Cookie Consent in India: Do You Need a Banner Under DPDP?

Who this is for: marketing, growth, product and engineering leaders responsible for websites and apps that use cookies, pixels, tags and SDKs.

If you search the DPDP Act for the word "cookie", you will not find it. That has led some Indian businesses to conclude that cookie banners are a European concern they can ignore. The conclusion is wrong, and it is risky. The DPDP Act regulates personal data, however it is collected, and most of the tracking on a modern website collects personal data.

This guide explains how the Act applies to cookies and similar technologies, what MeitY's guidance expects, and how to build a cookie consent setup that meets the standard. For the underlying consent rules, read what makes consent valid under DPDP.

Are cookies personal data?

Section 2(t) defines personal data as any data about an individual who is identifiable by or in relation to that data. Many cookies store or transmit identifiers, such as a unique visitor ID, an advertising ID or a hashed email, that are used to recognise a person across visits, pages or sites. When they are, the data they collect is personal data, and its processing falls under the DPDP Act.

The same applies to pixels, tags, local storage, device fingerprinting and app SDKs. The law follows the data, not the technology.

Which cookies need consent?

The Act allows only two lawful grounds: consent, or a legitimate use under Section 7. There is no "legitimate interests" ground for analytics or advertising. That gives a practical classification:

The Act contains no explicit exemption for essential cookies. The safest approach is to keep the strictly necessary category genuinely narrow, document why each cookie in it is needed, and put everything else behind consent.

What MeitY's guidance expects

In June 2025, MeitY's National e-Governance Division published a Business Requirement Document (BRD) for consent management systems under the DPDP Act, as part of its "Code for Consent" initiative. The BRD is not legally binding, but it is the clearest official signal of what the government expects. On cookies, it calls for:

• a cookie banner informing users about cookies and tracking technologies
• granular consent by category, such as essential, performance, analytics and marketing, with each category accepted or rejected independently
• a preferences interface where users can change or withdraw consent at any time
• renewed consent when the cookie policy changes
• multilingual support
• secure logging of consent activity
• expiry of cookies and consent records

A cookie setup built to this specification will also meet the core requirements of the Act itself.

What a DPDP-compliant cookie banner needs

Applying Sections 5 and 6 and Rule 3 to cookies gives a clear set of requirements:

1. Notice first. Before non-essential cookies are set, tell users what data is collected, for which purposes, and by whom, in plain language and separately from your terms of use. Link to a full cookie notice that lists each cookie or tag.
2. Affirmative action. Consent requires a deliberate click or toggle. Pre-ticked boxes, "by continuing to browse you accept" and scroll-to-accept do not meet Section 6(1).
3. Real choice. "Accept all" and "Reject all" should be equally easy to find and use. Making refusal harder than acceptance undermines the claim that consent was free.
4. Granularity. Let users choose by category, not only all or nothing.
5. Nothing fires before consent. Analytics and advertising tags must not load until the user has agreed. This is the requirement most often broken in practice.
6. Easy withdrawal. Section 6(4) requires withdrawal to be as easy as giving consent. A persistent "Cookie settings" link in the footer, or a small floating icon, does this.
7. Proof. Under Section 6(10), you must be able to prove consent. Log each choice with a timestamp, banner version and categories accepted.
8. Languages. Section 6(3) requires consent requests to be available in English or any Eighth Schedule language, which matters for sites serving regional audiences.

Dark patterns: a second regulator is watching

Cookie banners are also subject to the Central Consumer Protection Authority's Guidelines for Prevention and Regulation of Dark Patterns, 2023. They identify practices such as interface interference, forced action, nagging and confirm-shaming as unfair trade practices. A banner with a bright "Accept" button and a hidden, grey "Manage options" link, or one that reappears on every page after a refusal, risks problems under both regimes.

Children's sites and apps

Section 9(3) prohibits tracking, behavioural monitoring and targeted advertising directed at children (under 18), regardless of consent. If your audience includes children, such as an edtech, gaming or kids' content platform, advertising and cross-site tracking cookies should not run for those users at all.

Third-party tags and your liability

Every third-party script on your site, whether an ad network, social pixel or chat widget, processes your visitors' data. Under Section 8(1), you are responsible for that processing. Audit your tags regularly: marketing teams often add pixels through tag managers without review, and each new tag can silently break your consent setup.

Cookie consent checklist

Common cookie consent mistakes

• Assuming no mention means no obligation. The Act regulates personal data, and cookies collect it.
• Copying a GDPR banner without testing it. Many imported banners still fire tags before consent.
• Classifying analytics as essential. It rarely is.
• No withdrawal route. Once the banner is dismissed, many sites offer no way to change the choice.
• Banner without logs. Without records, you cannot prove consent under Section 6(10).

How ConsentifyAI helps

ConsentifyAI's cookie management module scans your site to inventory cookies and tags, classifies them by category, and serves a DPDP-ready banner with granular choices, equal Accept and Reject options and multilingual support. Tags are blocked until consent is given, every choice is logged with the banner version in a tamper-evident audit trail, and users can change their preferences at any time.