Are Cookies Covered Under India's DPDP Act? What Website Owners Need to Know

A visitor lands on an Indian e-commerce site to browse winter jackets. By the time they leave, without filling a single form or creating an account, the website already knows which pages they lingered on, which product they almost bought, and which advertising network to hand that information to for a retargeted ad the next day. No name was typed. No email was entered. Yet in the eyes of India's new data protection regime, that visitor may already be an identifiable individual whose personal data has been processed.

This is the question website owners across India are asking with growing urgency: does the Digital Personal Data Protection Act, 2023 ("DPDP Act") actually apply to cookies? Search the text of the Act, and the word "cookie" never appears. That silence can feel like a loophole. It isn't one — and understanding why is the first step toward a website that can withstand regulatory scrutiny.

A Law Written to Outlive Its Technology

Lawmakers had a choice: name specific technologies, or regulate the activity those technologies perform. They chose the latter — cookies will not be the last tracking mechanism to exist, and a law anchored to one technology risks becoming obsolete fast.

So instead of asking "does this involve a cookie," the DPDP Act asks: does this activity involve processing personal data belonging to a data principal? Section 2(t) defines personal data broadly as data about an individual who is identifiable by or in relation to such data — a cookie doesn't need a name, email, or phone number to qualify. A unique identifier, session token, or device fingerprint is enough if it can be tied back to a person.

The Digital Personal Data Protection Rules, 2025, notified by MeitY on 14 November 2025, build on this same foundation. Rather than listing cookies, they set the standard: clear, standalone notices explaining what's collected and why, paired with a genuine, revocable mechanism for consent.

The Test That Actually Matters: What Does the Cookie Do?

Picture two cookies on the same website. The first remembers that a visitor selected Hindi as their preferred language. The second assigns that visitor a persistent identifier, tracks every product page they view over three weeks, and shares that behavioural profile with an ad-tech partner.

Both are technically "cookies." Under the DPDP Act, they are not treated the same way. The first is unlikely to make anyone identifiable in a meaningful sense. The second builds a persistent, identifiable profile — precisely what the DPDP Act is designed to govern.

This is also why classification can't happen by category label. A cookie named analytics_pref could be harmless, while one named session_helper could be quietly feeding a third-party advertiser. The name on the cookie is marketing; the behaviour behind it is what the law cares about.

This is also where many businesses discover an uncomfortable truth: nobody has an accurate list of what the website actually does. A plugin bundles a tracking script, a chatbot widget adds its own third-party cookies, and six months later the site runs dozens of cookies that were never individually reviewed.

Not sure what's running on your site? Get a free cookie & tracker audit

Not Every Cookie Should Be Treated the Same Way

As a starting point, cookies generally fall into four buckets — each carrying a different level of compliance risk:

• Strictly necessary — authentication, carts, security. Lower burden if genuinely necessary, but still worth documenting.
• Analytics — page views, session data, device info. "Analytics" doesn't automatically mean "anonymous."
• Advertising and tracking — behavioural profiling, cross-site tracking. Carries the highest risk and the strictest consent requirement.
• Personalisation — language, remembered preferences. Assess by what's processed, not by the label.

The correct compliance question is always what data is being processed and for what purpose — never simply what the cookie is called.

Is a Cookie Banner Legally Mandatory in India?

Not in the way the EU requires it — but that doesn't mean consent isn't required. India has no standalone cookie law comparable to the EU's ePrivacy framework, and the DPDP Act doesn't prescribe a specific banner design. However, where cookies process personal data, the Act's requirements on notice, consent, purpose limitation, and Data Principal rights apply regardless of the mechanism used to collect it.

So "cookies aren't mentioned in the Act, so no consent is needed" is an unsafe reading. Equally, "every cookie legally requires a banner" oversimplifies the position. The right approach: examine the processing activity, determine whether personal data is involved, and implement controls accordingly — a process we walk through in detail in the next post in this series, which covers how to design a consent mechanism that actually meets the DPDP Act's bar.

Why This Isn't a One-Time Task

Because cookies are tied to a website's technical stack, this isn't a policy you write once and file away — every plugin or vendor added after launch can quietly introduce new personal data processing.

The compliance timeline gives some breathing room: substantive obligations around notice and consent carry an 18-month transition period, pushing the deadline toward 13 May 2027. That runway rewards businesses that start early — not those who treat this as tomorrow's problem.

In upcoming posts in this series, we'll cover how to run a full cookie and third-party tracker audit, and how to design a DPDP-compliant consent banner step by step.

Important Questions 

• Does the DPDP Act specifically regulate cookies?
• No. The Act doesn't mention cookies by name — it regulates the processing of personal data regardless of the technology used, so cookies fall within scope whenever they process information tied to an identifiable individual.
   
• Are cookie consent banners legally required in India? 
• There's no standalone banner mandate like the EU's. But where cookies process personal data, DPDP Act obligations on notice and consent still apply in practice.
   
• Do analytics cookies need consent under the DPDP Act? 
• It depends on whether the data collected can identify an individual, alone or combined with other data — analytics cookies aren't automatically exempt.
   
• When do DPDP Act obligations for cookies take effect? 
• The DPDP Rules were notified on 14 November 2025. Substantive obligations, including notice and consent, are expected to apply from 13 May 2027 after an 18-month transition.
   

The Strategic Point worth remembering

Cookies look like a small technical detail, but they can reveal a much larger data-governance problem. If an organisation can't confidently answer which trackers operate on its website and where that data goes, it has a visibility problem — not merely a cookie-banner problem. The cookie itself is not the real issue. The data trail behind it is.