Cookie Banners Under DPDP: Doing It Without Wrecking UX

A DPDP-compliant cookie banner blocks non-essential cookies until the visitor actively chooses to allow them, offers a real “Reject All” option as visible as “Accept All,” and logs what was agreed to. That’s the core of it. Everything else, the styling, the wording, where it sits on the page, is negotiable. Those three things aren’t.

Most businesses either do nothing (still common, still risky) or overcorrect into a five-click consent maze that tanks their bounce rate for no legal reason. Neither is necessary. India’s Digital Personal Data Protection framework is stricter than the “just show a banner” era but a lot more workable than GDPR’s reputation suggests, once you know what it actually asks for.

What does DPDP actually require for cookies?

The DPDP Act itself doesn’t mention cookies by name. It regulates “personal data,” and cookies that track, identify, or profile a visitor fall inside that definition, which is why MeitY’s supporting guidance treats them as squarely in scope. The Digital Personal Data Protection Rules were notified on 13 November 2025, and the Data Protection Board of India is already operational with penalty powers active from that date. Full compliance, including the detailed consent and notice requirements most businesses are focused on, is being phased in over roughly eighteen months from notification.

The standard for consent itself is specific: free, specific, informed, unconditional, and given through a clear affirmative action. Pre-ticked boxes, bundled “accept everything or leave” prompts, and consent implied by continued browsing all fail that test. If your banner’s only options are “Accept” and a barely visible X, it doesn’t meet the bar.

What does a compliant cookie banner actually need to include?

MeitY’s Business Requirements Document for Consent Management Systems, released in April 2025, lays out what a proper consent flow looks like in practice. Here’s the checklist version.

What a DPDP-Compliant Cookie Banner Actually Needs

• Block non-essential cookies until consent is given. Analytics, ads and embeds must not fire before a choice is made.
• Offer real category choices, not just Accept All. Essential, performance, analytics and marketing, per MeitY’s consent framework.
• Make Reject All as easy to find as Accept All. A buried or hidden reject option fails the affirmative-action standard.
• Log consent with a timestamp. Auditable logging is part of MeitY’s Consent Management System requirements.
• Let users withdraw consent as easily as they gave it. A visible preferences link, not a support ticket.
• Set an expiry and re-ask periodically. Auto-expiry is part of the same framework.
• Write the notice in plain language. Support Indian languages where your audience needs them.
• Keep a record of which notice version a user agreed to. Matters if your policy changes later.

None of that requires exotic tooling. A well-configured consent plugin or a properly set up Google-certified Consent Management Platform (CMP) handles most of it out of the box. What it does require is actually configuring the categories correctly rather than installing a plugin and leaving every default setting untouched, which is the single most common gap we find during audits.

How do you keep a compliant banner from wrecking your conversion rate?

This is the part most compliance-first guides skip entirely, and it’s where a lot of businesses get talked into over-engineering. A few things actually move the needle:

• Keep the first screen to two choices. Accept All and Manage Preferences (or Reject All) is enough. Bury the granular category toggles one click deeper, in the preferences panel, not on the banner itself.
• Write the notice like a human wrote it. “We use cookies to remember your preferences and understand how visitors use this site. You choose what to allow” clears the “informed” bar better than three paragraphs of legal boilerplate nobody reads.
• Don’t block the whole page behind a modal if you don’t have to. A banner anchored to the bottom of the screen, with essential functionality unaffected, tests better on mobile than a full-screen overlay in nearly every conversion audit we’ve run.
• Remember essential cookies don’t need consent at all. Login sessions, security tokens, and cart contents are functionally necessary and exempt from the opt-in requirement. Don’t ask permission for things you’re not legally required to ask permission for.

Do you need a full consent management platform, or is a simple banner enough?

Depends on how many third-party scripts you’re actually running. A brochure site with Google Analytics and nothing else can get compliant with a well-configured free or low-cost consent plugin: block scripts by default, load them only after consent, log the choice with a timestamp. That’s genuinely sufficient.

Once you’re running multiple ad pixels, a chat widget, a heatmap tool, and analytics all at once, a proper CMP earns its cost. It handles script-blocking automatically instead of you manually wiring conditional logic around a dozen third-party tags, and it keeps the consent log in a format you can actually produce if the Data Protection Board ever asks for it.

What happens if you get this wrong?

