Published by DPDP.ai KNOWLEDGE GUIDE | 2026 EDITION DPDP Cookie Consent Management An informative guide to cookies, consent and compliance under India's Digital Personal Data Protection Act, 2023. www.dpdp.ai/cookie-consent-management DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition 2 About this guide Cookie banners used to be a box-ticking exercise. Under India's Digital Personal Data Protection (DPDP) Act, 2023, they have become a real test of whether your organisation respects the people who visit your website. This guide explains, in plain language, what DPDP cookie consent management involves, what the law expects from your cookie banner, and how any organisation can run a fair, provable consent process without slowing its site down or burying visitors in legal jargon. It is written for compliance and legal teams, DPOs, marketers, product owners and developers. Every chapter ends with something you can act on: a checklist, a table or a simple decision rule. What is inside 01. Why Cookie Consent Is Now a Boardroom Issue . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 02. Cookies 101: What Is Running on Your Website? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 03. The Seven Rules of Valid Cookie Consent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 04. Anatomy of a DPDP-Compliant Cookie Banner . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 05. How Cookie Consent Management Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 06. Scan, Categorise and Block: Staying in Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 07. Consent Records and Audit Trails: Proof on Demand . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 08. Withdrawal, Re-consent and the Preference Centre . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 09. Speaking Your Visitor's Language: 22 Indian Languages . . . . . . . . . . . . . . . . . . . . . . . . . . 12 10. One Banner, Many Laws: DPDP, GDPR and CCPA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 11. Implementation Roadmap: From Audit to Go-Live . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 12. Choosing an Approach: Build, Buy or Blend . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 13. Ten Common Cookie Consent Mistakes (and Fixes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 14. Your 30-Day Action Plan and Checklist . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 15. Frequently Asked Questions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 16. Glossary of Key Terms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition AUG 2023 NOV 2025 DPDP Rules,2025 notified; CHAPTER 01 | THE BIG PICTURE Why Cookie Consent Is Now a Boardroom Issue NOV 2026 ~MAY 2027 Main Data Fiduciary duties apply (18 months) 3 01 Every time someone opens your website, a quiet exchange takes place. Small files called cookies, and similar trackers, begin to record who the visitor is, where they came from and what they do. Some of this is essential. A lot of it is not. For years, Indian websites could treat this as a technical detail. That era is ending. The DPDP Act, 2023 gives every individual (called a Data Principal ) the right to decide how their personal data isused, and it places the duty to respect that choice on the organisation (called a Data Fiduciary ). If your site uses analytics, advertising pixels, chat widgets or embedded video, you are almost certainly a Data Fiduciary for cookie data. Where the law stands The Act was passed in August 2023, and the DPDP Rules, 2025 were notified in November 2025. The Rules switch on the law in phases, giving businesses time to prepare. The window is now closing. The Act lets the Data Protection Board impose financial penalties that can reach hundreds of crores of rupees. Failing to meet your notice and consent duties usually falls under the general tier, but a cookie programme that also leaks data or tracks children can trigger much higher tiers. Failure to take reasonable security safeguards What is at stake DPDPAct,2023 receives Presidential assent Data Protection Board set up ConsentManager registration window opens (12 months) Failure to notify a breach; breach of children's data duties Additional duties of Significant Data Fiduciaries Any other breach, including notice and consent duties Maximum penalty per instance, as set out in the Schedule to the DPDP Act, 2023. Source: DPDP Act, 2023. Dates are indicative of the phased commencement. Always confirm current dates against the official notifications. ₹50 cr ₹150 cr ₹250 cr ₹200 cr DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition 4 A common surprise: the Act never says the word “cookie” The DPDP Act regulates personal data , not specific technologies. But cookies, device IDs and advertising identifiers that can single out an individual, or be linked to one, count as personal data in practice. That is why cookie consent sits squarely inside the law. Five questions every website owner