Part I: Abstract and Introduction
Every time a browser loads an Indian website, a small but consequential exchange usually takes place: a cookie is set, sometimes a tracker fires, and data describing the visit begins its journey somewhere. Whether Indian law actually regulates this exchange, and how confidently that question can be answered, is the subject of this article.
The starting point has to be stated precisely, because precision is where most commentary on this subject goes wrong. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) does not use the word “cookie” anywhere in its text. Nor does the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), notified by the Ministry of Electronics and Information Technology vide Gazette Notification G.S.R. 846(E) dated 13 November 2025. India does not have a cookie-specific law comparable to the EU’s privacy Directive. What exists is a general personal-data-protection statute, and the question of whether and how it applies to cookies is a matter of statutory interpretation rather than an explicit rule.
This article distinguishes, wherever a conclusion is drawn, between four categories: a settled legal requirement under the Act or Rules; a reasoned interpretation that industry and regulators have adopted but that has not been tested before the Data Protection Board or a court; an industry best practice that goes beyond what the law currently requires; or a genuinely open question on which the law does not yet speak. This structure is adopted because the area is new, evolving rapidly, and prone to overstatement, and because conflating these categories does a disservice to anyone relying on this article for practical guidance.
The article proceeds as follows: Part II sets out the relevant statutory and regulatory text and its documented institutional history. Part III examines how that text is being interpreted in practice, including by industry bodies, and is explicit about where interpretation outruns the statute. Part IV offers a critical assessment of the gaps and uncertainties that remain. Part V closes with practical guidance for website operators and for individual users, each clearly marked as guidance rather than a recitation of binding law.
Key terms: “Data Principal” is the individual to whom personal data relates. “Data Fiduciary” is the entity that determines the purpose and means of processing that data ordinarily, the website operator.
Part II: Background and Legal Framework
2.1 What a Cookie Is, and Why Categorisation Matters :
Cookies are commonly grouped into categories that matter for legal analysis, though none of these category labels appear in the DPDP Act or Rules themselves. Strictly necessary cookies support core website functions such as maintaining a login session. Functional cookies store preferences. Analytics cookies measure usage patterns. Advertising or tracking cookies, frequently placed by third parties, follow a user across sites to build behavioural profiles. These categories are drawn from industry and technical usage, not from Indian statute, and the legal treatment of each category is, as discussed below, a matter of ongoing interpretation rather than settled classification.
2.2 The Statutory Text Governing What Counts as Personal Data :
Section 2(t) of the DPDP Act defines “personal data” as any data about an individual who is identifiable by or in relation to such data. This is the only textual anchor available for deciding whether cookie-derived data falls within the Act at all, and the Act does not further define what makes a person “identifiable” in a tracking context. Settled position: data that, on its face, identifies a specific individual a logged-in user’s name, email, or account ID tied to a cookie is personal data, and processing it through cookies requires a lawful basis under Section 4. Genuinely open question: whether a pseudonymous or random tracking identifier, without more, renders a person “identifiable” for the purposes of the Act is not resolved by the statutory text, has not yet been addressed in any reported decision of the Data Protection Board, and is the subject of differing views among practitioners. This article does not treat that question as settled in either direction.
2.3 The Constitutional and Pre-DPDP Background :
Before the DPDP Act, data collection was governed by the Information Technology Act, 2000 and the SPDI Rules, 2011, which required consent only for a narrow category of “sensitive personal data” and did not address ordinary browsing data in terms. The constitutional foundation for data protection legislation generally is Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, in which a nine-judge bench of the Supreme Court held that privacy, including informational privacy, is a fundamental right under Article 21. The DPDP Act is widely understood as a legislative response to that judgment, although it does not itself cite Puttaswamy as a source, and the connection between the two is doctrinal rather than textual.
2.4 The Documented Notification History :
The institutional timeline below is drawn from the official Gazette notifications and is stated with the citations on which it rests, in line with the requirement that regulatory dates be independently verifiable rather than taken from secondary commentary.
- 11 August 2023: the DPDP Act (No. 22 of 2023) received Presidential assent.
- 3 January 2025: MeitY published the draft DPDP Rules for public consultation under Section 40(1) of the Act, inviting objections within forty-five days.
- 13 November 2025: MeitY notified the final DPDP Rules, 2025 vide Gazette Notification G.S.R. 846(E), and a companion notification, G.S.R. 843(E), brought specified provisions of the Act into force in stages.
