What are the cookie consent requirements under the DPDP Act? The DPDP Act 2023 requires that consent for processing personal data — including data collected via cookies — must be free, specific, informed, unconditional, and unambiguous. Cookie banners that use pre-ticked boxes, bundled consent, or that make website access conditional on accepting all cookies do not meet the DPDP standard. Organisations must provide granular consent options, make withdrawal as easy as giving consent, and maintain records of consent obtained.
Generate a DPDP-compliant consent banner in 60 seconds. Free.
Paste this snippet just before the </body> tag on every page of your website.
Want expert validation of your consent setup?
Our DPDP Consent Audit covers your full data collection flow — cookies, forms, SDKs, and consent records.
The Digital Personal Data Protection Act 2023 defines "personal data" broadly — any data that can identify an individual, directly or indirectly. Browser cookies that store user IDs, session tokens, device fingerprints, or behavioural data squarely fall within this definition. If your website deploys analytics or advertising scripts that place such cookies, you are processing personal data under Indian law.
Unlike the European Union's ePrivacy Directive — which mandates explicit cookie consent as a separate legal requirement distinct from the GDPR — India's DPDP Act does not have a standalone cookie consent law. However, Rule 3 of the draft DPDP Rules 2025 requires that organisations obtain consent through a clear "consent notice" in plain, accessible language before personal data processing begins. If your analytics or marketing cookies process personal data, a consent mechanism is legally necessary.
The critical distinction from GDPR: under the DPDP Act, there is no "legitimate interests" basis for processing. India's framework is binary — you either have valid, informed consent from the Data Principal, or you do not have a lawful basis to process their personal data. There are limited exemptions (national security, state functions, research), but standard commercial cookies do not qualify.
For organisations already compliant with GDPR, building DPDP consent flows is incremental — the core principles (granularity, plain language, easy withdrawal) align. For others, this is a new operational requirement that must be implemented before the Act's enforcement provisions come into full effect.
A legally sound DPDP consent banner must satisfy several requirements derived from the Act and the draft Rules:
Our generated banner code includes localStorage-based consent recording. For production environments with large user bases, we recommend a server-side consent management database. The NitiBharat Consent Audit reviews your full consent architecture including record-keeping adequacy.
This is one of the most frequently asked questions from Indian organisations implementing consent flows for the first time. The DPDP Act's position is clear: consent must be freely given, specific, informed, and unambiguous. The Act defines consent as a positive act — Section 6 states that consent shall be signified "through a clear affirmative action." This means a pre-ticked box, a banner that says "By continuing to use this site you agree," or any mechanism that treats inaction as consent is non-compliant.
In practical terms, opt-in is required for all non-essential cookie processing under the DPDP Act. If a user does not actively click "Accept" or "Accept Analytics," you may not set analytics or marketing cookies. This aligns with the EU approach under the ePrivacy Directive and GDPR, and is a higher standard than some US state laws (such as CCPA, which generally uses an opt-out model).
Strictly necessary cookies — those required for the website to function (session management, security, shopping cart state) — do not require consent. These can be set before the user makes a choice. All other cookie categories require an affirmative opt-in signal.
For organisations already using a "by continuing to browse" implied consent model: this must be replaced before the DPDP Act's enforcement provisions take effect. Our Consent Audit can assess your current implementation and recommend the minimum viable changes to achieve compliance.
The DPDP Act introduces a concept called the Consent Notice — a document (or on-screen display) that the Data Fiduciary must provide to the Data Principal before obtaining consent. Under Section 5 and the draft DPDP Rules 2025, the Consent Notice must:
A minimal banner that says only "We use cookies. Accept?" does not satisfy the Consent Notice requirement. The notice must provide enough information for the user to make an informed decision. This tool's generated code includes placeholders for all required disclosures — you will need to fill in your specific third-party tool names (e.g., "Google Analytics 4," "Meta Pixel," "Hotjar") for full compliance.
Do I need cookie consent if my website is only B2B?
The DPDP Act applies to any processing of personal data of natural persons (individuals) in India. If your B2B website is visited by individuals — even in a professional capacity — and you set cookies that identify those individuals, the Act applies. Most B2B websites with analytics or marketing pixels should implement consent.
Does the generated code store consent server-side?
The generated code uses localStorage for consent storage — a client-side mechanism. This is sufficient for basic compliance. For enterprise deployments with large user bases, or where you need to demonstrate consent records to the Data Protection Board, server-side consent logging (tied to a user account or a consent ID) is recommended. Our Consent Audit covers consent record-keeping adequacy.
What happens if I don't implement cookie consent?
