DPDP Act for Marketers: Consent, Cookies and Analytics

Consent decides which tags fire — and the DPDP timeline that decides when you need it working.

Most Indian marketing stacks were built on an unspoken assumption: if a visitor didn't object, you could collect. The Digital Personal Data Protection Act flips that to: collect for a stated purpose, with consent, and stop when the purpose ends.

That touches every layer of the stack we describe in our marketing analytics guide — the tags that collect, the pixels that feed ad platforms, the CRM that holds leads, and the reports built on all of it. The pillar gives the summary; this page is the working detail.

What is the DPDP Act, and where do the Rules fit?

The Digital Personal Data Protection Act, 2023 is India's first standalone data protection law. It applies to personal data that is collected digitally, or collected offline and then digitised, and it defines personal data as "any data about an individual who is identifiable by or in relation to such data" (Act text, MeitY, Section 2(t)).

An Act needs Rules to operate. The DPDP Rules, 2025 were notified on 14 November 2025, and the government's own summary describes "an eighteen-month period for phased compliance" (PIB summary of the Rules).

The phasing matters because it tells you what is a deadline and what is merely a start date:

• From notification (November 2025): the Data Protection Board of India is set up — a "fully digital" four-member body that takes complaints online (PIB).
• At 12 months (November 2026): the consent manager framework becomes operational, per DLA Piper's India chapter.
• At 18 months (May 2027): "all other substantive provisions", including the compliance obligations that touch your website and CRM, take effect (DLA Piper).

Two people will read those dates differently. A lawyer sees May 2027 as the date obligations bite. A marketer should see it as the date by which every tag, form and list already has to be working the new way — and tag changes take longer than anyone budgets.

What counts as personal data on a marketing website?

Anything that identifies a person, or can be combined with other data to identify them, is in scope. On a typical Indian business site that includes far more than the contact form.

One honest caveat before the table: the Act does not mention cookies by name. DLA Piper's chapter notes there is "no regulation of cookies, behavioural advertising, or location data" as specific categories — the question is always whether an individual is "identifiable by or in relation to" the data. Whether a bare GA4 client ID crosses that line is something your counsel should decide; a form submission or a hashed email sent to a pixel plainly does.

What must a consent notice say?

The Act sets the standard: consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", limited to data necessary for the stated purpose (Act, Section 6(1)). The Rules turn that into the notice itself.

PIB's summary is blunt: "Every Data Fiduciary must issue a separate consent notice that is clear and easy to understand" and it must "explain the specific purpose for which personal data is collected and used". Taxmann's analysis of Rule 3 lists what that notice carries:

• An itemised description of the personal data being collected — not "your information".
• The specified purpose, and the goods or services that purpose enables.
• How to withdraw consent — and withdrawal has to be as easy as giving it (Act, Section 6(4)).
• How to complain to the Data Protection Board.
• Standalone presentation — understandable "independently of any other information", which rules out burying it in a 4,000-word privacy policy.

In marketing terms: "Accept all" with a link to a policy is not a notice. A short panel that says what you collect (analytics identifiers, ad identifiers, form details), for what (measuring the site, measuring ads, replying to your enquiry), with separate toggles and a withdraw link in the footer, is much closer.

Section 7 of the Act does allow processing of data a person volunteered for the purpose they volunteered it for, without a fresh consent step, as long as they haven't objected. A clinic replying to an appointment enquiry is on that ground. Adding that same person to a promotional WhatsApp broadcast is a different purpose — and a different consent.

What is a consent manager, and why must it be Indian?

A consent manager is a registered intermediary through which a person can give, review and withdraw consents across many companies from one place. PIB states they "must be companies based in India", and the framework goes live at the 12-month mark (DLA Piper). Sansa Legal notes registration with the Board and a minimum net-worth requirement for these entities.