- Per G.S.R. 843(E) and the Rules’ own commencement clause: Rules 1, 2, and 17 to 21 dealing principally with definitions and the Data Protection Board came into force immediately on notification. Rule 4 comes into force one year later. Rules 3, 5 to 16, 22, and 23 — which include the notice and consent provisions most relevant to cookies come into force eighteen months after notification, that is, on or about 13 May 2027.
- 10 December 2025: a corrigendum to the Rules was issued vide G.S.R. 892(E).
One further point deserves explicit flagging rather than silent adoption: at least one industry compliance guide, citing a MeitY stakeholder consultation reportedly held on 23 January 2026, has suggested that the eighteen-month timeline could be administratively shortened to twelve months. This has not, as of the date of this article, been confirmed by any Gazette notification, and it is treated here as an unconfirmed industry report rather than a change in law. Readers relying on this article for compliance planning should independently check the Gazette of India for any subsequent notification before treating any timeline as final.
Part III: Main Analysis — Interpretation, Industry Practice, and Their Limits
3.1 The Interpretive Bridge from “Personal Data” to Cookies :
Because the DPDP Act does not mention cookies, every claim that cookies are “regulated” by the Act rests on an interpretive bridge: that cookie-derived data, particularly from third-party advertising or analytics trackers, is capable of rendering a person identifiable, and is therefore personal data within Section 2(t). This bridge has been adopted as a working assumption by the Advertising Standards Council of India (ASCI), in a white paper co-authored with PSA Legal and Tsaaro Consulting and released on 28 January 2025, titled “Navigating Cookies: Recalibrating Your Cookie Strategy in Light of the DPDPA.” The white paper itself is candid about the limits of this bridge, stating in its own text that “there is no specific cookie law in India,” and that the DPDPA merely “provides the principles for granular consent to be obtained” language that frames the application to cookies as derived and interpretive, not as an express statutory command. The same caution applies to several law firm advisories publishing similar analysis. This is industry and professional interpretation, not a holding of the Data Protection Board or a court, and it should be read with that qualification attached every time it is relied upon in this article.
3.2 What the ASCI White Paper Itself Found — Read Directly, Not Through Secondary Reports :
The empirical claim most cited in discussions of Indian cookie compliance comes from the ASCI white paper’s own dipstick survey, reviewed here directly rather than through secondary press coverage. The survey examined India’s fifty most-visited websites by traffic, ranked by Semrush.com, accounting for over three billion visits in December 2024. Its finding, in the paper’s own words, is that “only 3 websites (6%) currently implement cookie consent banners,” meaning 97 per cent had no cookie consent banner at all. Secondary press reports of this finding restate the figure inconsistently as “3%” or “3 of 50” but the primary document is unambiguous, and this article relies on its text directly.
Two qualifications matter. First, the white paper analysed sites against the draft DPDP Rules of January 2025, noting itself that those rules were “still under consultation” with “a final version yet to be published” the final Rules followed ten months later, on 13 November 2025. Second, the paper’s own legal analysis treats granular cookie consent as something that “would” be required by the DPDPA’s principles, an interpretive extension of Sections 5(1)(i) and 6, not an express statutory command naming cookies. It would overstate the white paper’s own findings to describe the surveyed websites as having been in legal breach of the DPDP Act; the paper’s framing is that they were unprepared for requirements likely to apply, under rules not yet final, whose operative provisions in any event take effect only from May 2027.
3.3 Consent Design: What Section 6 Requires, and What Goes Beyond It :
Section 5(1)(i) of the Act requires that any request for consent be accompanied or preceded by a notice describing the personal data to be collected and the purpose of processing. Section 6 is settled law: consent must be free, specific, informed, unconditional, and unambiguous, indicated by clear affirmative action, and pre-ticked or bundled consent is invalid. The ASCI white paper relies on exactly these two provisions, read together, as the textual basis for its conclusion that granular cookie consent “would” satisfy the DPDPA’s specificity requirement a reasoned application of general consent provisions to cookies, not a cookie-specific rule. Rule 3 of the DPDP Rules due to come into force in May 2027 separately requires an itemised notice describing each category of personal data collected and the specific purpose for collecting it, in clear language apart from general terms of service.
Beyond this textual baseline, industry guidance including analysis published by Khaitan & Co has argued that Section 6 and Rule 3, read together, imply that consent for cookies should be sought separately for each distinct purpose, such as analytics versus advertising, with an opt-out no harder to use than the opt-in. This is a reasonable reading of the statutory language, but it is the law firm’s interpretation of how the principle should apply to cookies specifically, not a textual requirement that names cookies or prescribes a particular consent-banner design. A website could, in principle, argue that a different consent design also satisfies the statutory test of “specific” and “unambiguous” consent, and there is no published Board guidance yet confirming or rejecting any particular implementation.