Non-compliance with the DPDP Act's consent requirements can result in penalties of up to ₹250 crore per violation under Schedule 1 of the Act. While enforcement is expected to ramp up gradually, organisations that are visibly non-compliant (e.g., running Google Analytics without consent) will be easier targets for the Data Protection Board once it is operational.
When does the DPDP Act enforcement start?
The Digital Personal Data Protection Act 2023 received Presidential assent in August 2023. The DPDP Rules 2025 were released in draft form for public consultation. Full enforcement is expected once the Data Protection Board is constituted and the Rules are finalised — currently expected in 2026, with compliance expectations set for 2027. Organisations that begin implementation now will be well-positioned ahead of enforcement.
Can I use the same consent banner for all Indian languages?
The DPDP Act encourages consent notices in languages the Data Principal can understand. For pan-India consumer-facing products, this is operationally significant — a single English-language banner may not be sufficient for regional-language users. Our generated code uses English as the default; for multilingual deployments, the generated structure can be adapted to detect browser language and serve localised strings.
What is a "Consent Manager" under the DPDP Act?
Section 6(5) of the DPDP Act introduces the concept of a Consent Manager — a third-party registered entity that can manage consent on behalf of Data Principals across multiple platforms. This is a novel concept in Indian data law, with no direct GDPR equivalent. Consent Managers must be registered with the Data Protection Board and must provide a single, unified dashboard where individuals can grant, review, and withdraw consent across multiple Data Fiduciaries. For most mid-market organisations, directly obtained consent (via a banner like the one generated here) will remain the primary mechanism. Consent Manager integration will become relevant once the ecosystem matures.
The generated code is a raw HTML/CSS/JS snippet compatible with any web platform. Implementation differs slightly by platform:
</body> tag.After implementation, verify that non-essential cookies are not set before user consent by using your browser's Developer Tools → Application → Cookies tab. Load the page with a cleared cache and confirm that only session/strictly-necessary cookies are present before the user makes a consent choice.
Deploying a consent banner is the first step — not the last. A complete DPDP cookie compliance programme includes:
The NitiBharat Consent Audit (₹799) covers all of the above in a single engagement — you receive a gap report, a cookie inventory, and implementation recommendations tailored to your tech stack.
NitiBharat offers a full suite of free tools to help Indian organisations understand and implement DPDP compliance:
All tools are free to use and require no registration. For organisations that need hands-on implementation support, NitiBharat offers fixed-price DPDP compliance engagements starting at ₹75,000 — book a free consultation to discuss your requirements.
NitiBharat is an AI-native DPDP compliance company specialising in the Indian mid-market. Our approach combines legal expertise with technical implementation capability — we don't just tell you what to do, we help you build and deploy the systems that make DPDP compliance operational and maintainable. All our tools are built on the DPDP Act 2023 text and the draft DPDP Rules 2025, updated as the regulatory landscape evolves. If you have a specific question about cookie consent or any other aspect of DPDP compliance, reach out to our team — we respond to all enquiries within one business day.
The Data Protection Board of India (DPBI) is the regulatory body established under the DPDP Act to adjudicate complaints, investigate breaches, and impose penalties. It is distinct from existing regulators like SEBI, RBI, or TRAI — though the DPDP Act allows those sectoral regulators to enforce DPDP-equivalent standards within their domains where they have prior agreements.
For cookie consent specifically, the Board can receive complaints from Data Principals who believe their consent was obtained without proper notice, or where consent withdrawal was made difficult. Once the Board is constituted and operational, enforcement actions will likely begin with high-profile consumer-facing organisations and digital platforms — creating reputational and financial risk even for organisations that believe they are low-profile.
Proactive compliance — implementing a proper consent banner, maintaining consent records, and auditing your third-party cookie ecosystem — is significantly cheaper than responding to a Board investigation or paying a financial penalty. The ₹799 Consent Audit from NitiBharat provides exactly this: a structured review that identifies gaps before they become enforcement issues.
If you have used this generator and have questions about how to implement the output, or whether additional steps are required for your organisation's specific tech stack or industry vertical (healthcare, fintech, HR-tech each have additional considerations), our team is available for a free 30-minute consultation. No obligation, no hard sell — just practical guidance from practitioners who work exclusively on DPDP compliance for Indian organisations.
Last updated: June 2026. Tool built on DPDP Act 2023 and draft DPDP Rules 2025. We review and update this tool as regulatory guidance evolves.
© 2026 NitiBharat. Free for use by Indian organisations implementing DPDP compliance. Attribution appreciated but not required.
This tool provides general guidance. It does not constitute legal advice. Consult a qualified DPDP practitioner for your specific implementation.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.