Cookie Consent
Under India's
DPDP Act —
What Changes

The DPDP Act does not use the word "cookie" — but it applies directly to any collection and processing of personal data, regardless of the technical mechanism. Cookies that collect identifiable personal data — including pseudonymous identifiers like device IDs, IP addresses tied to profiles, and browsing behaviour — are processing personal data under the Act's definition. This means any non-essential cookie that processes personal data requires DPDP-compliant consent under §6, making cookie consent management a direct DPDP obligation for all Indian websites collecting such data.

A well-implemented GDPR cookie banner may be substantially compliant with DPDP requirements — since GDPR imposes similar or stricter standards in most areas (granular consent, reject button, withdrawal). However, there are nuances: DPDP's consent language requirements are India-specific and must reflect DPDP legal bases, not GDPR legal bases. ConsentiQo is recommended over generic GDPR CMPs for Indian websites because it generates consent records in the format expected by India's DPB, uses DPDP-specific legal basis language, and integrates with the broader KavachOne DPDP compliance ecosystem.

Consents collected before your DPDP-compliant banner is deployed may not meet the Act's standards — particularly if they were collected through implied consent (continued browsing) or pre-ticked boxes. Best practice is to re-obtain consent from existing users by displaying the new DPDP-compliant banner to returning users who have not yet given compliant consent. ConsentiQo handles this automatically — it detects whether a returning user has a valid DPDP-compliant consent record and re-presents the banner if needed, without disrupting users who have already given compliant consent.

Mobile apps do not use cookies in the traditional browser sense — but they use functionally equivalent tracking mechanisms: advertising identifiers (IDFA on iOS, GAID on Android), SDKs that collect usage analytics, in-app event tracking, and cross-app tracking via fingerprinting. All of these that process personal data are subject to DPDP consent requirements. Mobile apps must obtain consent for each tracking SDK or advertising ID usage through in-app consent flows — which ConsentiQo supports via its SDK integration for iOS and Android apps.

Users who reject all non-essential cookies must receive the same quality of core service as users who accept. Under the DPDP Act, consent must be freely given — which means conditioning core service access on cookie acceptance (known as a "consent wall") is a violation. You may not refuse access to your website, degrade the service, or present content differently to users who reject cookies. The only permissible consequence of rejecting non-essential cookies is that the features those cookies enable — personalised recommendations, targeted ads, analytics dashboards — simply do not function for that user.