By country

Cookie Policy Generator India

The Digital Personal Data Protection Act 2023 and its Rules - consent notices, Consent Managers and verifiable parental consent.

Generate your cookie policy Read the cookie policy guide

India has no ePrivacy equivalent, so cookie obligations come from the DPDP Act’s consent model and the IT Rules’ disclosure duties. That makes the Indian cookie document a notice-and-consent artefact structured around purposes rather than a per-technology consent gate.

India’s Digital Personal Data Protection Act 2023 replaced the older IT Rules framework with a consent-centric statute. It applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India.

The Act is structurally different from GDPR. There is no legitimate interests basis: processing rests on consent or on a defined set of "legitimate uses". Notices must be standalone, plain, and available in English or any of the languages in the Eighth Schedule of the Constitution. A new intermediary role, the Consent Manager, is registered with the Data Protection Board.

The children’s rules are unusually strict. Verifiable parental consent is required for anyone under eighteen, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited outright rather than merely restricted.

What a cookie policy in India has to cover

Each tracking purpose stated as an itemised DPDP notice rather than a generic cookie list
Consent captured per purpose, with a withdrawal route as simple as the grant
The prohibition on tracking and behavioural monitoring where the user is under eighteen
Third-party tags and the parties receiving data through them
The grievance officer as the route for complaints about tracking

How India actually moves personal data

Consent notices as standalone artefacts

The DPDP notice cannot be buried in a longer policy - it must be a clear, standalone communication itemising the data, the purpose and the rights, presented alongside the request for consent.

Multilingual delivery

Data principals may require the notice in any Eighth Schedule language, which turns translation into a compliance obligation rather than a nicety.

Consent Managers

A registered intermediary through which people can give, manage, review and withdraw consent. If you integrate with one, that relationship needs describing.

Grievance redressal

Both the DPDP Act and the IT Rules require a route to raise a complaint with the business before escalating - the Act to the Data Protection Board, the Rules to a named grievance officer.

Cross-border transfers

Permitted by default except to countries the Government restricts by notification, which inverts the GDPR model of default prohibition with exceptions.

Third parties the draft will ask you about

Razorpay · PayU · Paytm · UPI rails · AWS ap-south-1 · Zoho · Delhivery · MSG91 · Google Workspace

The rules that apply

DPDP Act 2023

Consent or legitimate uses as the only bases, itemised notice requirements, and penalties up to ₹250 crore for failures to prevent a breach.

DPDP Rules

Operational detail on notice content, Consent Manager registration and obligations, breach reporting to the Board, and retention limits for classes of data fiduciary.

Verifiable parental consent

Required for all users under eighteen, with tracking and targeted advertising to children prohibited.

Significant Data Fiduciaries

A designation bringing extra duties: a Data Protection Officer based in India, independent audits and algorithmic due diligence.

IT Rules 2021

Intermediary obligations that continue to apply, including a published privacy policy, grievance officer and takedown timelines.

What the generated cookie policy contains

What the technologies actually are
Cookies, local storage, session storage, pixels, SDKs and server-side tags - the law covers storage and access on a device, not the word "cookie".
A per-cookie table
Name, provider, purpose, category and duration for each cookie, which is the format UK and EU regulators expect to see.
Category definitions
Strictly necessary, functional, analytics and advertising, with an honest explanation of why only the first runs without consent.
How consent was obtained and how to change it
The banner, the granular choices, and a permanent link to reopen preferences - the withdrawal route has to be as easy as the acceptance route.
Third-party cookies and onward use
Which providers set cookies through your site and what they do with the data once it is theirs.
Browser and device controls
Practical instructions, plus a note that blocking strictly necessary cookies will break parts of the service.

DPDP implementation order

Rebuild consent capture around itemised notices
One notice per purpose, standalone, in plain language, with a withdrawal route as easy as the grant.
Set the age gate to eighteen
And build a verifiable parental consent flow that does not itself over-collect.
Name a grievance officer and publish response times
Required by the IT Rules and expected under the Act’s redressal duty.
Assess whether you are a Significant Data Fiduciary
If designated, appoint an India-based DPO and schedule independent audits.
Plan for multilingual notices
At minimum English plus the languages of your largest user bases.

Where this usually goes wrong

Relying on legitimate interests

There is no such basis in the DPDP Act. A GDPR-shaped policy that leans on legitimate interests describes a basis Indian law does not recognise.

Age-gating at thirteen

The Indian threshold is eighteen, with verifiable parental consent below it. This is the widest child-protection band of any major regime.

Burying the notice inside the privacy policy

The Act requires a standalone, itemised notice presented with the consent request.

No grievance officer named

The IT Rules require the name and contact of a grievance officer to be published, with response timelines.

Behavioural advertising to under-eighteens

Prohibited, not merely consent-gated. Ad targeting stacks that rely on age-agnostic profiling are non-compliant by default.

Frequently asked questions

Does the DPDP Act apply to companies outside India?

Yes, where the processing relates to offering goods or services to data principals in India. Physical presence is not required.

Is there a legitimate interests basis in Indian law?

No. Processing rests on consent or on the enumerated legitimate uses - employment, emergencies, legal obligations and similar. The GDPR balancing test has no equivalent.

What is a Consent Manager?

A registered intermediary that lets people give, manage, review and withdraw consent across services through a single interface. It is a distinctive feature of the Indian regime.

What age counts as a child under the DPDP Act?

Under eighteen. Verifiable parental consent is required, and tracking and targeted advertising directed at children are prohibited.

Do I need a cookie policy as well as a privacy policy?

In the UK and EU, yes in practice. PECR and the ePrivacy Directive regulate storing and reading information on a device separately from GDPR’s rules on processing, and the per-cookie disclosure is too detailed to bury in a privacy policy.

Do analytics cookies need consent?

In the UK and EU, yes - the ICO has said repeatedly that analytics is not "strictly necessary". Some EU regulators allow a narrow exemption for first-party, non-shared audience measurement, but the default answer is consent first.

Does a cookie policy need updating when I add a tool?

Yes, and this is the clause that goes stale fastest. Every new tag, pixel or embedded widget adds cookies your table does not list. Scanning your own site on a schedule is the only reliable way to keep it honest.

What about cookies set by embedded video and maps?

They count. An embedded YouTube player or Google Map sets third-party cookies as soon as it loads, so either it loads only after consent, or you use a privacy-preserving embed mode and say so.