DPDP for WordPress and WooCommerce stores: a practical setup
Updated 20 October 2026 · 5 min read
WordPress and WooCommerce run a large share of Indian online stores. Here is what the DPDP Act means for a typical store, and a setup you can finish in an afternoon.
What a WooCommerce store collects
- Checkout: name, phone, email, billing and shipping address, order history.
- Accounts: login details and saved addresses.
- Forms and newsletters: contact form entries and subscriber emails.
- Plugins and tags: Google Analytics or Site Kit, Meta Pixel, Hotjar, Clarity, chat widgets, abandoned-cart tools.
Order data used to deliver the order is generally a legitimate use. The tags and the marketing are where consent comes in.
Step 1: a DPDP privacy notice
List what you collect and why, item by item, with how to withdraw consent, use rights and complain to the Board. The free notice generator builds one around Rule 3. See what the notice must contain.
Step 2: a consent banner that holds back trackers
- In WordPress, go to Plugins, Add New, search for nodd Consent, then install and activate it. Or get it from wordpress.org/plugins/nodd-consent.
- Open Settings, nodd, paste your site key from the nodd console and save.
- The plugin holds back Google Analytics, Tag Manager, Google Ads, Meta Pixel, LinkedIn, TikTok, Hotjar and Clarity scripts added through WordPress until visitors agree, and sends Google Consent Mode v2 signals.
- It points your site's privacy policy link, including the checkout privacy text, to your hosted Privacy Center.
- Add
[nodd_privacy_settings]to your footer so people can change their choice.
Step 3: checkout and marketing opt-ins
- Keep any "send me offers" checkbox unticked by default, and separate from agreeing to the order.
- Do not make marketing consent a condition of buying.
Step 4: records and requests
- nodd records every banner choice in a tamper-evident log you can export as CSV.
- Publish a contact for questions and requests, and reply within the time you promise.
Check it works
Open your store in a private window: the banner should appear, and your browser's network tab should show no Google Analytics or Meta requests until you accept. The full walkthrough is in the setup guide, and the wider to-do list is the DPDP checklist.
Questions
Is there a DPDP plugin for WordPress?
Yes. The free nodd Consent plugin in the WordPress plugin directory adds a consent banner, holds back common trackers until visitors agree, sends Google Consent Mode v2 signals and points your privacy policy link to a hosted DPDP notice.
Does WooCommerce need consent for order data?
Using a customer's name, address and phone to process and deliver their order is generally a legitimate use under section 7 of the DPDP Act, because they gave it for that purpose. Marketing emails, analytics and ad tracking are separate and generally need consent.
Will a consent banner slow down my WooCommerce store?
A well-built banner is a single small script. nodd's loads first so it can hold back trackers, and the trackers it holds back often make the first page load faster for visitors who decline.