3.4 Withdrawal of Consent: A Genuine Gap :
Section 6(4) settles that consent may be withdrawn at any time and that withdrawal must be no harder than giving consent. What is genuinely unclear and this article treats it as an open question rather than resolving it is what a Data Fiduciary must do about data already shared with third-party advertising or analytics intermediaries before withdrawal. Neither the Act nor the Rules specify a mechanism for compelling an intermediary, who may not itself be the Data Fiduciary the user dealt with, to act on a downstream withdrawal request. This is best described as an unaddressed gap in the current framework rather than a violation by any specific actor, since no provision yet squarely imposes such an obligation on intermediaries.
3.5 Children’s Data: The One Area of Clear, Unambiguous Statutory Text :
Section 9 of the Act, read with Rule 10 of the DPDP Rules, is the clearest provision in this entire framework as applied to tracking: it prohibits tracking, behavioural monitoring, and targeted advertising directed at children, without exception for consent, and requires verifiable parental consent before processing a child’s data at all. This is settled statutory text, not an interpretation, though like the rest of Sections 7 to 17 it does not come into legal force until the eighteen-month commencement date in May 2027 under the staged notification described in Part II.
3.6 Comparative Reference: GDPR Case Law as Persuasive Illustration Only :
Indian commentary on cookie consent frequently cites Planet49 GmbH v. Bundesverband der Verbraucherzentralen (C-673/17), in which the Court of Justice of the European Union held that pre-ticked cookie checkboxes do not constitute valid consent under the GDPR. The reasoning is conceptually useful for illustrating what “clear affirmative action” might mean in practice. It carries no binding or even persuasive authority in an Indian forum: the EU additionally has a dedicated ePrivacy Directive addressing cookies specifically, which has no Indian equivalent, and no Indian court or the Data Protection Board has had occasion to consider, let alone adopt, Planet49’s reasoning. It is cited here strictly for conceptual illustration.
Part IV: Critical Analysis and Evaluation
4.1 The Definitional Vacuum Is the Central Problem :
Every substantive conclusion in Parts II and III depends on the unresolved question of whether cookie-derived data renders a person “identifiable” under Section 2(t). The Act offers no definition calibrated to tracking technologies, and the Rules, despite running to twenty-three rules and seven schedules, do not fill this gap. Until the Data Protection Board addresses this question directly, every statement about whether a category of cookie “requires” consent including this article’s own discussion in Part III remains provisional. This is the single largest source of uncertainty in this area.
4.2 The Compliance Timeline Is Real, Not Speculative — But Its Implications Are Often Misstated :
Because Rules 3, 5–16, 22 and 23 do not take legal effect until on or about 13 May 2027, it would be inaccurate to describe websites currently lacking itemised cookie notices as presently in breach of those provisions; they are not yet in force against anyone. It is more accurate to describe the period until May 2027 as a compliance runway, during which the Board exists but the operative consent obligations do not yet bind. Conflating “not yet legally required” with “non-compliant” overstates the current legal exposure of website operators.
4.3 Persuasive but Non-Authoritative Sources Should Be Labelled as Such :
This article has relied on a white paper (ASCI), law firm advisories, and civil-society commentary. None carry the force of statute, regulation, or judicial or Board precedent. They are useful because they reflect how informed practitioners read a thin statutory text, and because the ASCI survey offers the only available empirical data on market practice verified here against the primary document itself. But they should not be cited as though they settle questions that remain legally open. Where this article uses such sources for a substantive conclusion, it has tried to mark the conclusion as interpretive rather than settled.
4.4 The Internet Freedom Foundation’s Critique :
The Internet Freedom Foundation, in a public statement following the 13 November 2025 notification, argued that the final Rules, despite a stated 6,900-plus public submissions on the draft, did not substantially incorporate civil-society input on independent oversight of the Data Protection Board or on definitional clarity. This is advocacy commentary rather than legal authority, and it is presented here as one informed perspective among others on the adequacy of the framework, not as a finding binding on any interpretive question.
Part V: Practical Guidance and Conclusion
5.1 For Website Operators: A Compliance-Oriented Checklist :
The following is offered as practical guidance reflecting current industry practice and the statutory direction of travel, not as a restatement of binding obligations that are already in force:
- Map your cookies by category and by the third parties who receive any data they generate, since this inventory is the necessary first step regardless of how the identifiability question is eventually resolved.
