DPDP

Cookies are everywhere. They remember logins, hold shopping carts, measure traffic and, in some cases, let advertisers follow users across sites. So does the DPDP Act cookie consent regime require a banner like Europe's? The answer is nuanced. The Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025 (DPDP Rules) never use the word "cookie" and create no dedicated cookie regime. Neither the DPDP Act nor the DPDP Rules, 2025 uses the word “cookie” or establishes a dedicated cookie-consent regime. Instead, the legal question is whether the information collected through a cookie constitutes digital personal data and whether its collection or use amounts to processing under the DPDP framework.

This guide explains what the law says, what it leaves open, and what Indian websites should do before the main obligations begin on May 2027.

Does the DPDP Act apply to cookies?

Not by name, but often in substance. The question is whether the information a cookie collects is personal data. Section 2(t) defines personal data as data about an individual who is identifiable by or in relation to that data, and section 2(n) defines digital personal data as personal data in digital form.

Two assumptions are unsafe:

• "Every cookie is personal data." The Act does not say this.
• "Cookies are outside the Act." This is risky wherever an identifier can be linked to a person through an account, device information or browsing behaviour. The words "in relation to" are wide.

For each cookie, SDK or pixel, ask: what does it collect, can it be linked to an individual, what is the purpose, and what legal basis applies?

Scope also matters. Under section 3(b), the Act reaches processing outside India if it relates to offering goods or services to people in India, so a foreign site serving Indian visitors can be covered.

For each cookie or tracking technology, ask:

Cookie or tracker → What data does it collect? → Can an individual be identified? → Is it personal data? → What is the purpose? → What lawful basis applies?

This analysis is more reliable than classifying cookies solely by technical labels such as “essential,” “analytics” or “marketing.”

When do the cookie-related rules apply?

Two Gazette notifications dated 13 November 2025 fix the dates: G.S.R. 843(E) for the Act and G.S.R. 846(E) for the Rules.

Date	What commences
Nov 2025	Definitions, the Data Protection Board provisions and certain other sections
Nov 2026	Section 6(9) and Rule 4 (Consent Manager registration)
May 2027	Sections 3–5, 6(1)–(8) and (10), 7–17 and 33; Rules 3 and 5–16

The notice and consent duties in sections 5 and 6, and the penalty provisions, therefore apply from May 2027.

Do not treat the delay as time to wait, because tracker audits and consent rebuilds take months. A December 2024 survey by the ASCI Academy, PSA Legal and Tsaaro Consulting found that only 3 of the 50 most-visited Indian websites showed a cookie consent banner at all.

Which legal basis can a website use?

Section 4(1) allows processing only in accordance with the Act and for a lawful purpose, based on either the Data Principal's consent or a "certain legitimate use" under section 7. Consent is not the only route, but the legitimate uses are narrow. Section 7(a), for example, covers data the person voluntarily provided for a specified purpose. Data collected passively by a third-party advertising tracker fits that wording poorly.

Is there an "essential cookie" exemption? No. The Act has no equivalent of the EU ePrivacy exception for strictly necessary cookies, so do not assume "essential" means "no consent needed". Some technical processing may involve no personal data. A session cookie for a service the user actively requested may be defensible under section 7(a). Neither point is settled, because the Act has no cookie-specific rule.

What counts as valid consent?

Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. The Act's own illustration helps: a telemedicine app that also asks for contact-list access can rely on consent only for what its service needs. A banner that bundles analytics, advertising and social tracking behind one "Accept" is hard to defend as specific. Under section 6(2), any part of consent that infringes the law is invalid to that extent.

What must the notice say?

Section 5 requires every consent request to be accompanied or preceded by a notice stating the personal data and purpose, how the person can withdraw consent and exercise rights, and how to complain to the Data Protection Board.

Rule 3 adds detail. The notice must be understandable on its own, in clear and plain language, with an itemised description of the data, the specific purposes, and the goods, services or uses the processing enables. It must give your website or app link and describe the means to withdraw consent, exercise rights and complain to the Board.

"We use cookies to improve your experience" is unlikely to meet this standard where personal data is involved.

