empty	An email address
Data protection officer	Empty	A name
Count as “expiring soon” within	30 days	7, 14, 30 or 60 days. The console lists and the Overview figure always count 30 days
Keep evidence for	7 years	1, 3, 7 or 10 years
Erase after inactivity	Off	Off, 1, 3 or 5 years
Monthly consent records in your plan	Unlimited	Any number. Consent is still recorded over the limit
Response deadline	30 days	30, 45 or 60 days. Never more than 90 days for a request from India
Require a second person to publish forms	Off	On or off
Store a reversible subject identifier	Off	On or off
The rights request form asks for	Empty. The form asks for an email address or account id	Up to 120 characters
Translation Service	Sarvam	Sarvam, Azure AI Translator, Google Cloud Translation, or another service with an OpenAI-compatible API
CMP ID	Empty	The id issued by IAB Europe
CMP version	1	A number

Forms, purposes and scans#

Setting	Default	Choices or limit
How long a decision stays valid, on a form	12 months	90 days, 6 months, 12 months or 24 months
How long a decision on this lasts, on a purpose	365 days	1 to 3650 days
Privacy button	On	On or off
Button position	Bottom left	Bottom left or Bottom right
Show a reject-all button	On	On or off
Let visitors choose partners one by one	On	On or off
Ask "Are you 18 or older?"	Never	Never, Where the DPDP Act applies or Everywhere
Honour Global Privacy Control	On	On or off
Google Consent Mode v2	On	On or off
IAB Global Privacy Platform	Off	On or off
IAB TCF v2.2	Off	On or off
Require double opt-in, on an email opt-in form	On	On or off
Custom CSS	Empty	Up to 20,000 characters
Custom layout	Empty	Up to 20,000 characters of HTML
Font family	Empty	Up to 200 characters
Pages to visit, in a scan	5	1, 3, 5, 10 or 20
Rescan automatically	Off	Off, every week or every month

A record expires at the earliest lifetime among the purposes the person allowed.

Keys and properties#

Item	Default or limit
A new key	Starts as a test key. It becomes live after you request it and the operator approves
Requests per key	600 a minute for a test key, 6,000 once live
Rate limit you set when you create a key	60 to 600,000 requests a minute
Checks per minute on a key with `consent:check`	60 to 6,000 identifiers a minute, 600 unless set
Test records	Deleted 30 days after their last change
Origins on a property	Up to 50
Property key	Up to 60 characters
Property export or import file	Up to 200 MB

A key on the default limit moves from 600 to 6,000 when it goes live. A limit you set yourself stays as it is.

Rate limits#

Limits are counted in one-minute windows, except the hosted form.

Budget	Default	Counts
For each key	600 a minute for a test key, 6,000 once live	Every request made with the key
Calls on a person, for each key	60 a minute	`subjects/find`, `export`, `withdraw`, `erase`, `link`, `requests/link`, notice links and processor tasks, on top of the key's budget
Consent checks, for each key	600 identifiers a minute	Each identifier in `consent/check`, on top of the key's budget
Audit log feed, for each key	60 a minute	`GET /audit-log`, on top of the key's budget
Hosted notice page, for each address	300 requests and 20 unknown links in 10 minutes	Requests to `/n/{token}` from one IP address
Browser and app writes, for each key and address	60 a minute	Writes made with a publishable key from one IP address
For each address, API	3,000 a minute	Every request to `/sdk` from one IP address, whatever the key
For each address, console	300 a minute	Every request the console makes to `/api` from one IP address
Hosted rights request form	5 an hour for each address	Requests submitted through the form

Server calls with a secret key are not held to the per-address write limit.
/health and /metrics are not rate limited.
A request over a limit gets 429 with a Retry-After header in seconds.

Responses to keyed requests show where the key stands. RateLimit-Reset is the number of seconds until the window starts again.

RateLimit-Limit: 600
RateLimit-Remaining: 587
RateLimit-Reset: 42

Rate limits covers how to stay within them.

Request sizes#

What	Limit
A JSON request body	100 KB
`metadata` from a server	8,192 bytes of JSON
`metadata` from the browser runtime	6 KB (6,144 bytes)
`decisions`	1 to 100 in one request
`identifiers`	5 in one call
`subjectId`	255 characters
`formKey`, `purposeKey`	60 characters
`pageUrl`, `reason`, `returnUrl`	500 characters
`guardian.reference`	200 characters
`email`	255 characters
`locale`	10 characters
`consentId` in `GET /form`	Up to five ids, separated by commas
`Idempotency-Key`	1 to 255 printable ASCII characters, no spaces
Details on the hosted request form	2,000 characters
Reply to the person on a rights request	4,000 characters
`alsoKnownAs` in a consent check	4
`noticeReference`	120 characters
`capture.agentRef`, `capture.locationRef`	100 printable characters
`capture.methodReference`	128 characters
Body of the import and notice campaign console calls	1 MB and 2 MB
Import file	100,000 rows and 50 MB, sent in batches of 250 rows
Records imports may write in a project	100,000 a UTC day
Notice campaign file	200,000 rows and 50 MB, sent 2,000 rows at a time
Identifiers for one person in a notice campaign	5
Your reference for a person in a notice campaign	64 characters
Notice links in one batch, and in one page of `GET /campaigns/…/links`	100,000, and 5,000
Processor reports in one API call, and in one console report	200, and 500
Processor tasks in one page	500
Evidence file fingerprinted in the console	50 MB
Audit log download	366 days in one file
Audit log feed page	500 entries, up to 1,000

