Question · Consent
Cookie consent under the DPDP Act
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
A compliant banner does four things: it stops every non-essential script and cookie until the visitor chooses, it offers Reject with the same effort as Accept, it asks for each purpose separately with nothing pre-ticked, and it records the choice. Most banners do none of the first three, because the trackers have already fired by the time the banner appears.
From the Gevox Readiness Index: Nineteen of twenty websites of firms that sell DPDP advice load tracking or set cookies before consent.
The Act does not mention cookies
Section 6 sets the consent standard for processing, and a cookie or a tracking script that sends a visitor’s IP address, device and page to a third party is processing. That is the whole basis. The word cookie appears nowhere; the load order is what the law tests.
The first second
On a typical site, analytics fires at about 120 milliseconds, a font provider at 200, a chat widget at 300, and the banner appears at 900. By the time the visitor can refuse, four third parties have their data. Section 6 requires consent before processing; a banner that appears after is asking permission for something that has already happened.
Essential versus everything else
Cookies strictly needed to provide what the visitor asked for, such as keeping a session or a cart, rest on Section 7(a): data provided voluntarily for that purpose. Analytics, advertising, personalisation, embedded video and chat do not; each needs consent for its own purpose.
The record
Section 6(10) puts the burden of proving consent on the Fiduciary. Keep the notice version shown, the choice made, the time and the mechanism. Without the record, the consent cannot be relied on.
Questions people ask
- Do we need a banner if we only use analytics?
- Yes. Analytics sends personal data to a third party before the visitor has agreed to anything. It needs consent, and the tag must not fire until it is given.
- Is "By using this site you agree" enough?
- No. Section 6(1) requires a clear affirmative action; continued use is not one.
- Can Reject be behind a second click?
- Consent must be free and withdrawal as easy as giving. Refusal buried under Manage preferences fails that standard.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.