should ask today 5 2 3 4 # 1 Can visitors read the notice in their own language? Question Do we know every cookie, pixel and SDK on our site and apps? Do any trackers fire before the visitor makes a choice? Can a visitor say no as easily as they can say yes? Could we prove, today, what a specific visitor agreed to? What a “no” tells you Start with an automatic scan. If yes, data is collected without consent. If not, the banner needs a redesign. If not, you need tamper-proof consent logs. If not, add Eighth Schedule language support. If you answered “no” or “not sure” to even one of these, you are in good company. Most websites do. The rest of this guide shows how to close each gap, step by step. DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 02 | THE BASICS Cookies 101: What Is Running on Your Website? 5 02 Before you can ask for consent, you need to know what you are asking consent for. A cookie is a small text file that a website stores in a visitor's browser. It helps the site remember something: a login, a language choice, or the fact that this visitor has seen a particular advert. The four categories every visitor should understand When does a cookie become personal data? First-party, third-party, session and persistent Most compliant banners group cookies into four simple categories. This is a widely used structure and it works well for visitors because it matches how they think. Cookies are also described by who sets them and how long they last. These labels matter because they change the risk. •First-party cookies are set by your own domain. They are usually easier to control. •Third-party cookies are set by other companies whose tools you embed: ad networks, social widgets, video players, heat-map tools. These are where most hidden compliance risk lives. •Session cookies disappear when the browser closes. Persistent cookies stay for days, months or years and are far more intrusive. •Look-alikes such as tracking pixels, local storage, SDK identifiers and browser finger printing do the same job and should be treated the same way. Whatever tool you use should cover these too. A simpletest: could thisidentifier help someonerecognise,single out or follow an individual? If yes, treat it as personal data. A random ID stored in a cookie, when combined with browsing history, IP address or login details, usually passes that test. Targeting & Advertising Performance & Analytics Functional Category Strictly Necessary What it does Makes the site work. Without it, core features break. Measures how people use the site so you can improve it. Remembers choices to make the site more comfortable. Builds profiles and shows personalised ads. Typical examples Login sessions, load balancing, shopping cart, security tokens Google Analytics, heatmaps, traffic counters Language, region, saved preferences, chat history Ad pixels, retargeting, cross-site tracking Consent? Not required. Always on. Required. Opt-in. Required. Opt-in. Required. Opt-in. DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 03 | WHAT THE LAW EXPECTS The Seven Rules of Valid Cookie Consent 6 03 Section 6 of the DPDP Act defines what counts as valid consent. In plain English, consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the purpose you stated. Here is what each rule means for a cookie banner. Rule 6 4 5 3 2 7 # 1 Free Specific Informed Affirmative action Limited to purpose Unambiguous Unconditional In plain English No pressure or trickery. People know what they agree to. Consent is not bundled with unrelated terms. No guessing what the visitor meant. The visitor must do something. Use data only for what was agreed. One choice per purpose. What it means for your banner Do not block the whole site unless the visitor accepts tracking (a “cookie wall”). Offer separate switches for analytics, functional and advertising cookies. No single all-or-nothing button. State the purpose and the data collected in simple words, before the choice is made. Do not make cookie acceptance a condition for using unrelated features. No pre-ticked boxes. Scrolling or continuing to browse is not consent. A click on Accept, Reject or Save is an action. Silence is not. A cookie consented to for analytics cannot later feed advertising profiles. Three more duties you cannot skip • Noticefirst. Section 5 and the DPDP Rules require a clear notice, in plain language, that itemises the personal data, the purpose, how to withdraw consent, how to exercise your rights and how to complain to the Data Protection Board. •Withdrawal must be as easy as giving consent. Section 6 says so directly. If it takes one click to accept, it cannot take five clicks and a form to withdraw. •You must be able to prove it. The burden of proving that notice was given and consent was obtained rests on the Data Fiduciary. If you cannot show a record, regulators may treat it as if it never happened. Quick self-test Openyour website in a private browser window. Before you click