Under India's DPDP Act 2023, websites that use cookies or trackers collecting personal data must obtain valid consent. In 2026 that means automatically scanning and categorising cookies, blocking non-essential cookies until the visitor consents, serving a clear banner in Indian languages, and logging every choice in an audit trail.
Do cookies need consent under the DPDP Act?
If a cookie or tracker collects personal data, it falls within the DPDP Act's consent requirements. Essential cookies needed to deliver a service have more leeway, but analytics, advertising and profiling cookies generally require informed consent.
Prior blocking is the standard
Best practice — and the safest reading of the law — is to block non-essential cookies until the visitor opts in, so no personal data is collected before consent is given.
Get it right with a cookie consent manager
A cookie consent manager scans your site, categorises cookies, blocks them until consent, serves a branded multilingual banner and records each choice — giving you compliance and defensible evidence with one line of code.
FAQ
If your website uses cookies that collect personal data, you need valid consent under the DPDP Act 2023, which in practice means a cookie consent banner with scanning, prior blocking and consent logging.