Cookie banner in India (DPDP Act)
The Digital Personal Data Protection Act (DPDP Act 2023) and its 2025 Rules bring a GDPR-like consent model to India: real opt-in, granular categories and an auditable log of every visitor decision.
Last updated:
What the DPDP Act requires for cookies
- Only strictly necessary cookies may be active by default; everything else requires explicit opt-in.
- Granular categories (essential, performance, analytics, marketing), not a simple accept/reject.
- Consent logged with metadata and auto-expiry, not a permanent one-time decision.
Is it already mandatory?
India's Ministry of Electronics and IT (MeitY) published the technical requirements document for consent-management platforms in June 2025. It's not yet a line-by-line binding technical mandate, but it sets the standard regulators will use to judge whether a banner is compliant — acting now avoids a rushed migration once full enforcement lands.
Cookie banner by platform
Alternatives to other CMPs
This guide is informational and not legal advice. For specific questions, consult a professional.