anything, check your browser's developer tools. Do analytics or ad cookies already appear? If so, you are collecting data before consent. This is the single most common failure we see. DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 04 | DESIGN THAT EARNS TRUST Anatomy of a DPDP-Compliant Cookie Banner 7 04 A good banner is clear, calm and fair. It does not trick people into saying yes. Here is a layout that meets the core expectations of the Act. www.yourwebsite.in 1We value your privacy Necessary Analytics Functional Cookie Policy Advertising Language: English We use cookies to run this site and, with your permission, to understand usage and show relevant offers. Choose what you are comfortable with. You can change this any time. Accept all Reject all Save my choices 4 3 6 5 2 # 1 2 3 4 5 6 Element Plain heading Short explanation Category switches Equal-weight buttons Cookie policy link Language selector ✓ Do • Make Reject as easy as Accept • Keep every non-essential switch off by default • Let people reopen their choices at any time Why it is there Tells the visitor in a few words what the banner is about. Explains cookie use in everyday language, not legal wording. Per-purpose choice. Necessary is locked on; the rest start off. Accept and Reject sit side by side and look equally easy to click. Opens the full, itemised notice for visitors who want more detail. Lets visitors read the notice in English or any Eighth Schedule language. ✗ Do not • Hide Reject behind extra clicks • Use pre-ticked boxes or silent consent • Fire trackers while the banner is still on screen Writing copy people actually read Typical: “We and our partners process your data for legitimate interests including audience measurement.” Clear: “We use analytics cookies to count visits and see which pages are useful. You can say no and still use everything.” DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 05 | THE PROCESS How Cookie Consent Management Works 8 05 Cookie consent management is the set of processes and technical controls that find your cookies, tell visitors about them, capture their choice, enforce it and keep proof. It can be run by hand, built in-house or supported by specialised software. Which ever route you take, the lifecycle is the same. 1 Discover Scan site for cookies, tags and trackers 2 Notify 3 Collect Capture a granular, affirmative choice 4 Enforce Block or release scripts by choice 5 Record Log every action in a tamper-proof trail 6 Review Re-scan, re-consent, honour withdrawal Show a clear, plain-languag e notice Nine capabilities every approach must cover Re-scan and re-consent Prior blocking Multi-language notices Consent records Capability Cookie discovery Easy configuration Granular categories Region-aware display Signals to other tools What it involves Detecting and classifying first- and third-party cookies, including new tags and pixels. Letting visitors accept or deny each cookie category independently. Keeping non-consented scripts from firing until the visitor opts in. Showing banners suited to each region, such as opt-in for India. Passing the visitor's choice to analytics and ad tools, e.g. Google Consent Mode v2. Offering the notice in English and Eighth Schedule languages. Storing each action with timestamp, device, notice version and choices. Letting legal and marketing change copy and categories without a developer ticket. Detecting new cookies and policy changes, then asking again. Keeps the notice accurate and up to date. Visitors always see the latest notice. Why it matters You cannot manage what you cannot see. Meets the “specific” rule in Section 6. Stops data collection before consent. One set-up can serve several regions. Compliance without losing all measurement. Matches the Act's language requirement. Gives you audit-ready proof. DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 06 | KNOW YOUR COOKIES Scan, Categorise and Block: Stayingin Control 9 06 Hidden cookies from third-party tools are one of the biggest compliance risks. A marketing plug-in, a chat widget or an embedded video can quietly add trackers that nobody on the legal team has approved. The answer is a repeatable loop: scan, classify, block, release on consent. How consent-based blocking works Keep the inventory fresh Why “blocked at the source” matters NO NO Visitor opens your page Keep the script blocked. Log the rejection. YES YES Load immediately. No consent needed for these. Fire the script and log the consent with a timestamp. Is the cookie strictly necessary? Has the visitor opted in to this category? Why it matters: blocking must happen before the script runs. Hiding a banner after a tracker has fired is not consent. Your website changes every week: new campaigns, new plug-ins, new tags. A one-time audit goes out of date in days. Continuous re-scanning finds new cookies as they appear and sorts them into the right category. It can also keep your cookie policy in sync with what is