Data requests, handled — not just collected.
When a visitor asks to see or delete their data, the clock starts — 30 days under GDPR, 45 under CCPA. ConsentPixel gives you a hosted request link, routes every submission into your portal, tracks the deadline, and hands you a ready-to-send response. Most consent tools give you an intake form and leave the rest to a spreadsheet.
A Data Subject Access Request (DSAR) is a legal request from a person to see, correct, or delete the personal data you hold about them. Under GDPR and US state laws like the CCPA, you're required to respond within a fixed window — and to be able to prove you did. Miss the deadline, or lose the paper trail, and a routine request becomes a compliance failure.
Here's the gap most tools leave open: they'll give you a form that collects the request, then stop. The request lands in an inbox, someone has to remember it, find the data, write a response, send it, and hope they logged it somewhere defensible. That manual middle is where deadlines get missed and audit trails go cold. ConsentPixel's DSAR Manager is built to close that gap end to end — from the moment a visitor clicks the link to the moment you have exportable proof the request was resolved on time.
The DSAR Manager covers the whole request — intake, routing, deadline, response, and proof — not just the form at the front.
How it works
Five steps, most of them automatic. You set it up once; the flow runs every time someone submits a request.
Publish your request link
ConsentPixel hosts a branded DSAR request form at your own link. Drop it into your privacy policy or footer — the same place regulators expect to find it. Visitors submit access, correction, or deletion requests without you building anything.
Every request routes into your portal
The moment a request is submitted, it's logged in your ConsentPixel portal and you get an immediate email notification — so a request never sits unseen in a shared inbox. Each one is captured with its type, timestamp, and requester details.
The deadline clock starts automatically
Each request shows the days remaining against the right legal window — 30 days for GDPR, 45 for CCPA — with overdue alerts before you run out of time. No manual date maths, no missed windows.
Respond with a ready template
Pre-written GDPR and CCPA response templates are built in. Customise the details, confirm the data, and send — instead of drafting a compliant response from scratch under time pressure.
Everything is logged and exportable
Every request — date received, type, status, response date — is kept in a full DSAR log you can export. If you're ever asked to demonstrate you handle requests properly, the record is already there.
See what a plaintiff firm sees first
DSAR handling is the paperwork side of compliance. The litigation side is what fires before consent. See which trackers fire before consent on your site, in about 10 seconds.
Scan your site free →DSAR handling, compared
Not every consent tool actually manages DSARs — many stop at a form, and the ones that go further usually charge enterprise money for it. Here's how ConsentPixel's DSAR Manager compares with the tools US SMBs and agencies most often weigh, on the dimensions that decide whether a request gets handled or dropped.
| DSAR capability | ConsentPixel | iubenda | OneTrust | Osano | Pure CMPs* |
|---|---|---|---|---|---|
| Hosted public request link | ✓ Included | Advanced tier+ | ✓ | ✓ | ✗ Usually none |
| Request routing & tracking | ✓ Built in | ✗ Manual | ✓ | ✓ | ✗ |
| Deadline clock (GDPR 30 / CCPA 45) | ✓ Automatic | ✗ | ✓ | Varies | ✗ |
| GDPR & CCPA response templates | ✓ Included | ✗ | ✓ | Varies | ✗ |
| Exportable audit trail | ✓ Exportable | ✗ No trail | ✓ | ✓ | ✗ |
| Bundled with consent + CIPA blocking | ✓ One tool | Docs-first | Suite | Suite | Consent only |
| Entry price | From $8.99/domain/mo | $24.99/site/mo+ | $10k/yr min | $199/mo | Low, but no DSAR |
*Pure CMPs = cookie-banner-only tools such as CookieYes and Cookiebot. Comparison reflects publicly reported information as of mid-2026; vendors' tiers and features change, so verify current capabilities directly. ConsentPixel figures describe our own product.
The revealing gap isn't who has a form — it's who has everything after the form. Reviewers note that iubenda's intake form, available on higher tiers, comes with "no request tracking, routing, or audit trail — you're managing responses manually." The enterprise suites (OneTrust, Osano) do handle the full lifecycle, but bundle it into $199/month-and-up platforms alongside data-mapping and vendor-risk modules most SMBs never use. ConsentPixel gives you the full lifecycle — routing, deadline tracking, templates, exportable proof — at per-domain pricing, next to the CIPA-first blocking that's the reason you're here.
Why "just a form" isn't enough
A DSAR intake form is the easy 10% of the job. The legal risk lives in the other 90% — the part that happens after someone hits submit:
The deadline is the risk
GDPR gives you one month; the CCPA gives you 45 days. A form doesn't count days. If a request sits in an inbox over a busy fortnight, you can breach the deadline without ever seeing it happen.
Proof is the defence
Regulators and courts don't ask whether you meant to comply — they ask you to show it. Without a logged, exportable trail of when each request came in and when it was answered, you're relying on memory and screenshots.
Manual handling doesn't scale
One request a quarter is manageable by hand. A viral post, a data-conscious audience, or ten client sites turns that into a queue — and manual tracking is exactly where things fall through.
Consistency is credibility
Templated, routed responses mean every requester gets a complete, compliant answer in the same shape — not a rushed reply that varies with who happened to pick it up.