Two further requirements are easy to miss:

• Language and contact details. Sections 5(3) and 6(3) require access in English or any Eighth Schedule language, and section 6(3) requires contact details for a Data Protection Officer or another authorised person. Rule 9 requires you to publish that contact information prominently.
• Existing consents. Under section 5(2), where users consented before the Act commenced, you must give them a fresh notice as soon as reasonably practicable.

Banner design: what the law does and does not say

Browse-to-accept. The Act never uses the phrase. But continuing to scroll or closing a banner is hard to reconcile with a "clear affirmative action". It is legally questionable, not expressly banned.

Pre-ticked boxes. Likewise, the Act does not mention them, but a default that switches optional tracking on invites the same objection. Under the GDPR, the Court of Justice held in Planet49 (2019) that pre-ticked boxes do not give valid cookie consent. That ruling is persuasive only, as India has no equivalent, and I found no Indian court or Data Protection Board decision on banner design.

"Reject All". Not expressly required. The Act and Rules prescribe no layout, button colour or first-layer refusal option. But section 6(4) says withdrawal must be as easy as giving consent, so a banner where acceptance takes one click and refusal takes several screens creates the asymmetry the law warns against.

Dark patterns. Separately, the Central Consumer Protection Authority's Guidelines for Prevention and Regulation of Dark Patterns, 2023, issued under section 18 of the Consumer Protection Act, 2019, target manipulative interface design. They are guidelines, not rules, and sit outside the DPDP Act, but a deceptive consent interface may still fall within them.

Analytics, advertising and third-party trackers

Analytics cookies need a fact-specific assessment: some use persistent identifiers, IP-related or device data that can be linked to a person. Advertising and cross-site trackers are riskier because they can build profiles. For each vendor, establish what it collects, whether the data leaves your site, what the vendor does with it, and whether it acts as your Data Processor or decides its own purposes.

Putting a tracker behind a banner is not the end of the exercise. You also need a lawful basis, and you remain responsible for what the vendor does, as the next sections explain.

Withdrawal: what must happen after "Reject"?

Section 6(4) gives every Data Principal the right to withdraw consent at any time, with ease comparable to giving it. (Withdrawal comes from section 6(4), not section 13, which deals with grievance redress.) Under section 6(6), the Data Fiduciary must then stop processing within a reasonable time and make its Data Processors stop, unless law requires or authorises the processing.

Three related points:

• Past processing stays lawful (section 6(5)).
• Erasure follows under section 8(7)(a), unless retention is necessary under law.
• Third-party tags must obey. If your banner records a refusal but a tag manager still fires an advertising pixel, you have a gap.

The Act prescribes no interface. Practical options include a persistent footer link, a preference centre with purpose-level toggles, and a system that passes withdrawal to every vendor. Rule 14(3) also requires you to publish a grievance process that responds within a reasonable period not exceeding ninety days.

Vendors: processors, contracts and breach reporting

Under section 8(1), you are responsible for compliance for processing done on your behalf by a Data Processor, irrespective of any agreement to the contrary. Under section 8(2), you may engage a processor for offering goods or services only under a valid contract. Section 8(5) requires reasonable security safeguards, including for processing done by processors.

The Act does not say "written Data Processing Agreement", and it does not list contract terms. But a contract with each cookie vendor is the sensible way to meet section 8, and click-through standard terms may not reflect your DPDP obligations. As a matter of good practice, specify the data categories, purposes and duration, security standards, deletion on your instruction, sub-processing limits and prompt breach notice to you. A short fixed deadline such as 24 hours is a practical choice, not a statutory one.

Breach reporting. Section 8(6) requires intimation of a personal data breach to the Board and each affected Data Principal, in the manner prescribed. Rule 7 sets that out:

• Affected Data Principals must be told without delay.
• The Board must receive a description without delay, and updated and detailed information within 72 hours of becoming aware, or a longer period the Board allows on written request.

The 72 hours therefore applies to the detailed report to the Board, not to every notification. A vendor that is slow to alert you eats into your own clock, which is the practical reason to agree breach notice terms.

Consent records and proof

Section 6(10) puts the burden on you: where consent is the basis for processing and its validity is questioned, the Data Fiduciary must prove that notice was given and consent obtained in accordance with the Act and Rules. A banner that appeared but left no record proves little.

A defensible record usually captures when the person chose, which notice version and language they saw, which purposes they accepted or refused, any later withdrawal, and an identifier linking the record to the event.

