DPDP Act 2023: Why Every Indian Startup and Website Needs to Take Cookie Consent Seriously

Introduction: Your website might be collecting more data than you think

Imagine someone visits your website to read a blog, explore your product or sign up for a free trial.

They haven't created an account. They haven't filled out a form. They haven't even clicked anything.

But behind the scenes, your website might already be collecting information through cookies, analytics tools, advertising pixels, tracking scripts and third-party integrations.

Google Analytics might be recording their browsing activity. Meta Pixel might be tracking their interactions. A session-replay tool might be observing how they navigate your website.

Have you ever stopped to ask whether your visitors know what is happening to their data?

More importantly, have you given them a meaningful choice?

This is where India's Digital Personal Data Protection Act, 2023 (DPDP Act) becomes important.

India is moving towards a more transparent digital ecosystem where businesses must take responsibility for how they collect, use, process and protect people's personal data.

For startups, SaaS companies, e-commerce businesses, digital agencies and website owners, this is something worth preparing for now.

And one of the practical places to start is your website's cookie consent mechanism.

1. What exactly is India's DPDP Act?

The Digital Personal Data Protection Act, 2023 is an Indian law introduced to protect individuals' digital personal data.

It was enacted on 11 August 2023.

In simple terms, the law establishes two important expectations:

• Individuals should have meaningful control over their personal data.
• Businesses should process personal data only for lawful purposes and follow the responsibilities established under the law.

The Act introduces two important terms.

Data Principal: The individual whose personal data is being collected or processed. In simple language, this is your website visitor or customer.

Data Fiduciary: The organisation or person that decides why and how personal data is processed. This could be your startup, SaaS business, e-commerce company or website operator.

For example:

Suppose you own an online shopping website.

A visitor browses your products, creates an account and purchases something. Your website collects information and uses third-party tools to understand customer behaviour.

Your business determines why that information is collected and how it is used. You are generally the Data Fiduciary for that processing.

Even if you use external service providers to process the data, your responsibilities as a Data Fiduciary do not simply disappear.

The Act can also apply to businesses outside India when they process digital personal data in connection with offering goods or services to individuals in India.

In short: If your digital business serves Indian users, you should understand the DPDP framework.

2. What does the DPDP Act have to do with cookies?

This is where things get interesting.

A cookie is a small piece of information stored in a visitor's browser by a website.

Cookies can serve different purposes:

• Remembering login sessions.
• Saving shopping cart information.
• Remembering language and user preferences.
• Understanding website traffic.
• Measuring marketing campaigns.
• Tracking visitor behaviour across websites.

Not all cookies are used for the same purpose.

Some are essential for the website to function, while others are used for analytics, personalisation or advertising.

But here is the important distinction:

The DPDP Act does not specifically mention cookie banners or prescribe a particular cookie consent banner design.

Instead, it regulates the processing of digital personal data.

Under Section 2, personal data means data about an individual who is identifiable by or in relation to that data.

Therefore, a cookie or online identifier may fall within the DPDP framework when it identifies, or can be related to, an identifiable individual.

For example:

Imagine a marketing tracker collects an identifier that allows a business or third party to recognise a returning visitor and associate their browsing activity with that person.

That activity may involve processing digital personal data.

The same consideration applies to tracking pixels, analytics scripts and other technologies when they process personal data.

This is why website owners should not assume that cookies are outside the scope of data protection simply because they operate in the browser.

3. What does the DPDP Act actually say about consent?

Let's understand the most relevant provisions in simple language.

Section 4: Personal data must have a lawful basis for processing

Section 4 says that personal data can be processed only in accordance with the Act and for a lawful purpose.

The two grounds provided are:

1. Consent given by the individual.
2. Certain legitimate uses specified under Section 7.

This means businesses cannot simply assume that every form of data collection is acceptable.

They need to identify the appropriate lawful basis for each processing activity.

Section 5: Businesses must provide a proper notice

Before requesting consent, a Data Fiduciary must provide a notice explaining:

• What personal data is being processed.
• Why that data is being processed.
• How individuals can exercise their rights.
• How individuals can raise a complaint.

The notice must also be accessible in English or an applicable language specified in the Eighth Schedule of the Constitution.

The DPDP Rules, 2025 further clarify that the notice must be understandable independently of other information, written in clear and plain language, and include an itemised description of personal data and the specific purposes of processing.

What this means for websites:

A vague message such as "We use cookies to improve your experience" may not provide enough information where consent for personal-data processing is required.

Visitors should be able to understand what information is being collected and why.

Section 6: Consent must be meaningful

This is arguably one of the most important sections for cookie consent management.

