India has no cookie law. What it has, from 13 May 2027, is a personal data law that applies to cookies and trackers the same way it applies to a sign-up form. Here is what that means for the banner on your site.
Last reviewed · Sources: G.S.R. 843(E), G.S.R. 846(E), Lok Sabha Q.3960 (12 Aug 2026)
For most cookies, yes, from 13 May 2027. The DPDP Act never uses the word cookie, but a cookie or tracker that processes personal data is processing like any other, so it needs consent under sections 4 and 6 or a legitimate use under section 7. Cookies that identify no one are outside the Act.
The Act applies to digital personal data: data about an individual who is identifiable by or in relation to it. Many cookies carry an identifier that links a browser to a person, directly or once combined with other data. When they do, setting and reading them is processing, and processing needs a ground under section 4: consent, or one of the legitimate uses in section 7.
Where consent is the ground, the full section 6 standard applies: free, specific, informed, unconditional and unambiguous, by a clear affirmative action, preceded by a notice under section 5, and withdrawable as easily as it was given. The Data Fiduciary must be able to prove it under section 6(10).
The Act has no strictly necessary exemption by that name. Section 7(a) allows processing for a specified purpose for which the Data Principal voluntarily provided her data and has not objected, which may cover cookies needed to deliver what she asked for, such as a login session or a cart. Analytics and advertising cookies need consent.
| Category | What it does | Likely ground |
|---|---|---|
| Essential (session, login, cart, security) | Delivers what the person asked for | Likely Sec 7(a) legitimate use; disclose it |
| Preferences (language, region) | Remembers choices | Sec 7(a) where the person set it; otherwise consent |
| Analytics | Measures use of the site | Consent, where it identifies a person or device tied to one |
| Advertising and retargeting | Profiles for ads, often shared with third parties | Consent; never for children (Sec 9(3)) |
| Third-party embeds and pixels | Video, chat, social and ad pixels that set their own cookies | Consent, before the script loads |
The Board has issued no guidance on cookies. The "likely ground" column is our reading of the Act, not settled law.
Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, meaning anyone under eighteen, and consent does not lift the bar. Only the classes and purposes in the Fourth Schedule are exempt (Rule 12). A site that children use needs to switch off advertising and behavioural cookies for them, which in practice means knowing, through verifiable parental consent under Rule 10, who is a child.
For most cookies, yes, from 13 May 2027. The DPDP Act never uses the word cookie, but a cookie or tracker that processes personal data is processing like any other, so it needs consent under sections 4 and 6 or a legitimate use under section 7. Cookies that identify no one are outside the Act.
The Act has no strictly necessary exemption by that name. Section 7(a) allows processing for a specified purpose for which the Data Principal voluntarily provided her data and has not objected, which may cover cookies needed to deliver what she asked for, such as a login session or a cart. Analytics and advertising cookies need consent.
No. Section 6(1) requires consent to be free, specific, informed, unconditional and unambiguous with a clear affirmative action. Pre-ticked boxes, scrolling and continued browsing are not a clear affirmative action, and section 6(4) requires withdrawal to be as easy as giving consent.
This guide summarises the DPDP Act, 2023 and the DPDP Rules, 2025; the Gazette texts govern. This is informational and is not legal advice. Liability under the DPDP Act, 2023 remains with the Data Fiduciary.
