DPDP Act and Cookies: Does Your Website Need Cookie Consent?

Search the Digital Personal Data Protection Act, 2023 for the word "cookie" and you'll find nothing. Not a single mention. This has led a surprising number of Indian businesses to a comfortable conclusion: if the law doesn't name cookies, cookies must be outside it.

That conclusion is wrong, and understanding why requires looking at how the Act actually defines its scope — not at what vocabulary it happens to use.

The Act Doesn't Regulate Cookies. It Regulates Personal Data.

This is the distinction that resolves the entire question. The GDPR and the ePrivacy Directive address cookies and similar tracking technologies explicitly. India's DPDP Act takes a different drafting approach — it is technology-neutral. Rather than listing the mechanisms by which data might be collected, it defines what it protects and lets that definition do the work.

Section 2(t) of the Act defines personal data as any data about an individual who is identifiable by or in relation to that data. That phrase — "in relation to" — is doing something significant. It means data doesn't have to name you to be personal data. It only has to be capable of connecting back to you.

Now consider what a typical cookie actually stores: a persistent unique identifier, often paired with an IP address, device fingerprint, browsing history across sessions, or behavioural profile. Legal commentary on the Act is broadly consistent on the implications here — where cookies capture identifiers, device data, or user activity of this kind, the Act's provisions necessarily come into play, regardless of the fact that cookies aren't named. The mechanism is silent in the statute. The data it collects is not.

So the honest framing of the question isn't "does DPDP cover cookies?" It's "do your cookies process personal data?" For any site running analytics, retargeting pixels, A/B testing tools, chat widgets, or personalisation scripts, the answer is almost certainly yes.

What This Means in Practice

Once a cookie falls within scope, the Act's consent standard applies to it in full. Under DPDP, consent must be free, specific, informed, unconditional, and unambiguous — and each of those words carries operational weight for how a cookie banner has to behave.

• Specific rules out bundling. Consent must be tied to defined purposes, which means you cannot obtain one blanket permission covering analytics, advertising, and personalisation together. Legal analysis of the Act read alongside the DPDP Rules points to separate consent being required for each individual purpose of cookie usage, with all those purposes disclosed in the notice given to the Data Principal.
• Informed rules out vagueness. A banner reading "we use cookies to improve your experience" doesn't tell a visitor what data is collected, for what purpose, or who receives it — which is the minimum the Act contemplates.
• Unambiguous rules out inference. Continued browsing is not consent. Pre-ticked boxes are not consent. A clear affirmative action is required. This isn't a novel Indian position — in the Planet49 case, the Court of Justice of the European Union reached the same conclusion on pre-ticked boxes years ago, and European regulators have enforced against the practice repeatedly since.
• Unconditional is the requirement most businesses overlook entirely. Access to a service cannot be made contingent on consenting to non-essential data processing. Practically, that means you cannot wall off the public areas of your website behind a cookie wall that only lifts once a visitor accepts tracking.

And then there's withdrawal. The Act requires that revoking consent be as easy as granting it — which implies a persistent preference centre a visitor can reach at any time, not a one-time banner that disappears after first click and never returns.

Official Guidance Has Started Naming Cookies Directly

While the statute itself stays silent, government-issued guidance has become noticeably more explicit. In June 2025, the Ministry of Electronics and Information Technology released the Business Requirements Document for Consent Management Systems. It isn't legally binding, but it is operationally instructive: it recommends banners offering Accept, Reject, and Customise options, the ability for users to modify or withdraw consent at any point, multi-language support, and automatic expiry of stored cookie preferences.

Read alongside the Act, that guidance closes much of the interpretive gap. The direction of travel is not ambiguous.

Where Indian Websites Currently Stand

The most recent and comprehensive picture comes from ComplyZero Research's "State of Cookie Compliance in India, 2026," published in March 2026 from a scan conducted that February. The study analysed more than 6,000 websites across 24 industry sectors and catalogued over 84,000 individual tracking cookies — making it the largest study of its kind on Indian cookie compliance to date.

The findings are stark. Only 249 of the 6,000+ websites scanned — roughly 4.1% — displayed any form of consent mechanism at all, meaning 95.9% of Indian websites were collecting data through tracking technologies with no consent request whatsoever. Government websites performed low of any sector: of 1,154 government sites scanned, only 2 showed a consent banner. Even among the small minority of sites that did have a banner, the study found that close to 80% still dropped non-essential cookies before the visitor made any choice — the same "banner without blocking" failure that regulators elsewhere have already fined companies over.

The composition of what's being tracked adds another layer. Across the full dataset, only 17.8% of cookies served an essential or functional purpose — the rest were marketing, analytics, or entirely unclassified. Media websites were the most aggressive trackers, averaging 30 tracking technologies per page, followed by e-commerce sites at an average of 24 cookies per visit.

Compare that to where GDPR enforcement now stands: a year-long UK ICO review of the country's 1,000 most-visited websites found that more than 95% now meet its cookie compliance standards. India's largest study to date found the near-exact inverse. That gap is the clearest signal available of how much ground Indian businesses have left to cover before the May 2027 deadline — and, for businesses that move early, how significant a differentiator basic compliance still is.

The Timeline Is No Longer Theoretical

Until late 2025, businesses could reasonably describe DPDP compliance as a planning exercise. That changed when MeitY notified the DPDP Rules in November 2025, activating an 18-month phased rollout. The Data Protection Board of India is being constituted as part of this rollout, meaning the enforcement mechanism itself is now taking shape rather than remaining theoretical. Consent Manager registration opens in November 2026, and full substantive compliance falls due on 13 May 2027 — with penalties reaching up to ₹250 crore per violation and no grace period expected, since the transition window itself was the accommodation.

For cookie consent specifically, that runway is tighter than it appears. Compliant consent isn't a banner you install in an afternoon. It requires auditing what cookies your site actually runs, classifying them by purpose, blocking non-essential scripts until permission is granted, logging every consent action in a form you could produce if asked, and keeping all of it current as your site changes.

Final Conclusion

The DPDP Act's silence on cookies isn't an exemption — it's a drafting choice. The Act regulates personal data wherever it's processed and by whatever means, and cookies that store identifiers or track behaviour process exactly that. If your website uses them, cookie consent is not optional under DPDP. It's simply one of the more visible places where your compliance will be tested.