The Schedule to the DPDP Act sets penalties by category of contravention, not one flat number. Consent violations and notice failures, the ones a bad cookie banner exposes you to, sit in the same bracket as most core obligations: up to ₹200 crore. Ignoring a direct order from the Data Protection Board carries the highest listed figure, up to ₹250 crore, and under Section 33(3) the Board can double whatever it lands on, pushing the real ceiling to ₹500 crore in the most extreme, repeated, or deliberately defiant cases. This isn’t legal advice, and the exact figure that would apply to any specific violation depends on facts a lawyer needs to assess, but the direction is clear: “we’ll deal with it later” gets more expensive the longer a business waits.

If a site already has a GDPR-style banner, does that cover DPDP too?

Partly, and it’s worth checking rather than assuming. Most GDPR consent tools already do the hard part: blocking scripts by default, offering granular categories, logging the choice. Where they fall short for an India-focused site is usually language and framing, not mechanics. A banner written for a European audience, referencing GDPR by name and citing an EU-based legal basis, reads oddly (and looks unmaintained) on an Indian business site, and it may not reference the specific rights DPDP gives Indian users, like grievance redressal through the Data Protection Board rather than a national supervisory authority.

Practically: if you’re already running a proper consent management platform for GDPR compliance, you’re most of the way there. Update the copy, confirm the categories match what MeitY’s framework expects, and make sure the “Reject All” option is genuinely as prominent as “Accept All,” since some GDPR implementations get away with a slightly buried decline option that DPDP’s affirmative-action language wouldn’t tolerate as cleanly.

What’s the single biggest mistake we see on client cookie banners?

Analytics firing before anyone clicks anything. We’ve now audited a good number of sites that added a “DPDP-ready” cookie banner and changed nothing about how their tracking scripts actually load. The banner shows up, looks compliant, and the Google Analytics tag has already fired in the page header regardless of what the visitor chooses. That’s not a compliance banner. That’s a compliance-shaped decoration sitting on top of the exact behavior the law is asking you to stop. Fixing it isn’t hard: move tracking scripts behind your consent tool’s gating mechanism instead of hardcoding them in the theme header, and test it by checking your network tab with consent declined.

That test takes two minutes and catches the majority of “compliant on paper, non-compliant in practice” banners we come across: open your site in a private browser window, decline everything on the banner, then open your browser’s developer tools and watch the network tab as the page loads. If you see requests firing off to Google Analytics, a Meta pixel, or any other third-party tracker before you clicked anything, the banner is decorative. Fix the gating logic before you fix anything else on this list.

Frequently asked questions

Does the DPDP Act apply to cookie banners specifically?

The Act doesn’t name cookies directly, but it governs personal data, and cookies used for analytics, advertising, or profiling collect information tied to an identifiable person. MeitY’s supporting guidance explicitly places cookie consent inside the DPDP consent management framework.

When do businesses actually need to be compliant?

The DPDP Rules were notified on 13 November 2025, with the Data Protection Board already operational and penalty provisions active. The remaining detailed obligations, including the full consent and notice requirements, are rolling out in phases over the following months, so the safest approach is treating this as already in force rather than waiting for a final deadline.

What happens if a website currently has no cookie banner at all?

It’s out of step with the current framework and carries real exposure once enforcement ramps up, particularly for any site collecting data beyond strictly essential cookies. There’s no grace period written specifically for “we hadn’t gotten to it yet.”

Is a simple “Accept Cookies” banner enough under DPDP?

No, if it doesn’t offer an equally easy way to decline or doesn’t actually stop non-essential cookies from loading until consent is given. A banner that only informs, without genuinely gating anything, doesn’t meet the “clear affirmative action” standard.

Do small businesses need to worry about this, or just large companies?

The Act applies regardless of company size; there’s no small-business carve-out for consent requirements. Enforcement priority in the early phase will likely focus on larger data fiduciaries and serious breaches first, but that’s a practical reality of limited regulatory bandwidth, not a legal exemption.

Sources

• The Digital Personal Data Protection Act, 2023, full text, MeitY
• DPDP Act 2023, Section 33 and the Schedule of Penalties, DPDPA.com
• WordPress SEO: The Complete Configuration Guide
• Accessibility Basics That Also Help SEO
• Mobile Usability Errors in Search Console and Their Fixes
• Custom 404 Pages That Recover the Visit