Cookie banner
A banner with Accept and Reject at equal weight, separate choices for analytics and marketing, and tags that wait for a yes. We connect it to Google Tag Manager so the visitor's choice is actually respected.
See the cookie banner setup
Website consent under the DPDP Act
DPDP website compliance: cookie banner, forms and policies, set up and tested
We set up DPDP consent on websites that serve people in India and prove it works: no tracking before a yes, and tags that stop when a visitor changes their mind.
- 13+years in web and data analytics
- 30+enterprise teams across India, the US and the UK
- The team holds OneTrust, Google Analytics and Google Tag Manager certifications
- From the team behind Waftr (a global web analytics company)
What does the DPDP Act mean for a website?
Under the Digital Personal Data Protection Act, 2023 (the DPDP Act, also written DPDPA), a website that collects personal data of people in India must give a clear notice, get consent before any non-essential tracking, let people withdraw consent as easily as they gave it, and be able to prove that consent was given. These duties apply in full from 13 May 2027.
Source: DPDP Act, 2023, Sections 5 and 6. DPDP Rules, 2025, Rule 3. Last reviewed .
Read the website guide to the DPDP ActWhat we see on Indian websites today
Most Indian websites we look at have no cookie banner at all, while analytics and advertising tags load as soon as the page opens. Most of the rest show a banner with a single Accept All button. Very few offer Accept and Reject side by side.
Both groups have the same job to do before the DPDP Act duties apply in full on 13 May 2027. A banner needs a Reject button that is as easy to press as Accept. It needs choices: strictly necessary cookies stay on, and the visitor decides on analytics, marketing and the rest. And it has to appear before anything is tracked.
Check your site freeTry it yourself
A banner that shows is not a banner that works
The common setup goes like this. Someone places the script, clicks Accept once, and tells the client, "See, it is working."
That is not how it works. The real test is what happens when a visitor says no, or changes their mind. If someone moves from Accept to Reject, Google Analytics and the marketing tags must stop firing straight away.
We call this the Accept-to-Reject test. We run it on every tag and show you the result.
See how we test your tags
Demo. It does not scan your website.
Tags running on this page
- Google Analytics Running
- Meta Pixel Running
- Google Ads Running
Running without a yes
Nobody has chosen yet, but three tags are already tracking.
- Nothing before a choice Fail
- Starts on Accept Not tested yet
- Stops on Reject Not tested yet
Try it. Press Accept or Reject in the banner.
Three things we fix on your website
Form consent
A short notice below every form that says what you collect and why, with an unticked consent checkbox and a visible privacy policy link.
See the form consent setupPrivacy policy and cookie policy
We draft both from what your website really collects. Your legal contact approves the final wording.
See the policy drafting serviceThree ways to start: free check, audit or implementation
Free website check
₹0
5 checks on your homepage. One-page summary by email in 2 working days.
Check my websiteDPDP Website Audit
₹4,999
15 checks across the whole site. PDF report with fixes by priority, in 3 working days.
See DPDP website audit levelsDPDP Website Implementation
from ₹39,999
Banner, tag gating, forms and policy pages, set up and tested. Setup in about two weeks.
See DPDP website implementationMonthly Care plans from ₹4,999 keep the setup accurate as your site changes. View full pricing
We set up the banner and the tags together
We work in Google Tag Manager and Google Analytics every day, so the banner and the consent mode and tag gating are configured as one job.
A person checks everything
We use scanning tools to collect the evidence, but a person checks every result against a 20-point checklist. A wrong marketing tag costs you some data. A wrong consent setup is a legal problem, so we do not leave it to a scanner.
We stay on the website
Your DPO, legal team or privacy consultant looks after the company-wide side. We handle the website: banner, forms and policy pages.
From first check to handover in four steps
Setup takes about two weeks. Policy sign-off depends on your legal team and usually adds two to four weeks.
Book a free call-
Check We test your site the way a visitor sees it.
-
Plan We agree the fixes and the notice wording with your team.
-
Set up Banner, tags, forms and policy pages.
-
Test and hand over Every choice tested, with a report you can keep.
Consent work we have delivered
Our team has set up consent and tracking for SaaS, fintech and ecommerce websites, from startups to enterprise teams.
The team holds OneTrust, Google Analytics and Google Tag Manager certifications.
Key DPDP dates for your website
| Date | What happens |
|---|---|
| Rules notified. Data Protection Board established. | |
| Consent Manager registration starts. | |
| Notice, consent, rights and penalties apply in full. |
Notice and consent failures carry a penalty of up to ₹50 crore. That is a maximum set in the Schedule to the DPDP Act. The Data Protection Board decides the amount.
Source: DPDP Rules, 2025, Rule 1. Schedule to the DPDP Act, 2023.
Check where your site standsWhat we do and what we do not do
We do
- Cookie banner and tag gating in Google Tag Manager
- Form notices and consent checkboxes
- Privacy policy and cookie policy drafts, for your legal contact to approve
- Testing, with evidence you can keep
We do not
- Act as your Data Protection Officer
- Give legal opinions
- Work on mobile apps
- Touch CRM, HR or back-office data
- Run security audits
A banner alone does not make a company compliant with the DPDP Act. DPDPWeb takes care of the website side: cookie banner, form consent, and privacy and cookie policy pages.
DPDP website questions, answered
Does the DPDP Act require a cookie banner?
Not by name. The DPDP Act has no cookie-specific rule. But if your website uses analytics or advertising cookies linked to a person, that is processing personal data, and it needs consent first (Section 6). A cookie banner is how a website asks for that consent. A site with no such trackers does not need one.
Does the DPDP Act apply to my website?
Yes, if your website collects personal data of people in India, such as names, emails, phone numbers or cookie IDs linked to a person. The DPDP Act also applies to companies outside India that offer goods or services to people in India (Section 3).
When is the DPDP Act deadline for websites?
13 May 2027. That is when the notice, consent, rights and penalty provisions of the DPDP Act apply in full, 18 months after the DPDP Rules were notified on 13 November 2025. Consent Manager registration opens earlier, on 13 November 2026.
What are the penalties under the DPDP Act?
Up to ₹50 crore for notice and consent failures, and up to ₹250 crore for failing to keep personal data secure. These are maximums in the Schedule to the DPDP Act. The Data Protection Board decides the amount after hearing the company.
Is an email address personal data under the DPDP Act?
Yes. Under the DPDP Act, personal data is any data about an individual who can be identified by it (Section 2(t)). Name, phone number and email address count in the same way as PAN or Aadhaar. A simple contact form needs the same care as a KYC form.
How long does DPDP website implementation take?
About two weeks for the website setup on a typical site. Privacy and cookie policy sign-off depends on your legal team and usually adds two to four weeks.
What does a DPDP website audit or implementation cost?
The free website check is ₹0. Audits are ₹4,999 and ₹14,999. Implementation starts at ₹39,999 for a small site. DPDPWeb prices are in INR, with GST extra where applicable. The consent platform licence is paid by you directly to the platform. See full pricing
Is DPDPWeb a law firm or a DPO service?
No. DPDPWeb works on websites only: cookie banners, form consent, and privacy and cookie policy pages. We draft policies from what your site really collects, and your legal contact approves them. Nothing we provide is legal advice.
Free website check
Find out what your website does before consent
Send your URL. We run five checks on your homepage and email you a one-page summary within two working days. No call needed.
Check my website- 5 checks
- Homepage only
- 2 working days
- No call needed
Demo. It does not scan your website.
Tags running on this page
-
{{ t.name }}
{{ t.word }}
{{ status }}
-
{{ c.label }}
{{ c.word }}
{{ foot }}