Built for agencies and multi-site owners
If you manage more than one site, DSAR handling multiplies fast — and this is where the per-domain model earns its keep. Every client site can have its own hosted request link, with every request flowing into one portal you manage centrally. Instead of logging into a different tool for each brand, or paying a separate per-site subscription for a form that doesn't even track the request, you handle the whole portfolio's data requests from a single place — and can show each client a clean, exportable record of how theirs were handled. It's a service line you can stand behind, not a cost you absorb. See our agency plans for how the multi-domain model works.
What's in the DSAR Manager
Hosted request form
A branded DSAR intake form hosted for you, ready to link from your privacy policy — no build, no plugin.
Instant routing & alerts
Every submission lands in your portal and pings you by email the moment it arrives, so nothing slips.
Deadline tracking
Days-remaining counters against GDPR's 30-day and CCPA's 45-day windows, with overdue warnings.
Response templates
Pre-written GDPR and CCPA replies you customise and send — compliant answers without starting blank.
Full DSAR log
Date received, request type, status, response date — the complete history of every request.
One-click export
Export the log whenever you need to demonstrate your request-handling to a regulator, client, or auditor.
Where DSAR fits in your compliance
Compliance has two halves. One is prevention — stopping trackers from firing before consent, which is where CIPA and the wiretapping lawsuits live, and where ConsentPixel's core engine works. The other is rights handling — responding properly when someone exercises their data rights, which is what the DSAR Manager covers.
Most tools do one or the other. A cookie banner blocks (sometimes) but ignores data requests; a documents suite writes policies but leaves DSARs to a spreadsheet. ConsentPixel does both in one tool — prevention on the page and rights handling behind it — so a single subscription covers the exposure that ends in a lawsuit and the obligation that ends in a regulator's letter.
Works alongside
The DSAR Manager is one layer of how ConsentPixel keeps you defensible. These features work with it:
Consent Log
Immutable, timestamped proof of every consent decision — the evidence a defense turns on.
Learn more →Coverage Monitor
Verifies every page stays protected — so trackers can't fire unconsented behind your back.
Learn more →Privacy Policy Generator
Built from your real scan data — and the natural home for your DSAR request link.
Learn more →Frequently asked questions
What is a DSAR?
A DSAR — Data Subject Access Request — is a formal request from an individual to see, correct, or delete the personal data an organisation holds about them. The right exists under the GDPR and under US state laws such as California's CCPA/CPRA, and it comes with a deadline: you generally have 30 days to respond under GDPR and 45 days under the CCPA. Handling one properly means receiving the request, verifying it, locating the data, responding within the window, and keeping a record that you did — which is the full lifecycle ConsentPixel's DSAR Manager is built to cover.
How does ConsentPixel's DSAR Manager work?
ConsentPixel hosts a branded DSAR request form at your own link, which you add to your privacy policy or footer. When a visitor submits a request, it's routed into your ConsentPixel portal and you're notified by email immediately. Each request shows the days remaining against the correct legal deadline — 30 days for GDPR, 45 for CCPA — with overdue alerts. You respond using built-in GDPR and CCPA templates, and every request is recorded in an exportable log capturing the date received, type, status, and response date. It covers the whole request, not just the intake form.
How is this different from tools that just offer a DSAR form?
Many consent tools stop at the intake form — the request lands somewhere and you manage everything after it by hand. That's the part where deadlines get missed and audit trails go cold. Some well-known platforms provide a form on their higher tiers but, as reviewers have noted, with no request tracking, routing, or audit trail. ConsentPixel handles the full lifecycle: routing, automatic deadline tracking, response templates, and an exportable audit trail. The enterprise suites that do all this too tend to bundle it into platforms starting around $199/month or $10,000/year, whereas ConsentPixel includes it at per-domain pricing.
Which plans include the DSAR Manager?
The DSAR Manager is available across ConsentPixel plans, from Starter at $8.99/domain/month up through the Growth and Agency tiers. For agencies and multi-site owners, each site can have its own hosted request link while all requests flow into a single portal, which is why the per-domain model tends to work out far cheaper than per-site subscriptions elsewhere. Check the pricing page for the current per-plan breakdown, since plan contents are updated from time to time.
Does handling DSARs make my site CIPA-compliant?
No — and it's important to be clear about that. DSAR handling addresses data-rights obligations under GDPR and state privacy laws, which is a separate matter from CIPA wiretapping exposure. CIPA claims are about trackers firing before a visitor consents, on page load — a prevention problem that the DSAR Manager doesn't touch. That's handled by ConsentPixel's core blocking and Coverage Monitor. The two work together: prevention stops the exposure that ends in a lawsuit, and DSAR handling covers the obligation that ends in a regulator's letter. This page is educational and not legal advice; consult a qualified privacy professional about your specific obligations.
Can agencies manage DSARs across multiple client sites?
Yes. Each client site gets its own hosted DSAR request link, and every request across your portfolio flows into a single ConsentPixel portal, so you're not logging into separate tools or paying separate per-site subscriptions for each brand. You can track deadlines across all sites centrally and export a clean, per-client record of how each site's requests were handled — which turns DSAR handling into a service you can offer clients rather than an overhead you absorb. The per-domain pricing model is designed for exactly this multi-site shape.
Handle every data request — and prove you did
ConsentPixel — Privacy · Verified pairs CIPA-first, prevention-first consent with full DSAR handling: a hosted request link, deadline tracking, response templates, and an exportable audit trail. One tool for both halves of compliance.