Do not confuse this with your cookie banner. A consent management platform (the banner tool) is a piece of software you run on your site. A DPDP consent manager is a regulated entity registered with the Board. Your banner vendor is not automatically the latter, and as of this writing we could not verify any registered list — ask the vendor directly and ask counsel what, if anything, you must integrate with.

What rights do your visitors get, and what does your stack have to do?

The Act gives every data principal — the person — the right to access their data, correct and update it, seek erasure, nominate someone to act for them, and withdraw consent at any time (Act, Sections 12–13; PIB). The Rules put a clock on it: fiduciaries must "address all requests within a maximum of ninety days" (PIB).

Ninety days sounds generous until you try to answer "what do you hold about me?" across GA4, a Meta custom audience, HubSpot, a Google Sheet the sales team exports every Friday, and a WhatsApp broadcast list on someone's phone. The operational task is knowing every copy.

• Map the copies. One list of every system that stores a lead: form tool, CRM, email platform, ad-platform audiences, spreadsheets, agency dashboards.
• Name an owner and an inbox. Requests will arrive by email and WhatsApp, not through a form you designed.
• Test an erasure end-to-end. Delete one test record and confirm it is gone from every copy, including the uploaded ad audience.

What happens when data leaks?

Two clocks run at once. Taxmann's reading of the Rules: the Board must be notified within 72 hours of becoming aware of a breach, and affected people must be told "without delay", in plain language, with the impact and the remedial steps (PIB; DLA Piper).

The Act's Schedule sets the ceilings, as reproduced by PIB: up to ₹250 crore for failing to maintain security safeguards, up to ₹200 crore for failing to notify a breach, and up to ₹50 crore for other violations. Those are maximums the Board can impose, not tariffs — but they are the reason a shared lead sheet with "anyone with the link" access is now a board-level risk, not a sales-team habit.

What changes in practice: the banner and Google Consent Mode

A consent notice is the interface. Something still has to tell your tags what the visitor chose. On Google's stack that mechanism is Consent Mode, which "lets you communicate your users' cookie or app identifier consent status to Google. Tags adjust their behavior and respect users' choices" (Google Analytics Help).

Be clear about what it is and isn't. Consent Mode was built around Google's EU user consent policy and its November 2023 update was framed for traffic in the European Economic Area (Google Tag Platform docs). It is a product feature that helps Google's tags honour a choice. It is not an Indian legal requirement, and it is not a consent notice — you still need the notice and the banner. Its usefulness for an Indian site is that it gives you a tested, one-switch way to make GA4 and Google Ads respect what the visitor said.

What the tags actually do, per Google's docs:

• Consent signals: ad_storage (advertising cookies), analytics_storage (analytics cookies), ad_user_data ("sending user data related to advertising to Google") and ad_personalization ("personalized advertising").
• Basic implementation: "Google tags blocked until consent is granted" — nothing fires, nothing is modelled.
• Advanced implementation: tags load before the dialog and "send cookieless pings when cookie consent declined"; that data "is used for behavioral and conversion modeling, to fill the gaps".
• When ad_storage is denied: "new cookies won't be set for advertising purposes" — but the ping still carries "the full page URL, including any ad click information in the URL parameters".
• Region-specific defaults: the default command accepts a region list, so you can set denied-by-default for India while leaving other markets as they are; wait_for_update holds tags for a few hundred milliseconds while the banner loads.

Whether advanced mode's cookieless pings are acceptable under a purpose-limited Indian notice is exactly the kind of question for counsel, not for us. Where teams choose basic mode, plan for the consequence: fewer sessions, fewer attributed conversions, and a visible step down in every report the week you switch. Annotate it in GA4 so nobody "fixes" it in six months.

The plumbing lives in Tag Manager — consent settings on each tag, and the banner's update call — which we cover in our Google Tag Manager guide; the property side is in our GA4 setup guide. Meta's Pixel has its own consent handling and the Conversions API does not exempt you — server-side sending is still collection, and our server-side tracking guide says so plainly. For a Meta-specific walkthrough see our Meta Pixel and Conversions API guide.

This is the part most businesses ask us to handle inside a performance marketing engagement: rebuilding the tag layer so consent, GA4 and the ad platforms agree, and then re-baselining the numbers.

Email, WhatsApp and the lead data you keep

Retention is where marketing teams are most exposed, because leads never get deleted. Section 8(7) of the Act requires erasure once the specified purpose is served or consent is withdrawn, unless a law requires you to keep it. The Rules put the same idea as ceasing retention when "it is reasonable to assume that the purpose... is no longer being served" (DLA Piper).

The Third Schedule adds hard numbers for very large platforms only — e-commerce with 2 crore or more registered users, social media at the same threshold, online gaming at 50 lakh — where three years of inactivity triggers erasure, with 48 hours' notice to the person first (Taxmann). Most readers of this page are nowhere near those thresholds. The principle still applies; only the fixed clock doesn't.

A workable posture for a coaching institute or D2C brand, subject to counsel:

• Enquiry leads that never converted: define a purpose window (say, the admissions cycle), then delete or anonymise.
• Newsletter and WhatsApp marketing: consent specific to marketing, collected separately from the enquiry; opt-out in every message; a suppression list so a withdrawn number is never re-imported.
• Ad-platform customer lists: refresh from the CRM on a schedule, so withdrawals actually leave the audience.
• Children: "verifiable consent from a parent or guardian is required" (PIB) — EdTech and gaming teams collecting student data should treat this as a product decision, not a banner tweak.

The upside: first-party data you were given on purpose

Every constraint above pushes in one direction — toward data people hand you knowingly. Purchase history, a phone number given to get a quote, an email given for a price list. That data is consented, purpose-bound and yours; no browser change or platform policy takes it away.

We keep that strategy on its own page rather than repeat it here: first-party data: why it matters covers how to collect it, store it and activate it. This page's job is to make sure the collection is lawful.

A marketing team's compliance-prep checklist for the window

Work through this with counsel reviewing the outputs, not just the plan. Most of it is inventory and plumbing — the kind of work that fits comfortably in the window if you start now and not at all if you start in April 2027.

1. Inventory every tag and pixel. Open Tag Manager and list each tag, what identifiers it sets, and which vendor receives them — GA4, Google Ads, Meta, LinkedIn, Clarity, chat widgets. Anything you can't explain, pause.
2. Inventory every place a lead lives. Form tool, CRM, email platform, WhatsApp lists, ad audiences, spreadsheets, agency dashboards. One row per system, with an owner.
3. Write the purposes in plain language. "Measure how the site is used", "measure our ads", "reply to your enquiry", "send offers by email/WhatsApp". Each is a separate purpose with a separate consent.
4. Draft the notice with counsel. Itemised data, purpose, withdrawal route, complaint route — standalone, not a policy link. Put the same text at the banner, the form and the WhatsApp opt-in.
5. Wire the banner to the tags. Set consent defaults (with a region list if you serve other markets), connect the banner's update call, and set consent settings on every tag in Tag Manager. Decide basic versus advanced Consent Mode with counsel's view in writing.
6. Re-baseline the reports. Note the switch date in GA4 and your dashboards; expect a step change; compare like with like afterwards.
7. Build the request and breach runbooks. One inbox for access/correction/erasure, a 90-day tracker, an erasure script that hits every system in step 2, and a breach contact tree that reaches the Board within 72 hours.
8. Set a retention rule and run it. Purpose windows per list, a suppression list for withdrawals, a monthly job that deletes or anonymises what has aged out — and a log that shows you did.

Where to go from here

Treat the compliance window as a tracking rebuild with a legal reviewer, not a legal project with a tracking footnote. The teams that do this early get a cleaner tag layer, a first-party data set they can defend, and reports that survive the switch. The teams that wait get a banner installed in a hurry and a quarter of unexplained "traffic drops".