Cookie consent in India: does the DPDP Act require a cookie banner?
Updated 20 October 2026 · 5 min read
India has no separate cookie law. But the DPDP Act covers digital personal data, and most analytics and advertising tools on a website process exactly that: device identifiers, IP addresses and browsing behaviour linked to a visitor.
Why trackers need consent
The Act allows processing either with consent or for a limited list of legitimate uses. Showing a visitor the product they clicked on is part of the service they asked for. Measuring them with Google Analytics, or following them with the Meta Pixel to show ads later, is not, so it generally needs consent.
What valid consent looks like
- A clear action: the visitor clicks to agree. Scrolling or simply staying on the page is not a clear action, and boxes should not come pre-ticked.
- Before the tracking starts: tags wait until the visitor chooses.
- Specific: separate choices for purposes such as analytics and marketing.
- Informed: a link to your privacy notice.
- As easy to withdraw as to give: a Privacy settings link on every page.
- Recorded: you should be able to show what each visitor agreed to and when.
What a DPDP consent banner does
- Loads first, before any analytics or ad tag.
- Offers Accept all, Reject non-essential and Choose, with equal weight.
- Holds back Google Analytics, Google Tag Manager, Google Ads, Meta Pixel, Hotjar, Microsoft Clarity and similar tags until the matching category is allowed.
- Sends Google Consent Mode v2 signals so Google tags respect the choice.
- Stores a record of the choice and the notice version shown.
Can a GDPR cookie plugin work?
Many GDPR banners already hold back trackers, which is the hardest part. Check that it links to a DPDP notice, names the Board and your grievance contact rather than an EU authority, and keeps a record you can export. See the DPDP and GDPR differences.
Set one up
nodd's banner is one script tag, or the free nodd Consent plugin on WordPress. It holds back trackers, sends Consent Mode signals and records every choice in a tamper-evident log. The setup guide takes about 15 minutes.
Questions
Does the DPDP Act mention cookies?
No. The Act does not use the word cookie. It covers any processing of digital personal data, and analytics and advertising tags usually process identifiers linked to a person, so their use generally needs a lawful basis such as consent.
Is an Accept-only cookie banner enough in India?
An Accept-only banner, or one that runs trackers before anyone clicks, is hard to square with the Act. Consent must be given by a clear action, and withdrawing it must be as easy as giving it, so offering a reject option of equal weight is the safer design.
Do I need consent for cart and login cookies?
Cookies that a site needs to deliver what the visitor asked for, such as a cart or a login session, are generally treated as part of providing that service rather than needing separate consent. Analytics, advertising and retargeting are the ones to hold back.