Most Indian e-commerce and D2C sites run Meta Pixel, Google Ads remarketing tags and analytics scripts that collect personal data before a shopper takes any action — this requires specific, informed, unconditional consent under Section 6 of the DPDP Act 2023, not just a passive cookie banner. Essential cookies (cart, checkout, login) do not need consent, but marketing and analytics cookies do. This checker flags which of your tracking tools carry the highest consent risk.
Running Meta Pixel, Google remarketing or analytics on your online store? Check your cookie and tracking consent risk in 60 seconds.
Most Indian D2C and e-commerce brands installed a cookie banner years ago to look compliant with global norms, but under the DPDP Act 2023 a banner is only the first step. Section 6 requires consent to be free, specific, informed, unconditional and withdrawable — a banner that shows a notice but lets tracking scripts fire regardless of the choice does not meet that bar. Tools like Meta Pixel, Google Ads remarketing tags, and session-recording heatmaps all collect personal data (device identifiers, browsing behaviour, sometimes email or phone via hashed matching) before the shopper has made any real choice.
The commercial risk compounds around big sale periods: a store running heavy remarketing during a festive sale is processing personal data for lakhs of visitors simultaneously without a valid consent basis. With enforcement fully active by May 2027, Data Protection Board scrutiny of consumer-facing digital businesses — where complaint volume is naturally higher — is expected to be a priority area.
The fix is not to remove tracking, it is to sequence it correctly: essential scripts load immediately, marketing and analytics scripts load only after explicit consent, and every consent event is logged with a timestamp and purpose. Most Indian e-commerce brands can do this with a consent management layer plus a rewritten cookie and privacy policy — typically a 2–3 week project. Niti Bharat's Ecommerce DPDP Pack builds this end-to-end: consent-gated tag sequencing guidance, a DPDP-compliant cookie and privacy policy, and a retargeting consent framework, so festive-season campaigns keep running without exposure.
A one-page PDF showing exactly how to sequence Meta Pixel, Google Ads and analytics scripts behind consent, plus a sample cookie categorisation table.
One real DPDP development explained in plain English, one practical how-to, one number from our own assessment data. Nothing else — no daily noise, no sales pitch.
No spam. Unsubscribe with one click, anytime.
