Cookie consent under DPDP: what changes for Indian websites

The Digital Personal Data Protection Act, 2023 does not mention cookies, but its consent rules apply to any cookie or tracker that relates to an identifiable person. In practice that means analytics, advertising pixels and session replay tools need a clear opt-in before they run, a notice that explains why, and a way to withdraw. This is not legal advice. TechSum implements consent flows and partner counsel advises on legal interpretation.

Are cookies personal data under DPDP?

The Act defines personal data as data about an individual who is identifiable by or in relation to that data (section 2(t)). A cookie value on its own is just a string. Once it can be linked to a person, through a login, an email address, a phone number or a device profile built up over time, it is personal data.

Most marketing trackers are built to do exactly that linking. A Meta pixel or a Google Ads tag ties browsing to an advertising profile. Analytics tools that store a visitor ID work the same way. The safe assumption is that they fall inside the Act.

What do sections 5 and 6 require?

Section 5 requires a notice that tells people what data is collected, for what purpose, how to withdraw consent and exercise their rights, and how to complain to the Data Protection Board. The DPDP Rules, 2025 (rule 3) add detail on how the notice is presented.

Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, signalled by a clear affirmative action, and limited to the data needed for the stated purpose. Section 6(4) adds that withdrawing consent must be as easy as giving it. Section 6(10) puts the burden on you to show that a notice was given and consent was obtained.

Read against a typical Indian website, that rules out several common patterns:

• A banner that says "by using this site you agree" and sets cookies already.
• A prominent Accept button with a hidden or buried Reject option.
• One switch that bundles analytics, advertising and personalisation together.
• Consent that cannot be changed later without clearing the browser.

What does a DPDP-ready cookie setup look like?

A workable setup has five parts.

1. Nothing non-essential fires before consent: analytics, ad pixels, chat widgets with tracking and embedded video that sets cookies stay off until the visitor opts in.
2. A banner with an equal choice: Accept and Reject sit at the same level, in plain language, in English with a Hindi or Marathi option where your audience needs it. The notice must be available in English or any language in the Eighth Schedule of the Constitution.
3. Categories that mean something: necessary, analytics, advertising. Each with a short line on what it does and who receives the data.
4. A permanent way back: a small "cookie settings" link in the footer that reopens the choices and lets someone withdraw.
5. A record: store when each visitor agreed, to what, and which version of the notice they saw. This is your evidence under section 6(10).

How do I test that consent really works?

Do not trust the banner's own settings screen. Test the result.

1. Open the site in a fresh private window.
2. Open developer tools and the Network tab before accepting anything.
3. Reload. List every request to a domain other than your own.
4. If you see Google Analytics, Meta, LinkedIn, Hotjar or similar requests before you click anything, those tags are not gated.
5. Click Reject and repeat. The same requests should still be absent.
6. Click Accept and confirm they now fire.

Tag Manager is the usual culprit. A tag set to fire on "All Pages" will run regardless of the banner unless it is tied to a consent trigger. Google Consent Mode, with analytics and ad storage set to denied by default, lets Google's tags wait for the signal. Google requires Consent Mode v2 for advertising in the European Economic Area and the UK, and many Indian sites with global audiences use it everywhere for one consistent setup.

What about consent managers?

The Act creates a role called a Consent Manager, a registered entity that lets a person give, manage and withdraw consent through one platform (section 6(7) to 6(9)). The Rules provide for registration with the Data Protection Board, and that part starts about a year after notification. It is a different thing from a website cookie banner tool. You do not need to wait for it to fix your banner today.

Do EU visitors change the picture?

If you also serve visitors in the European Union or UK, GDPR and the ePrivacy rules apply to them as well, and those rules are stricter on cookies. A single banner that meets the higher bar, with region-specific defaults where you want them, is simpler to maintain than two separate systems.

What are the trade-offs?

Honest consent banners reduce the share of visitors who are tracked. Your analytics numbers will drop, and ad audiences will be smaller. That is the cost of the law working as written. You can soften it with consent-aware measurement, such as server-side tagging that respects the choice, and by focusing on first-party data that people give you on purpose through forms and accounts.

Over-engineering is the other risk. A site with a contact form and basic analytics does not need a heavyweight platform. A short banner, a clean notice and gated tags are enough.

Where does TechSum fit?

We set up consent-aware tracking, build the banner and the record, and audit what fires before and after consent. Counsel reviews the wording and the legal position. A good first step is the DPDP Readiness Scan, or the free health check for a quick look at what your site loads today. See Data and Analytics for tracking setup and the Trust, Security and Compliance pillar for the wider work. For the bigger picture, start with what a small business must do first under DPDP.