truly running on your pages, written in plain language. Some banners only hide t rackers visually while the scripts keep running in the background. Real blocking happens at the tag-manager or script level, so analytics, advertising and tracking tags do not fire until the visitor opts in. This is the difference between looking compliant and being compliant. DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 07 | EVIDENCE Consent Records and Audit Trails: Proof on Demand 10 07 Under the DPDP Act, it is not enough to say you collected consent. The burden of proof sits with you. If a Data Principal complains, or the Board asks, you need a reliable record of exactly what the visitor saw and chose. What a good consent record contains What an audit trail looks like Choices made Banner version Channel, device, region Field Timestamp Visitor reference Consent record exported Event Cookies accepted: Analytics, Functional Cookies rejected: Targeting & Advertising Banner re-shown: Cookie Policy v1.5 Example 2026-06-18 10:12:44 IST Tokenised ID, e.g. #C7K3 Analytics: accepted; Advertising: rejected v1.4 Web banner, mobile Chrome, India (opt-in) Visitor #C7K3 | 2026-06-18 10:12:44 IST | Web banner System | 2026-06-19 09:00:00 IST | New tracking script detected Compliance team | 2026-06-19 16:40:11 IST | Regulator audit Details Visitor #C7K3 | 2026-06-18 10:12:44 IST | Web banner v1.4 Export Rejected Status Accepted Why you need it Proves when the choice was made. Links choices to one visitor without storing extra personal data. Shows the specific, per-purpose decision. Re-consent Proves which notice wording the visitor saw. Shows the context and which legal rules applied. Each action becomes one line in an immutable log: Tamper-proof. Records cannot be edited or deleted after the fact, so they stand up as evidence. Privacy-light. Tokenised references mean your consent database does not create a new pile of personal data to protect. Exportable. One-click, structured reports (PDF or JSON) for Board submissions, supervisory authorities or internal audits. • • • DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 08 | CONSENT IS A CONVERSATION Withdrawal, Re-consent and the Preference Centre 11 08 Consent is not a one-time event. People change their minds, your cookieschange,andyour policy changes. A compliant set-up treats consent as something thatisreviewedand renewed, not collected once and forgotten. Make withdrawal effortless When to ask again A special note on children Triggersforre-consentshouldbe automatic, not manual: Section 9 ofthe Actaddsextraprotectionfor children. A Data Fiduciary must obtain verifiable parental consent before processing a child's personal data and must not undertake tracking, behavioural monitoring or targeted advertising directed at children. If your site serves learners or young users (for example an ed-tech platform), switch off advertising and behavioural cookies for those audiences and take specific legal advice on age assurance. Section6 of the Act says withdrawing consent must be as easy as giving it. In practice, that means: • A small, permanent “Cookie preferences” link or icon on every page, usually in the footer. • A preference centre that shows the visitor's current choices and lets them change any of them in one click. •Immediate effect. When consent is withdrawn, the related scripts stop firing and the withdrawal is logged. •Downstream updates. Send each new consent or withdrawal by webhook to your connected systems (CRM, analytics, marketing tools) so every system stays in step. Trigger A new cookie or tracker is detected Your cookie policy version changes A purpose changes (for example analytics to advertising) Consent reaches your internal expiry period Prompt the visitor to confirm or update their choices. What should happen Classify it, update the notice and re-show the banner for the affected category. Show the updated notice and ask for fresh consent. Treat it as a new purpose. Ask again; never reuse old consent. Remember Therighttowithdraw is a right of the visitor, not a feature you can charge for or hide in settings menus. Make it visible, fast and free. DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 09 | INCLUSIVE CONSENT Speaking Your Visitor's Language: 22 Indian Languages 12 09 India's internet users are diverse, and a large share browse in their own language. The DPDP Act requires that a Data Principal be able to read the notice in English or any language listed in the Eighth Schedule of the Constitution. A banner written only in English may not meet that standard for many of your visitors. The 22 Eighth Schedule languages Getting multilingual banners right • Sindhi Kannada Marathi Assamese Tamil Nepali Bengali Kashmiri Odia Bodo Telugu Konkani Urdu Dogri Maithili Punjabi Malayalam Sanskrit Gujarati Hindi Santali Manipuri • • • • Translatemeaning,not words. Literaltranslationof legal English often produces confusing text. Have a native