On retention, be precise. The Act sets no period for ordinary website consent logs. The Rules require registered Consent Managers to keep consent records for at least seven years, but that does not apply to every website. Rule 8(3) separately requires retaining personal data, associated traffic data and processing logs for at least one year, for Seventh Schedule purposes. Whether it reaches your consent logs is an open interpretive question, so one year is a sensible baseline.

Consent Managers: do you need one?

A Consent Manager is a person registered with the Board who acts as a single point of contact so people can give, manage, review and withdraw consent through an interoperable platform (sections 2(g) and 6(7)–(9)). Rule 4 sets registration conditions, including a minimum net worth of ₹2 crore. Using one is not mandatory for websites. A cookie-banner platform is not a Consent Manager unless it has registered with the Board, and no tool replaces your legal assessment.

Children and cookies

A child under section 2(f) is anyone below 18. Section 9 requires verifiable parental consent before processing a child's personal data, with mechanics in Rule 10. Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, subject to prescribed exemptions. A banner cannot cure that problem, so if your site is likely to attract minors, assess advertising and analytics tags separately.

Penalties

Section 33 and its Schedule set these maximum penalties, imposed by the Board:

Breach	Maximum
Failure to take reasonable security safeguards	₹250 crore
Failure to notify a breach; breach of children's obligations	₹200 crore each
Additional duties of Significant Data Fiduciaries	₹150 crore
Any other provision	₹50 crore

These are ceilings. A consent or notice defect most likely sits in the ₹50 crore tier, though a children's tracking breach could reach ₹200 crore. That classification is my reading, not an official one. Section 33 commences on May 2027.

The Supreme Court challenge

The Act is being challenged in Venkatesh Nayak v. Union of India, W.P.(C) 177/2026, with connected petitions. On 16 February 2026 the Court issued notice but refused to stay the Act, and on 7 August 2026 the Centre was given two weeks to reply. The challenges focus mainly on the Right to Information amendment in section 44(3), the State's powers under sections 17 and 36, the term "significant" in section 33(1), and the independence of the Board. One report says a petition also targets sections 5 and 6. The consent provisions have not been suspended, so prepare as if they will apply.

Should you copy a GDPR cookie banner?

Not automatically. EU law has a specific framework for access to information stored on a user's device, with an exception for strictly necessary technologies. The DPDP Act has no equivalent. California's law differs again, focusing on sale, sharing and opt-out signals. GDPR compliance does not equal DPDP compliance, so a business serving several regions needs consent settings that vary by location and purpose.

A practical DPDP cookie consent checklist

The items below mix legal requirements and good practice. Items marked * are practice, not statutory mandates.

1. Audit every technology. List all cookies, pixels, SDKs and tags, and the data each collects.
2. Test for personal data. Ask whether it can be linked to an individual.
3. Choose the legal basis. Consent under section 6 or a section 7 use.
4. Write a compliant notice. Itemised data, purposes, withdrawal, rights and complaint routes; English or Eighth Schedule languages; contact details.
5. Design for clear affirmative action. No browse-to-accept; no pre-ticked optional tracking; purpose-level choices.
6. Give refusal equal ease. Equal prominence for accept and refuse is good design.*
7. Build withdrawal into the system and pass it to every vendor.
8. Contract with every vendor, with breach-notice terms.*
9. Keep versioned records of notice and consent.
10. Assess children's risk and check for minors on the site.
11. Prepare grievance and rights handling within the Rule 14(3) limit.
12. Review periodically. Rescan trackers and refresh notices when practices change. A fixed 12-month re-consent cycle is not required by the Act or Rules.*

The bottom line

The DPDP Act has no dedicated cookie rule, but that does not put cookies outside it. Where a cookie involves personal data, section 6 and the notice duties in section 5 and Rule 3 apply, and from May 2027 you must be able to prove compliance under section 6(10).

The sharper question is not "Do I have a cookie banner?" but: can you show what your site collects, why, on what legal basis, what users were told, how they chose or withdrew, and what happened to their data afterwards?

A consent management platform such as GrantCookie helps with the practical side, with a clear banner, a scan of the trackers on your site and a record of every consent. The legal assessment behind it remains yours.