- Review existing privacy notices against the itemised-notice standard in Rule 3, even though that Rule is not yet in force, so that the eventual transition is not a last-minute exercise.
- Treat advertising and analytics cookies cautiously by building towards consent-based processing for these categories, since this is the more conservative reading of Section 4 if the Board later interprets “identifiable” broadly while recognising this is a risk-management choice, not a present legal mandate.
- Apply an absolute restriction on behavioural tracking of users known or reasonably suspected to be minors, since Section 9 and Rule 10 admit no consent-based exception once in force, and reflect a clear legislative intent that providers can reasonably anticipate now.
- Monitor the Gazette of India and Data Protection Board publications directly for the final word on any timeline change, rather than relying on secondary reporting of unconfirmed consultations.
5.2 For Individual Users: Practical Privacy Steps :
Until the framework’s consent provisions take legal effect, an individual user’s protection rests less on enforceable legal entitlement and more on their own choices and existing browser tools:
- Review cookie banners that do appear and decline non-essential categories where an option to do so exists, rather than defaulting to “Accept All.”
- Use browser-level privacy settings blocking third-party cookies or using private browsing modes as a present, self-help layer of protection that does not depend on any website’s compliance posture.
Where a website does collect identifiable data and the relevant DPDP provisions are in force, exercise the statutory rights to information, correction, and erasure under Sections 11 to 13 once those provisions take effect
5.3 Conclusion :
Indian law does not yet say, in so many words, what it requires of a cookie. What it says is that personal data may not be processed without a lawful basis, and the question of whether a given tracking technology produces personal data is left to interpretation that has not yet been tested before the body created to test it. The institutional steps taken since November 2025 the notified Rules, the constituted Board, the staged commencement timeline running to May 2027 are real and verifiable, and they represent genuine progress over the position that existed under the IT Act and SPDI Rules alone.
But progress in institution-building should not be mistaken for resolved law. The central uncertainty whether and which cookies render a person identifiable remains open, and most of what is written confidently about “mandatory” cookie consent in India, including some of the commentary this article has drawn on, is better understood as an informed prediction of how the law is likely to develop than a statement of how it presently stands. The most defensible position, and the one this article has tried to model, is to be precise about that distinction rather than to resolve it by assertion.
References and Citations
Primary Legal Sources :
- Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023), Sections 2(t), 4, 6, 7, 9, 11–13, 18–26.
- Digital Personal Data Protection Rules, 2025, Gazette Notification G.S.R. 846(E), dated 13 November 2025, Ministry of Electronics and Information Technology, Rules 1–4, 10, 17–23.
- Notification G.S.R. 843(E), dated 13 November 2025, Ministry of Electronics and Information Technology, regarding commencement of provisions of the DPDP Act, 2023.
- Corrigendum to the Digital Personal Data Protection Rules, 2025, Gazette Notification G.S.R. 892(E), dated 10 December 2025.
- Draft Digital Personal Data Protection Rules, 2025, Gazette Notification G.S.R. 02(E), dated 3 January 2025 (superseded by the final Rules).
- Information Technology Act, 2000, and Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
- Constitution of India, Article 21.
Case Law :
- Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, Supreme Court of India (Nine-Judge Bench).
- Planet49 GmbH v. Bundesverband der Verbraucherzentralen, Case C-673/17, Court of Justice of the European Union (2019) cited solely as comparative, non-binding illustration.
Industry and Institutional Commentary (Persuasive, Non-Authoritative) :
- Advertising Standards Council of India, PSA Legal, and Tsaaro Consulting, “Navigating Cookies: Recalibrating Your Cookie Strategy in Light of the DPDPA” (White Paper, January 2025), available at ascionline.in — cited and quoted directly from the primary document.
- Press Information Bureau, Government of India, release on the Digital Personal Data Protection Rules, 2025 (November 2025).
- Internet Freedom Foundation, public statement on the Digital Personal Data Protection Rules, 2025 (13 November 2025).
- Khaitan & Co, client advisory on cookie consent under the DPDP Act regime (2025).
- Shardul Amarchand Mangaldas & Co, client advisory, “Enforcement of the DPDP Act and Notification of the DPDP Rules” (November 2025).
- S. Rana & Co., client advisory, “MeitY Notifies Final Digital Personal Data Protection Rules 2025” (2025).
- PRS Legislative Research, “The Digital Personal Data Protection Bill, 2023: A Summary” (2023).
Author: Sanskriti Sanskriti
Law student