Section 6
Cookie and tracker consent for DPDP
Cookies and trackers are one place where you ask for consent. They are not the whole DPDP programme.
Sample workspace
Tracker scan example.com
- Analytics6 trackers
- Advertising4 trackers
- Functional3 trackers
- Reject-allOn
Banner
- Scan of example.com finished
- Categories turned into purposes
- Publish banner in English and हिन्दी
Short answer
Where trackers on your website or app process personal data on the basis of consent, s.6 of the DPDP Act applies: consent must be free, specific, informed, unconditional and unambiguous with a clear affirmative action, and can be withdrawn as easily as it was given. TruePrivacy's banner requires reject-all for DPDP, ships interface text in English and all 22 Eighth Schedule languages, and comes as a web script and SDKs for iOS, Android and React Native. Cookie consent is one part of DPDP consent, not the whole programme.
What cookie consent does
Trackers that identify a visitor, such as advertising and analytics tags, can process personal data. Where you rely on consent for them, the banner is where that consent is given, refused and later withdrawn. Consent for trackers follows the same s.6 rules as any other consent.
A banner script for your website. You write and review the notice text it shows.
SDKs for iOS, Android and React Native apps.
Banner interface text in English and all 22 Eighth Schedule languages (s.5(3)).
DPDP banners require a reject-all option.
Scan a website for trackers and categorise them so they can become consent purposes.
How to set up a DPDP banner
- 01Scan your site
Run the tracker scan on your website and review how trackers are categorised.
- 02Turn categories into purposes
Make each category a consent purpose, described in plain language. See purpose limitation.
- 03Write the notice
Write and review the notice text that goes in the banner. The consent notice guide covers what to include.
- 04Publish on web and apps
Add the banner script to your website and the SDK to your iOS, Android or React Native app.
Mapped to the Act and Rules
| Duty | Section or rule | What TruePrivacy does |
|---|---|---|
| Consent that is free, specific, informed, unconditional and unambiguous, with a clear affirmative action | s.6(1) | Consent per purpose; reject-all required on DPDP banners |
| A notice with every consent request | s.5, Rule 3 | Your notice text in the banner, written from your itemised purposes |
| Notice readable in English or an Eighth Schedule language | s.5(3) | Interface text in English and all 22 Eighth Schedule languages |
| Withdraw consent as easily as it was given | s.6(4) | A preference page to change choices |
| Prove notice and consent | s.6(10) | Consent event log and receipts in consent management |
Cookies are one part of DPDP consent
A cookie banner covers trackers on your website and apps. DPDP also covers personal data you collect through forms, apps, calls and offline records you digitise, and it sits alongside notices, rights, breach response and retention. Treat the banner as one module of the programme, not the programme.
The banner's interface translations do not translate your notice. You write and review the notice text for each language you publish. If children use your site or app, s.9(3) bars tracking, behavioural monitoring and targeted advertising directed at them; see children's data.
Works with
Consent per person and purpose, with an event log, receipts and a preference page.
NoticesThe notice that comes with every consent request, and email campaigns.
Purpose limitationOne list of purposes across consent, notices and retention.
Children's dataGuardian consent with email notice, code verification and a recorded decision.
Does the DPDP Act cover cookies?
The Act applies to digital personal data. Where a cookie or tracker processes personal data on the basis of consent, s.6 applies to that consent. Check specific cases with counsel.
Which languages does the banner support?
Banner interface text ships in English and all 22 languages of the Eighth Schedule. You write and review your own notice text.
Does the banner work in mobile apps?
Yes. There are SDKs for iOS, Android and React Native, alongside the web banner script.
Is a cookie banner enough for DPDP?
No. Cookie consent is one part of DPDP consent. Notices, rights requests, grievances, breach response and retention are duties too.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin