DPDP website audit: see what your site collects before consent
Start with a free check of your homepage, or have the whole site audited by a person against our checklist.
Written by Shuruthi Sellamuthu. Last reviewed .
What does a DPDP website audit check?
A DPDP website audit checks which cookies and tags load before consent, whether the banner offers a real choice, whether tags stop when a visitor changes their mind, how forms ask for consent, and whether the privacy and cookie policies match what the site really does.
Three ways to audit your website
| What is compared | Free Check | Website Audit Recommended | Advanced Audit |
|---|---|---|---|
| Price | ₹0 | ₹4,999 | ₹14,999 |
| Checks | 5 | 15 | 20 |
| Scope | Homepage | Whole site, public pages | Whole site plus your tag setup |
| Access we need | None | None | View access to Google Tag Manager and your consent platform |
| You get | One-page summary by email | PDF report with fixes by priority | PDF report, tag inventory sheet and a 45-minute walkthrough |
| Turnaround | 2 working days | 3 working days | 5 working days |
| Limits | 1 homepage | 1 domain, up to 25 pages and 5 forms | 1 domain, up to 50 pages and 10 forms |
| Actions | Check my website | Order the Website Audit | Order the Advanced Audit |
Both paid audits are credited against Implementation if you book within 30 days. GST extra where applicable. See full DPDP pricing.
Want it fixed, not just checked?
You can go straight to Implementation. Every plan includes the Website Audit, then we set up the banner, tag gating, form consent and policy drafts, and test them. From ₹39,999.
The 20 checks
5 checks on your homepage
- A banner shows on the first visit.
- Accept and Reject are offered with equal weight.
- No analytics or marketing cookies or tags load before a choice.
- There is a visible way to reopen and change choices.
- Homepage forms carry a notice, a privacy policy link and an unticked checkbox.
10 more checks across the whole site
- Cookie categories can be chosen separately, with only strictly necessary switched on.
- Reject is honoured across pages and on return visits.
- Switching from Accept to Reject stops the tags.
- Embedded video, maps, chat and booking widgets wait for consent.
- Banner wording is plain, names the purposes and links to the cookie policy.
- Every form asks only for what it needs, and says what, why and how to withdraw or complain.
- Consent checkboxes are unticked and separate from the Terms, with marketing optional.
- The privacy policy covers data, purposes, recipients, retention, rights and complaints, with a published contact.
- The cookie policy table matches the cookies really found.
- If the site is aimed at under-18s, there is no tracking or targeted advertising (DPDP Act Section 9(3)).
5 more checks with access to your tag setup
- Every tag in Google Tag Manager is tied to a consent type, with the default set to denied.
- No tracking scripts are hard-coded outside Google Tag Manager.
- Google Consent Mode v2 passes the right signals to Google tags.
- The consent log is recording, with the banner version, and can be exported.
- The tools receiving personal data match what the privacy policy says.
How we test a website
Before we ask for any access, we test what every visitor can see.
-
The banner We open the site as a new visitor. Does a banner appear? Does it show Accept and Reject with equal weight, and cookie categories the visitor can switch on or off?
-
Tracking before consent This is the check that matters most. We watch what loads before any choice is made. No analytics or marketing cookie should be set until the visitor says yes.
-
Changing your mind After accepting, can the visitor reopen the choices and switch to Reject? When they do, the tags must stop.
-
Forms We look at what personal data each form collects, whether a notice and privacy policy link sit next to it, and whether the consent checkbox starts unticked.
Then, with access, we go deeper. We check how each tag is set up in Google Tag Manager and the consent platform, and which tools receive visitor data such as IP address, email and other identifiers. We read the privacy policy, cookie policy and terms against what the site really does, and where they do not match, we help rewrite them.
We use scanning tools to collect the evidence, but a person checks every result against our checklist. A wrong marketing tag costs you some data. A wrong consent setup is a legal problem, so we do not leave it to a scanner.
What the report looks like
- A one-page summary: what is fine, what is not
- Findings by priority: high, medium and low
- Evidence for each finding: a screenshot of what loaded and when
- The fix for each finding, written so your developer or agency can act on it
The Advanced Audit adds a tag inventory sheet and a 45-minute walkthrough call.
Free DPDP website check
Send us your website. We run the five homepage checks and email you a one-page summary within two working days, with the three most important fixes.
- 5 checks
- 2 working days
- No call and no card
What an audit is not
It is not a legal opinion, not a compliance certificate and not a DPO review. It covers the website only: banner, tags, forms and policy pages.
DPDPWeb works on websites only: cookie banners, form consent, and privacy and cookie policy pages. We are not a DPO service and not a law firm. Nothing on this site is legal advice.
Audit questions
What access do you need?
None for the Free Check and the Website Audit. They test what any visitor can see. The Advanced Audit needs view access to Google Tag Manager and your consent platform. We never need your CRM.
How long does it take?
2 working days for the Free Check, 3 for the Website Audit and 5 for the Advanced Audit.
Is this a legal audit?
No. It is a technical audit of the website. We show what the site does and where it falls short of the notice and consent rules in the DPDP Act. Your legal contact decides what it means for the company.
Can our own developers do the fixes?
Yes. Each finding comes with its fix, written so a developer or agency can act on it. Or we can do it for you as an Implementation, with the audit fee credited.
Is the free check really free?
Yes. No call and no card. We send the result and a few follow-ups about it, which you can stop at any time. Updates and offers on other services come only if you tick the box.
Do you audit mobile apps?
No. We work on websites only.
What if we have several domains?
Each domain is one audit. Write to us for a group quote.
Know your gaps before 13 May 2027
Start with the free check, or order the Website Audit for the whole site.