speaker review the copy. Detect, then let people choose. Pick a sensible default from the browser language, but always show a visible language selector. Keep every version in sync. When you update the notice, all language versions must update together and each must be logged with its version number. Check the layout. Scripts such as Devanagari, Tamil or Urdu (right-to-left) need room. Test your banner on small phone screens. Test with real users. Ask a few visitors what they think they chose. If they are unsure, the wording needs work. Why it helps beyond compliance Abanner people understandbuildstrust. Visitors who feel respected are more likely to make an informed, lasting choice, which means fewer complaints and cleaner data. DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 10 | GOING GLOBAL One Banner, Many Laws: DPDP, GDPR and CCPA 13 10 If your website also serves visitors from Europe or California, you do not need three different banners. You need one banner that can behave differently by region. Here is how the three frameworks compare on cookie consent. Consent standard Language Proof of consent Maximum penalty Withdrawal Default model Up to ₹250 crore (tiered) English or any Eighth Schedule language Burden on the Data Fiduciary India: DPDP Act, 2023 Opt-in consent for non-essential processing Free, specific, informed, unconditional, unambiguous, affirmative As easy as giving consent (Sec. 6) EU: GDPR + ePrivacy Opt-in consent for non-essential cookies Freely given, specific, informed, unambiguous As easy as giving consent (Art. 7) Language the user understands Controller must demonstrate consent (Art. 7) Up to €20M or 4% of global turnover California: CCPA / CPRA Opt-out of sale or sharing Maintain records of requests and responses Per-violation civil penalties Honour Do Not Sell or Share links and Global Privacy Control Clear and plain language Notice plus right to opt out; consent needed for minors This table is a simplified overview for orientation and is not legal advice. Laws and enforcement practices evolve. Geo-aware display Speed and Core Web Vitals Protecting marketing performance with Google Consent Mode v2 Many marketers worrythat askingfor consentwillwrecktheir measurement. Google ConsentModev2 helps. It passes the visitor's consent state to Google Analytics and Google Ads so that tags behave accordingly, supporting compliance while preserving modelled conversion data. Setting it up correctly helps ad-spend reporting stay reasonably accurate even when advertising cookies are opt-in. Aheavybannercanslowpages,hurt search rankings and frustrate visitors. Look for a lightweight script that loads asynchronously. A sensible target is a measurable impact of well under 100 milliseconds, checked with your own speed tests. Ageo-aware banner shows anopt-in experience to visitors in India and the EU, and an opt-out experience where the law allows it, from one configuration. This keeps the experience consistent and avoids maintaining duplicate banners. DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 11 | GETTING IT DONE Implementation Roadmap: From Audit to Go-Live 14 11 Rolling out cookie consent is a short, well-defined project rather than a long transformation. Timelines depend on the size of your site and how many third-party tools it uses.Hereisa four-step path that works for most organisations. 4 3 2 1 Audit Design Group cookies into categories, define a purpose for each, and write a plain-language notice. Decide which languages and regions you will cover. Deploy Monitor Track consent rates and cookie inventory, review logs, and re-scan on a schedule. Update the notice whenever something changes. Scanyour site and apps. List every cookie, tag and tracker, who owns it and why it is there. Remove anything you no longer need. Addthe consent banner through your CMS or tag manager. Set up blocking so non-essential scripts wait for consent. Test in a private browser window. Who does what Cookie compliance works best as a shared effort. Agree on roles before you start. Team Legal / DPO Leadership Security / IT Marketing Product / Engineering Main responsibilities Approve categories, purposes and notice wording. Own the mock-audit and the response to regulators. Declare every tag and pixel. Write clear banner copy. Monitor consent rates. Install the banner code or tag-manager set-up. Make sure scripts are blocked until consent. Keep the preference link in the footer. Review the consent store and any webhook connections. Confirm records are protected. Fund the programme and review a short consent and compliance report each quarter. DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 12 | DECISION GUIDE Choosing an Approach: Build, Buy or Blend 15 12 There is no single right way to manage cookie consent. Small sites with few tools may manage with a simple in-house set-up. Larger or fast-changing sites usually need automation. This chapter helps you compare the options fairly. Approach