Section 6 says consent must be:

• Free: The individual should not be forced into giving consent.
• Specific: Consent should relate to a particular purpose.
• Informed: The individual should understand what they are agreeing to.
• Unconditional: Consent should not be tied to unrelated conditions.
• Unambiguous: The individual should clearly communicate their agreement.
• Affirmative: There must be a clear action indicating consent.

The Act also says consent should be limited to the personal data necessary for the specified purpose.

Let's take an example.

A visitor opens an online shopping website.

The website needs essential cookies to maintain the shopping cart and manage the shopping session.

However, it also uses analytics tools to measure visitor behaviour and marketing pixels to measure advertising performance.

Should all these purposes automatically be treated as one permission?

A purpose-based consent approach allows visitors to make meaningful choices about different processing activities.

This is precisely why a properly designed cookie preference interface matters.

Section 6(4): Users must be able to withdraw consent

Here is another important requirement.

The Act says individuals should be able to withdraw their consent at any time.

More importantly, withdrawing consent should be as easy as giving it.

Think about this experience:

A website displays a large, attractive Accept button.

But when a visitor wants to reject or change their preferences, they have to navigate through several pages.

That creates an unnecessary barrier to exercising their choice.

A better approach is to provide accessible preference controls so visitors can revisit and change their decisions.

Section 6(10): Businesses must be able to demonstrate consent

This is particularly important for startups.

The Act places the responsibility on the Data Fiduciary to demonstrate that the required notice was provided and consent was obtained in accordance with the law when consent is the basis for processing.

In other words, simply displaying a banner is not the entire story.

Businesses should think about maintaining reliable records of:

• The visitor's consent decision.
• The categories or purposes selected.
• When the decision was made.
• The notice or policy version presented.
• Subsequent changes or withdrawal.

A consent management solution can help maintain this evidence.

4. Does the DPDP Act make cookie banners mandatory in India?

Let's clear up a common misunderstanding.

The DPDP Act does not contain a standalone provision saying:

"Every website must display a cookie consent banner."

It also does not prescribe a specific visual layout, colour, button arrangement or mandatory cookie-category taxonomy.

However, Sections 4, 5 and 6 establish requirements for lawful processing, notices and consent where consent is the applicable basis.

Therefore, if your website uses cookies or similar technologies to process personal data on a consent basis, you need an effective way to communicate the required information and obtain and manage consent.

A cookie consent banner with a preference centre is a practical way to support this.

For a website using analytics, advertising trackers and other non-essential technologies, a well-implemented consent mechanism can help ensure that the visitor's decision is respected.

Remember: A banner that merely appears on the screen but does not actually control tracking scripts is not enough to demonstrate that the underlying processing follows the visitor's choice.

The technical implementation matters just as much as the visual banner.

5. What happens if a startup ignores data protection responsibilities?

The DPDP Act establishes monetary penalties for significant breaches of its provisions.

Some of the maximum penalties listed in its Schedule include:

These are maximum statutory amounts, not automatic fines for every mistake.

These penalties apply from 13 May 2027, when the main provisions take effect.

The Data Protection Board must consider the circumstances of the breach, including its nature, gravity, duration, repetition and mitigation measures, before determining a penalty.

For startups, the lesson is not to panic about penalties.

It is to build responsible data practices before problems arise.

A privacy-conscious website can help establish trust with customers, business partners and investors.

6. Are startups also covered under the DPDP Act?

Yes, startups should pay attention to the Act.

The definition of a person under the Act includes companies, firms and other legal entities.

Section 17(3) does provide the Central Government with the power to notify certain Data Fiduciaries, including eligible recognised startups, for exemption from specified obligations.

But there is an important distinction:

This is not an automatic blanket exemption for every startup.

It depends on a government notification and the conditions specified in it.

Startups should therefore not assume that being small, early-stage or bootstrapped automatically removes their data protection responsibilities.

In fact, building privacy into a product from the beginning is much easier than trying to redesign an entire tracking architecture later.

7. What should an Indian website's cookie consent experience look like?

A good cookie consent implementation should be more than a pop-up.

Here are some practical features website owners should consider.

1. Clearly explain cookie purposes

Visitors should understand what different technologies are used for.

For example:

• Necessary: Required for core website functionality.
• Functional: Used to remember preferences.
• Analytics: Used to understand website usage.
• Marketing: Used for advertising and campaign measurement.

These are useful implementation categories, not a taxonomy explicitly mandated by the DPDP Act.

2. Provide meaningful choices

Where consent is required, visitors should have an understandable way to make their choice.

A useful interface can provide:

• Accept all.
• Reject non-essential.
• Customise preferences.

Rejecting optional purposes should not be made unnecessarily difficult.

3. Respect the visitor's decision technically

This is one of the most overlooked aspects.

