DPDP and your website: what Indian businesses actually have to do
India's DPDP Rules were notified in November 2025, with the substantive obligations landing in May 2027. Here is what changes on your website, and why the consent decisions you make now decide whether your ad tracking still works.
8 min read
We are not lawyers and this is not legal advice. This is an implementation guide for the marketing and measurement side of DPDP, written for business owners who need to know what to change on their website. For obligations specific to your business, take proper legal advice.
India's Digital Personal Data Protection Rules, 2025 were notified on 14 November 2025. The substantive obligations — the ones that change what your website has to do — land in May 2027.
That sounds far away. It is not, for one specific reason: the consent decisions you make now determine whether your ad tracking still works when the rules bite. Businesses that bolt a consent banner on at the last minute typically lose a large share of their conversion data overnight, because the banner blocks the tags and nothing was configured to handle it. Businesses that plan for it keep most of their measurement through modelling.
The timeline, in plain terms
| Phase | Date | What applies |
|---|---|---|
| Phase 1 | 14 November 2025 | Data Protection Board established; procedural provisions |
| Phase 2 | November 2026 | Consent Manager registration opens |
| Phase 3 | 14 May 2027 | Substantive compliance: consent notices, security safeguards, breach reporting |
Is a cookie banner legally required in India?
Not in the way it is in Europe, and this is the most common misunderstanding. DPDP is a personal data law, not a cookie law. There is no Indian equivalent of the EU's ePrivacy Directive, which is what actually mandates cookie consent in Europe.
- A cookie that stores no personal data and only remembers a UI preference is not what DPDP is aimed at.
- An analytics or advertising tag that collects identifiers tied to an identifiable person is processing personal data, and does need a lawful basis — which under DPDP generally means consent.
So the question is not whether you need a cookie banner. It is whether you are collecting personal data, and whether you obtained valid consent with a proper notice. For any site running GA4, Meta Pixel or Google Ads tags, the answer to the first half is yes.
What a valid consent notice has to contain
The rules set a meaningfully higher bar than the banners most Indian sites run today. A compliant notice must be standalone rather than buried in a general privacy policy, written in clear plain language, itemised with the specific data collected and the specific purpose for each, and presented with or before the consent request.
Pre-ticked boxes and generic blanket policies are explicitly ruled out. In practice, "We use cookies to improve your experience. [OK]" does not meet this standard, and neither does a banner with only an Accept button. Consent must also be as easy to withdraw as it was to give.
How this affects GA4, Meta Pixel and Google Ads
Google Consent Mode v2
Consent Mode is Google's mechanism for adjusting tag behaviour based on consent state. It was built for GDPR and Google mandates it for EEA traffic — it is not mandated for India. But it is the right tool for DPDP anyway, because it solves the problem properly rather than by brute force.
| Approach | What happens | Data loss |
|---|---|---|
| Blocking — do not fire tags until consent | Tags simply do not run for non-consenters | Severe. You lose them entirely. |
| Consent Mode — tags run in a restricted state | Cookieless pings sent; Google models the gap | Much lower. Conversions are modelled back. |
Set the default state to denied and update on the user's choice. The default must fire before any Google tag, which in practice means a small script in the page head, ahead of your tag manager.
Meta Pixel and the Conversions API
Meta has no equivalent modelling layer. If the Pixel is blocked, the event is gone. That is a strong argument for the Conversions API as a server-side complement — but be careful about the reasoning. CAPI is not a way to route around a user's refusal. Sending server-side events for someone who declined consent is worse than the browser-side problem, not better. Configure it to respect the same consent state.
Expect a reported-conversion drop when you implement this properly. That is not a bug — it is the tracking finally reflecting what you are actually permitted to observe. Baseline before and after so nobody reads the step change as a performance decline.
An implementation checklist
- Inventory what you actually collect — every tag, form field and third-party script. Most businesses find things nobody remembered installing.
- Write the itemised notice: data collected, and the specific purpose of each, in plain language, standalone.
- Implement Consent Mode v2 defaults in the page head, before the tag manager loads, with all four signals defaulted to denied.
- Build a real consent banner with genuine Accept and Reject options of equal prominence. No pre-ticked boxes, no Accept-only.
- Wire the banner to update consent state and push a dataLayer event so tags respond.
- Gate tags on consent using consent checks rather than blocking triggers.
- Build a withdrawal path that is as easy as giving consent was.
- Configure the Conversions API to respect consent if you use it.
- Baseline your numbers before and after so you can tell a consent effect from a performance change.
- Document the whole thing — accountability is a live obligation, not a paperwork exercise.
Frequently asked questions
- Does DPDP require a cookie banner on my Indian website?
- Not directly. DPDP regulates personal data rather than cookies specifically, and India has no equivalent of the EU's ePrivacy Directive. But if you run GA4, Meta Pixel or Google Ads tags you are processing personal data, which needs consent with a proper itemised notice, so in practice most sites will need a consent mechanism.
- When do I actually need to comply?
- Substantive obligations including consent notices apply from 14 May 2027. Consent Manager registration opens around November 2026. The Rules were notified on 14 November 2025.
- Is Google Consent Mode v2 mandatory in India?
- No. Google mandates it for EEA traffic, not Indian traffic. But it is the better technical approach for DPDP, because it preserves modelled conversion data instead of losing non-consenting users entirely.
- Will I lose conversion data when I implement consent?
- Some, yes. With tag blocking the loss is severe. With Consent Mode v2 it is much smaller, because Google models the gap from cookieless pings. Baseline before you switch so you can distinguish a consent effect from a performance drop.
- Can I use the Conversions API to keep tracking people who declined?
- No, and you should not try. Sending server-side events for a user who refused consent is a worse problem than the one it solves. Configure the Conversions API to respect the same consent state.
Ready to turn your website and ads into a customer engine?
Tell us about your business. You'll get a clear plan, honest pricing and a fixed scope — usually within one working day.