In-house build Performance Cost over time Real script blocking Automatic scanning Language support Granular consent Audit-ready logs Criterion DPDP-specific design Open-source or CMS plug-in Commercial consent software Withdrawal and re-consent Integrations Strengths Full control. Fits unusual systems. No external dependency. Scanning, blocking, languages and logs ready to use. Maintained as rules change. Low cost to start. Quick for simple sites. What to ask Is consent built around Section 6, notice rules and Data Principal rights, or adapted from GDPR? Are scripts blocked before consent at tag-manager level, or just hidden? How often does it re-scan? Does it catch new third-party trackers by itself? Are Eighth Schedule languages included, with a visible language selector? Can visitors accept or reject each category independently? Are logs tamper-proof, timestamped, versioned and exportable, without storing extra personal data? Is a preference centre included? Does re-consent fire when policies change? Does it support tag managers, webhooks and signals such as Google Consent Mode v2? What is the measured load impact on Core Web Vitals? Is the cost predictable as traffic and stored records grow? Watch-outs Needs ongoing developer time. Easy to miss new cookies, languages or log requirements. Features and DPDP fit vary. Records, languages and blocking may be limited. Needs vendor evaluation. Check data handling and how pricing grows with your traffic. Questions to ask of any solution Which ever route you choose, test it against these questions. Score each from 0 (missing) to 2 (fully supported). DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 13 | LEARN FROM OTHERS Ten Common Cookie Consent Mistakes (and Fixes) 16 13 These ten problems appear again and again in cookie audits. The good news: each one has a straight forward fix. 8 9 4 5 3 2 6 7 # 1 10 Pre-ticked boxes Banner only in English One-time cookie audit No proof of consent Withdrawal is buried Old consent reused for new purposes Ignoring children's data Mistake Trackers fire before the visitor chooses Only an “Accept all” button Reject is hidden or greyed out Heavier penalties may apply. Consent is not specific or free. A dark pattern that undermines free consent. Silence or inaction is not consent. May not meet the language requirement. New tags appear every week. You carry the burden of proof. Why it is a problem Data is collected without consent. Must be as easy as giving consent. Violates purpose limitation. The fix Block non-essential scripts until opt-in. Add Reject and per-category choices. Give Accept and Reject equal prominence. Start all optional switches off. Offer Eighth Schedule languages. Schedule regular re-scans. Keep tamper-proof, exportable logs. Add a permanent preferences link. Trigger re-consent on any purpose change. Disable ad tracking for minors; seek age-assurance advice. The pattern behind most failures Almost every mistake above comes from treating the banner as a design task instead of a data-control task. Start from what your site really does with data, and design the banner to be an honest description of it. DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 14 | START TODAY 17 14 Your 30-Day Action Plan and Checklist You do not need a long project plan. Four short weeks are enough to move from uncertainty to a compliant, evidenced cookie programme. WEEK 1 Discover WEEK 2 Decide WEEK 3 Deploy WEEK 4 Demonstrate Scan yourwebsite. List every cookie, tag and tracker. Identify owners for each. Groupcookies into four categories. Define the purpose of each. Draft the plain-language notice. Configurethe banner and languages. Install the snippet. Test blocking in a private browser. Review logsand exporta sample audit report. Train the team. Schedule quarterly reviews. The compliance checklist ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ ☐ Preference link visible on every page Children's data and advertising rules reviewed Consent logs are timestamped, versioned and tamper-proof Re-scan and re-consent are switched on Scanned the site and listed every cookie and tracker Grouped cookies into four clear categories Banner shows Accept, Reject and per-category choice Non-essential scripts are blocked before consent Assigned a business owner to each third-party tag Wrote a plain-language notice with purposes All optional categories are off by default Banner available in English and Eighth Schedule languages Withdrawal takes effect immediately and is logged Audit report can be exported in minutes Google Consent Mode v2 configured for Analytics and Ads Team trained and quarterly review scheduled Where to go next Read the DPDP Act, 2023 and the DPDP Rules, 2025 on the official websites of the Government of India (MeitY) and the Data Protection Board, and ask your legal advisor to confirm the dates and duties that apply to your organisation. DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 15 | QUICK