How the DPDP Act applies to cookies
The Act covers digital personal data, meaning any data about an individual who can be identified by or in relation to that data. Many cookies and trackers fall into this category, because they link browsing activity to a device, a login or an advertising profile.
To process this data, you need either valid consent or one of the legitimate uses the Act allows. Cookies that are strictly needed to deliver the page or service the visitor asked for are easier to justify. Analytics, advertising and personalisation cookies usually need consent.
Does every website need a cookie banner?
There is no universal cookie banner requirement in the DPDP Act. The real questions are whether a specific activity processes digital personal data within the Act's scope, which lawful ground applies, and whether notice and consent obligations arise. Avoid assuming that every cookie needs consent, or that every so-called essential cookie is automatically excluded. A banner on its own is not the same as compliance.
Map each tracker to a purpose and legal basis
Assess each use separately. The vendor's label for a cookie does not decide its legal basis.
| Technology use | Typical example | Question to investigate |
|---|---|---|
| Session operation | Login session | What basis supports the necessary processing? |
| Analytics | Usage measurements | Is personal data involved, and is consent needed? |
| Marketing | Remarketing pixel | Is the required choice collected before use? |
| Personalisation | Recommendations | What purpose is disclosed and authorised? |
| Third-party integration | Embedded widget | Who processes or receives the data? |
The cookie consent checklist
- Scan your website and list every cookie, pixel, tag and script, including those added by marketing and third-party tools, tag managers, embedded videos and chat widgets.
- For each one, document what it collects, why it is deployed, where the information goes and which third party receives it.
- Group them by purpose, such as essential, analytics, functional and advertising, and note which third parties receive the data.
- Block non-essential cookies until the visitor consents. Loading them first and asking later does not give you valid consent.
- Show a clear banner with options to accept, reject or choose by purpose. Rejecting should be as easy as accepting, and the design should not push visitors toward acceptance.
- Do not use pre-ticked boxes or treat scrolling, continued browsing or ignoring the banner as consent. The Act requires a clear affirmative action.
- Test that the banner is actually enforced: first visits, rejected choices, accepted choices, repeat visits and changed preferences.
- Link to a plain-language notice that explains what data is collected, for which purposes and how to withdraw consent or raise a grievance. Review it whenever tracking tools or purposes change.
- Offer the notice in English and in the languages your visitors use.
- Store a record of each visitor's choices with a timestamp, the channel and the version of the notice they saw. Protect these records and do not keep more than you need.
- Let visitors reopen their preferences at any time from a link in the footer.
- Make sure withdrawal reaches your applications and processors. Deleting a browser cookie may not address data already sent to external systems.
- Review advertising, analytics and other vendors: who can access the data, what the contracts say, and how they honour withdrawal.
- Test on desktop, mobile and tablet, across browsers and languages, and check accessibility. Choices should carry across your domains and apps without being applied to the wrong person.
- Rescan regularly, because new tools and tags are added to websites all the time. Assign an owner for approving new trackers and documenting changes.
Common mistakes
- A banner that only has an "Accept" button.
- Google Analytics or advertising pixels firing before the visitor makes a choice.
- A banner that says a visitor declined marketing tracking while the tag has already sent identifiers.
- A cookie policy copied from a GDPR template that does not reflect the DPDP Act.
- No record of consent, so you cannot prove what a visitor agreed to.
- Consent captured on the website but not respected by marketing and CRM tools.
Cookie consent is one part of DPDP compliance
Website cookies are the most visible part of consent, but the same customer may also share data through your app, a contact form, a branch or a call centre. Managing cookie consent in a separate tool from everything else makes it hard to answer a simple question from a customer or the Data Protection Board: what did this person consent to, and when?
How ConvergeDPDP handles cookie consent
ConvergeDPDP includes a cookie consent manager and preference centre that store each choice in the same consent hub as consents from your apps and offline channels. It offers cookie scanning and classification, configurable banners and controls for non-essential scripts. Withdrawals are processed in real time, every change is written to a tamper-evident audit trail, and data is hosted in India.
Validate how it behaves in your own environment and configure it according to your legal analysis.
Conclusion
Website DPDP readiness is about real processing controls, not just a banner. Understand your tracking technologies, decide the right legal grounds, disclose practices clearly, enforce choices and keep systems aligned as they change. With operational obligations starting on 13 May 2027, auditing and testing now is particularly valuable.