Does the DPDP Act Require Cookie Consent in India? A Guide for Websites

If your website uses Google Analytics, Meta Pixel, Google Ads, LinkedIn Insight Tag or other tracking technologies, you may be wondering whether India's Digital Personal Data Protection Act, 2023 requires you to display a cookie consent banner.

That does not mean cookies automatically fall outside the DPDP framework.

The DPDP Act regulates the processing of digital personal data. If a cookie, tracking technology or related system processes information that qualifies as personal data, the organisation using it needs to decide whether that processing is permitted under the Act and whether consent is required.

This distinction matters for every Indian business preparing its website for DPDP compliance.

Does the DPDP Act mention cookies?

No.

You will not find a section in the DPDP Act saying, "Every website must display a cookie banner." Nor do the DPDP Rules create a dedicated cookie consent framework comparable to some international privacy regimes.

Instead, the law focuses on personal data and how it is processed.

So the more useful question is not "Does my website use cookies?" It is:

What information do my cookies and trackers process, for what purpose, and what legal basis applies to that processing?

When can cookies involve personal data?

Cookies are simply a technical mechanism for storing or retrieving information.

Some cookies support basic website functions, such as:

• maintaining a login session
• remembering items in a shopping cart
• preventing fraud
• maintaining security
• remembering user preferences

Other technologies are used to analyse or follow user behaviour. Common examples include:

• Google Analytics
• Google Ads conversion tracking
• Meta Pixel
• LinkedIn Insight Tag
• Microsoft Clarity
• Hotjar
• marketing automation tools
• advertising networks
• cross-site tracking technologies

Depending on how they are configured, these technologies may process identifiers, device information, browsing behaviour, IP-related information or other data relating to an identifiable individual.

That is where DPDP considerations arise.

What the DPDP Act says about consent

Section 6 of the DPDP Act sets a high standard for consent.

Where processing is based on consent, that consent must be:

• free
• specific
• informed
• unconditional
• unambiguous
• given through a clear affirmative action

The consent must also be limited to the personal data necessary for the specified purpose.

So businesses should be careful about assuming that telling visitors "by using this website you accept cookies" will satisfy the DPDP consent standard.

If consent is required for a particular type of processing, the user must get a meaningful opportunity to make that choice.

What notice must be provided?

Section 5 of the DPDP Act deals with notice.

When consent is requested, the Data Principal must receive information about the personal data proposed to be processed and the purpose of that processing.

The DPDP Rules add more detail. Rule 3 requires the notice to be understandable on its own, without depending on other information, and to set out in clear and plain language:

• an itemised description of the personal data
• the specified purpose or purposes of processing
• information that lets the individual withdraw consent, exercise their rights and make complaints

For websites, this means the privacy experience may need to do more than display:

We use cookies to improve your experience.

Businesses need to understand what is actually being collected, and why.

Does every website need a cookie banner?

Not necessarily.

A website should first work through six questions:

1. 1What cookies and trackers are present?
2. 2What data does each technology process?
3. 3Why is that data being processed?
4. 4Does the processing involve personal data?
5. 5What basis under the DPDP Act applies?
6. 6If consent is relied upon, is valid consent obtained before the relevant processing starts?

A simple company website using only technologies needed to deliver the service has a very different compliance profile from an ecommerce site running several analytics, advertising and retargeting tools.

That is why copying another website's cookie banner is not a reliable DPDP compliance strategy.

Google Analytics, Meta Pixel and ad trackers

Google Analytics is one of the most common technologies businesses should review. It can generate and process information about website visitors and how they interact with a site.

A business preparing for DPDP should know:

• which version and configuration it uses
• what identifiers are generated
• whether IP-related information is processed
• what events are recorded
• whether Google Signals or advertising features are enabled
• whether analytics data is linked with other information
• when the analytics scripts begin processing information

So the answer to "Do I need consent for Google Analytics?" depends on the processing taking place and the applicable provisions of the DPDP framework.

Meta Pixel and advertising trackers deserve particularly careful review, because they are often designed to understand user behaviour, measure conversions or build audiences.

Check whether tags such as Meta Pixel, Google Ads, LinkedIn Insight Tag, TikTok Pixel or other advertising tags run before the visitor has made any meaningful choice.

Can users withdraw consent?

Yes.

Section 6 gives Data Principals the right to withdraw consent, and withdrawing should be comparable in ease to giving consent.

For a website, that means visitors need a practical way to return to their privacy choices and change them. A banner shown once, with no preference mechanism to come back to, may create problems.

What Indian businesses should do now

The first step is not to install a random cookie banner.

It is to run a website tracking audit. Identify:

• every first-party cookie
• every third-party cookie
• analytics tools
• advertising pixels
• session-replay tools
• embedded content
• marketing automation scripts
• third-party SDKs
• when each tracker fires
• what information each tool processes

Once you know what your website is actually doing, you can decide what notice and consent controls are appropriate.

How ConsentCenter helps

ConsentCenter is built for exactly this first step and everything after it:

• Cookie and tracker scanning finds first-party and third-party cookies, pixels and SDKs across your website, and flags new ones as they appear.
• Categorisation by purpose groups each tracker by vendor and purpose, so your notice reflects what actually runs.
• Real-time blocking can hold non-essential scripts until a visitor makes a choice.
• A permanent preference center lets visitors come back and change or withdraw consent at any time.
• Consent records keep a timestamped log of every choice for audits.

Prepare before May 2027

The final DPDP Rules were notified in November 2025. The substantive provisions on notice, consent and Data Fiduciary obligations take effect in May 2027.

Use the implementation period to understand your website now, rather than waiting for the last few weeks before enforcement.