Time limits and lifetimes#

What	How long
SDK request timeout	10 seconds by default: `timeoutMs` in Node.js and Android, `timeout` in Python and iOS
Your webhook endpoint must answer within	8 seconds
A webhook signature is accepted for	5 minutes either side of your clock
An idempotency key is remembered for	24 hours
A repeat waits for a first request still running	Up to 2 seconds, then `409`
An email confirmation link works for	48 hours
A consent portal link works for	7 days
A request status link works for	180 days
Consent cookies last	The form's consent period, never more than 395 days
Detailed breach report to the Board	72 hours from awareness, or the extension the Board allowed
`checkConsent()` and `check_consent()`	1 second by default, never retried
`collectedAt`	Not in the future and not before 1990
`expiresAt` on an earlier consent	After the call, and within 3,650 days of it
An import that sends no batch	Stopped after 30 minutes
An import check that is not written	Discarded after 24 hours
Notice links	Valid 60 to 90 days, 90 by default
A batch of notice links can be downloaded for	7 days
A processor has to stop	7 days by default, 1 to 365
A processor has to erase	30 days by default, 1 to 365
Audit log feed holds back entries younger than	60 seconds

Notices and reminders#

Event	When it is sent
`consent.expired`	Within an hour of a record's `expiresOn`. The check runs every hour
`subject.erasure_notice`	72 hours before a person is erased for inactivity. Erasure is never less than 48 hours after the notice
`subject_request.due_soon`	Once a day for each open request due within five days or overdue
`breach.report_due`	Once, 12 hours before the Board report is due
`breach.people_notice`	Each time someone chooses Send to your systems on a breach
`legal_hold.placed`, `legal_hold.released`	Once for each hold placed, and once when it is released
`usage.threshold_reached`	At 80% and at 100% of the monthly limit, once each per month
`evidence.anchored`	Once for each closed day that has sealed events
`consent.imported`	Once for each import that finishes or is stopped
`campaign.batch_issued`	Once for each batch of notice links
`campaign.withdrawn`	Once for each withdrawal made on a notice link
`campaign.anchored`	Once for each closed day with notice answers or issued batches
`propagation.overdue`	Once a day for each processor with overdue live tasks
`ruleset.changed`	Once for each change of the DPDP rule set, to each project that acknowledged an earlier one
`policy.published`	Once for each policy version published
`project.closing`	When an owner schedules or cancels the project's deletion
`project.deleted`	Once, when the project's data is deleted

Retries#

A webhook delivery counts as made when your endpoint answers 2xx within eight seconds. Anything else is tried again.

Attempt	Sent
1	At once
2	1 minute after attempt 1 failed
3	5 minutes later
4	30 minutes later
5	2 hours later
6	6 hours later
7	12 hours later

Rule	Value
Attempts for one webhook event	7, over about 21 hours
An endpoint is turned off after	10 events in a row that each failed all 7 attempts
Server SDK attempts	3 in all by default, for `GET` requests and writes with an idempotency key
Server SDKs retry after	A network error, a timeout, or `502`, `503` or `504`
Server SDKs do not retry	`429` or `500`
Mobile SDK attempts	1. They never retry

Retention#

Data	Kept for
Consent records and their events	While the consent is in force, then for Keep evidence for. Deleted only when the operator has turned on retention enforcement
Any record, at the least	One calendar year after its last processing or its last event
Test records	30 days after their last change
Webhook delivery log, settled events and failed events	30 days
Processor tasks	As long as their record
Idempotency records	24 hours
Rights requests, audit log, breach register, daily anchors	Not deleted by the product

Data processing has the full table.

Console and hosted pages#

List	Shows
Records list	25 on a page
Export CSV on Records	Up to 100,000 rows
Audit log	50 entries at a time, newest first
Notice campaigns	25 on a page
Processor tasks	50 on a page
Failed webhook events	500 at a time; Replay all sends up to 5,000
Past imports	20 at a time
Cookie list	Up to 200 items
Consent portal	Up to 100 records, newest first

Overview dashboards#

Each person's dashboards on the Overview, and the chart queries they send.

What	Limit
Dashboards	10 for each person in each project
Charts on a dashboard	24. Above 12 the edit bar says the dashboard is hard to read
A saved dashboard	32,768 bytes
Dashboard name, chart title, chart note	80, 120 and 280 characters
Period	366 days for 12 months. A custom period runs up to 365 days
Charts that read single records or events	The last 90 days, or 366 days with a property or a form chosen. Shortened and marked, never refused
Webhook delivery charts	The last 30 days
Comparison	Reads up to 732 days back
Time buckets in one chart	370; 62 with a breakdown; 16 for grouped Columns. Beyond that the chart moves to weeks or months
Groups	Set by the chart type. A heatmap holds 12 by 12
Rows from one chart query	2,000. More is refused with This chart could not be drawn
Time for one chart query	3 seconds. 5 seconds for charts that read single records or events, set by `DASHBOARD_STATEMENT_TIMEOUT_MS`
Wait for a database connection	2 seconds, then The server is busy
Chart queries at once	4 for each request. For each API replica, `DASHBOARD_MAX_STATEMENTS`: by default 30% of `DB_MAX_CONNECTIONS`, at most 6, at least 2
Charts in one request	32. The answer leaves within 27 seconds; a chart that cannot start in time answers busy
Cached results	60 seconds. 300 seconds for a query of single records or events that took 250 milliseconds or more
A query that took too long	Not run again for 60 seconds
Retries in the console	After 5 and 20 seconds, then with each refresh
Refresh automatically	About once a minute while it is on
Small samples	A rate out of fewer than 30 is marked. On six measures a rate out of 1 to 9 is not shown