ANSWERS 18 15 Frequently Asked Questions Q Q Q Q Q Q Q Q Do all cookies need consent? Strictly necessary cookies, such as login sessions or shopping carts, are generally treated differently from analytics, functional and advertising cookies. They should still be disclosed in your notice. Confirm the position for your site with your legal advisor. How long should I keep consent records? Keep them for as long as you need to demonstrate valid consent and meet the retention requirements in the DPDP Rules and any sector rules. Confirm the exact period with your legal advisor. Will a cookie banner slow down my website? A well-built banner should not. Use a lightweight script that loads asynchronously, and measure the impact on page speed, Core Web Vitals and SEO before and after you add it. What happens when a visitor rejects cookies? Non-essential cookies and trackers are blocked from running. Necessary cookies keep working. The choice is recorded, and the visitor can return later to change or withdraw it. Does the DPDP Act mention cookies specifically? No. It regulates personal data. However, cookies and trackers that identify or can be linked to an individual are treated as personal data, so the Act's notice, consent and withdrawal rules apply. Can I customise the banner to match my brand? Yes. A good tool lets you change colours, logo, text, layout, position, languages and consent options from a no-code dashboard, and publish changes instantly. What is cookie consent and why does my website need it? Cookie consent is permission from a visitor to store or access cookies on theirdevice.Underthe Do I need separate banners for India, the EU and California? Not if your set-up is geo-aware. One configuration can show an opt-in banner for DPDP and GDPR regions and an opt-out experience for CCPA regions. DPDP Act, if cookies process personal data, you need valid consent, a clear notice and a way to prove both. Good DPDP cookie consent management , manual or automated, covers all three. Important notice. This guide is provided for general information and education only. It is not legal advice. Please consult a qualified legal professional about your specific obligations under the DPDP Act, 2023 and the DPDP Rules, 2025. DPDP.ai www.dpdp.ai/cookie-consent-management | DPDP Cookie Consent Management Guide 2026 Edition CHAPTER 16 | QUICK REFERENCE 19 16 Glossary of Key Terms Notice Cookie wall Dark pattern Term Data Principal Data Fiduciary Data Processor Consent Consent Manager Purpose limitation Re-consent Tracking pixel / SDK Eighth Schedule Global Privacy Control Strictly necessary cookie Third-party cookie Data Protection Board Significant Data Fiduciary Meaning The individual whose personal data is processed, such as a websitevisitor. The organisation that decides why and how personal data is processed. A business that processes personal data on behalf of a Data Fiduciary. A free, specific, informed, unconditional and unambiguous indication of agreement, given by a clear affirmative action. The information given to a Data Principal before consent: what data, for what purpose, and how to exercise rights. A registered entity that lets a Data Principal give, manage, review and withdraw consent through one interface. The body set up under the Act to hear complaints and impose penalties. A Data Fiduciary notified by the Government as carrying higher risk and extra duties. A cookie essential for the site to work, such as a login session. A cookie set by a domain other than the one the visitor is on, often by advertising or analytics tools. A tiny image or code library that reports visitor activity, doing the same job as a cookie. A barrier that blocks access to a site unless the visitor accepts tracking. A design trick that nudges people towards a choice, such as a hidden Reject button. Using personal data only for the purpose the Data Principal agreed to. Asking the visitor to confirm or update their choices after something material changes. The list of 22 languages recognised in India's Constitution. A browser signal that tells sites the visitor does not want their data sold or shared. SUMMARY Key Takeaways 4 5 6 3 2 7 1 Offer the notice in English or any Eighth Schedule language. Reject and withdraw options must be as simple to use as Accept. Non-essential cookies and scripts should stay off until the visitor opts in. Re-scan regularly and ask again when cookies, purposes or policies change. You carry the burden of showing that notice was given and consent obtained. The Act never names cookies, but identifiers that single out a person fall under it. Free, specific, informed, unconditional, unambiguous and given by a clear action. Keep proof. Keep it current. Ask before you track. Consent must be real. Make no as easy as yes. Speak the visitor's language. Cookies can be personal data. PublishedbyDPDP.ai | www.dpdp.ai © 2026 DPDP.ai by Surepass Technologies. For general information only; not legal advice.