Suppose a visitor rejects analytics cookies.

But Google Analytics continues to load through a JavaScript function inside your React application.

The banner may display a rejection message, but the underlying script is still running.

That defeats the purpose of the consent mechanism.

The consent implementation should therefore control the relevant scripts, tags, pixels and embedded content—not simply record a button click.

This only works when the consent script is the first script in the page’s <head>: image pixels and scripts placed before it are not held.

4. Allow visitors to change their preferences

Visitors should be able to reopen their cookie settings and change their choices without having to search through the entire website.

5. Maintain consent records

A business should be able to establish what choice was made and when, and connect that decision to the notice and processing purposes presented.

6. Review your tracking technologies regularly

Websites change constantly.

A new marketing campaign, analytics integration or third-party plugin can introduce additional trackers.

Your consent implementation should be reviewed whenever the website's tracking behaviour changes.

8. DPDP Act implementation timeline: Why should you prepare now?

The DPDP Act was enacted in 2023, but its provisions are being brought into force in phases.

The Government notified the Digital Personal Data Protection Rules, 2025 and the commencement notification in November 2025.

The important dates are:

This phased timeline is important.

As of November 2026, the main consent, notice and Data Fiduciary obligations under Sections 3–17 have not yet reached their notified commencement date.

MeitY has also consulted on shortening this transition period, so these dates may change.

However, the May 2027 deadline is approaching.

This gives businesses an opportunity to review their tracking infrastructure, identify data collection practices, update privacy notices and implement consent management ahead of time.

Waiting until the last minute can make this much harder.

9. How can TrustCookies help your website prepare?

Understanding the law is one thing.

Actually implementing consent across a modern website is another challenge.

Today's websites are not always simple HTML pages.

Many startups use React, Next.js, Vue and other JavaScript frameworks. Third-party scripts can be injected dynamically after the page has loaded.

This creates a technical challenge.

A traditional cookie banner might display a visitor's preferences, but scripts loaded later by the application can sometimes escape basic HTML-level blocking.

This is where TrustCookies comes in.

https://trustcookies.com/

TrustCookies is designed to make consent management work with modern websites, including applications built using JavaScript frameworks.

Here is how it helps:

Runtime script blocking

TrustCookies is designed to gate configured tracking scripts at runtime, including scripts injected after React or other applications hydrate.

This helps address the gap between displaying a consent banner and actually enforcing the visitor's choice.

TrustCookies’ tc.js must be the first script in the page’s <head>: image pixels and scripts placed before it are not held.

Accept, reject and customise

Give visitors a clear way to:

• Accept all.
• Reject all.
• Choose preferences by category.

The preference centre can also be reopened so visitors can change their choices.

Built for modern web frameworks

TrustCookies supports integration approaches for:

• React
• Next.js
• WordPress
• Any website with a script tag

Integrations with popular tools

Tag a script with a consent category and TrustCookies holds it until the visitor chooses.

It also supports Google Consent Mode v2 and Global Privacy Control.

Multilingual consent experience

A privacy experience should be understandable to the people using your website.

TrustCookies supports 35 languages, including Hindi, making it easier to offer a localised consent experience.

Consent records

TrustCookies maintains consent records containing information such as timestamps, region, policy and pseudonymous subject identifiers, without storing raw IP addresses in those consent records.

This helps businesses maintain a record of visitor choices.

The idea is simple: Don't just display a cookie banner. Make sure the technology behind your website respects the choice visitors make.

10. Your startup's privacy journey should start before your first compliance deadline

If you are building a startup, launching a SaaS product or running an e-commerce website, privacy should not be an afterthought.

Your website is often the first interaction a potential customer has with your business.

A transparent consent experience communicates something important:

You respect your visitors' choices.

You understand that their data belongs to them.

And you are building a business that takes responsibility for how information is processed.

The DPDP framework is an opportunity for Indian startups to establish these practices as part of their product architecture rather than treating privacy as a last-minute legal requirement.

Whether you have a simple landing page, a WordPress website, a complex React application or a SaaS platform with multiple tracking integrations, understanding what runs behind your website is an important first step.

Start building a website where consent is not just a banner. It is a real choice.

Ready to make your website consent-aware?

Don't wait until the compliance deadline to understand what your website is tracking.

Explore TrustCookies and bring meaningful consent management to your website.

Visit TrustCookies – Make Every Visitor's Choice Count

Disclaimer: This article is for general educational and informational purposes. It is not legal advice. The DPDP Act and Rules have a phased commencement schedule. Whether a particular cookie or tracking technology processes personal data, and the legal basis required for that processing, depends on the actual implementation and circumstances. Website owners should obtain appropriate legal advice for their specific use cases.