The DPDP Act Just Made Your Analytics a Compliance Question: Consent, Cookies and Tracking

India’s DPDP Rules, 2025 make cookies and tracking consent-driven — and there is no GDPR-style "legitimate interest" fallback. Behavioural analytics is now consent-gated. Here is what GA4, Meta pixels and your cookie banner must do to stay compliant.

30 June 2026 8 min read

Key Takeaways

The DPDP Rules, 2025 (notified November 2025) make cookies and tracking a consent-driven activity, with no "legitimate interest" basis like the GDPR.
Cookies, device IDs and analytics tokens count as personal data, so GA4 and pixels must load only after affirmative consent.
A banner alone is not proof — you must keep audit-grade consent logs (what was shown, what was chosen, when) for at least a year.

By Gautham MahadevanFounder & Principal Consultant · 7+ yrs experience

India's Digital Personal Data Protection regime just turned analytics into a compliance question. With the DPDP Rules, 2025 notified in November 2025, cookies and tracking became a consent-driven activity, and — unlike the EU's GDPR — there is no "legitimate interest" basis to fall back on (Countly). Behavioural analytics in India is now, in practice, consent-gated. If you run GA4, a Meta pixel or any tracker on a site used by people in India, this applies to you.

What does the DPDP Act actually require for tracking?

Consent must be free, specific, informed, unconditional and given by clear affirmative action (Mondaq). Websites must disclose each cookie's purpose — essential, functional, analytical or marketing — and let users reject non-essential cookies without losing core functionality. Pre-ticked boxes and "by using this site you agree" banners no longer count.

The scope is wide. Personal data includes device identifiers, behavioural data, cookies and analytics tokens — not just names and phone numbers. So even "anonymous" analytics that sets a client ID is in scope.

When do the rules take effect?

The rollout is staggered over ~18 months (India Briefing). The Data Protection Board was established on 13 November 2025; consent-manager registration opens 13 November 2026; and the core consent, notice and security provisions become enforceable around 13 May 2027. But the Board can already receive complaints and direct corrective action — so the runway is shorter than the 2027 date suggests. Build now, don't wait.

Why server-side and first-party data become the default

Because consent shrinks your client-side signal, first-party data and server-side collection become the resilient core of measurement (EY). When a chunk of visitors decline analytics cookies, you lean on logged-in data, CRM records and consented server-side events rather than scattershot third-party pixels. The DPDP shift rewards the same architecture privacy-first marketers were already moving toward.

The proof problem most businesses miss

A banner alone isn't compliance — you must be able to prove consent. In a dispute, the organisation has to show what notice the user saw, what they chose, and when (GoTrust). That means audit-grade consent logs, retained for at least a year. The common failure is "implementation drift": tags firing before consent is captured, which technically breaches the rule even with a banner in place.

What about grievances and breaches?

Two operational duties land on your website. You must publish a grievance officer's contact details (Rule 9), and you must report any personal-data breach to affected users and the Data Protection Board within 72 hours — whether or not damage occurred (India Briefing). Penalties are not automatic, but the Board can levy significant fines after investigation, so a documented process matters.

A practical DPDP-ready analytics checklist

Block non-essential tags until consent — load GA4 and pixels only after an affirmative "Accept".
Granular banner — separate Accept, Reject/Only-necessary and Manage-preferences; no dark patterns.
Log consent — store what was shown and chosen, with timestamps, for at least a year.
Easy withdrawal — keep "Cookie Settings" in the footer, as easy to use as giving consent.
Shift to first-party / server-side — reduce reliance on third-party cookies.
Publish a plain-language notice and a grievance-officer contact.

Want your tracking rebuilt so it's both DPDP-compliant and still gives you usable data? Our analytics team sets up consent-gated, server-side measurement, and you can talk to us about an audit of what your site fires today.

What to verify before acting on The DPDP Act Just Made Your Analytics a Compliance Question

Rules and platform behaviour change after an article is published. Confirm event definitions, conversion settings, consent mode, attribution reports, and data retention against the Google Analytics Help before you act on anything below, because the right answer depends on your entity, state, turnover, and current setup.

Going deeper: Marketing Dashboards.

Frequently asked questions

Does the DPDP Act apply to a small business website?

Yes. If you run a website or app used by people in India and you decide why and how personal data is processed, you are a Data Fiduciary under the DPDP Act — regardless of size. The Act also applies extraterritorially to foreign companies offering goods or services to Indian users. Because even basic analytics collects identifiers, it applies to almost every business with a website.

Can I still use Google Analytics under the DPDP rules?

Yes, but only with valid consent. There is no "legitimate interest" basis in the DPDP framework, so analytics is consent-gated. GA4 and similar tools must not fire until the user gives clear affirmative consent, the cookie purposes must be disclosed, and users must be able to reject non-essential cookies without losing core site functionality. Tags firing before consent is the most common breach.

When do the DPDP analytics rules take effect?

The rollout is staggered. The Data Protection Board was set up on 13 November 2025, consent-manager registration opens around 13 November 2026, and the core consent, notice and security provisions become enforceable around 13 May 2027. However, the Board can already receive complaints and direct corrective action, so businesses should implement consent properly now rather than wait for 2027.

What records do I need to prove consent?

You must be able to demonstrate that notice was given and valid consent obtained — a visible banner is not enough on its own. Keep audit-grade logs of what notice the user saw, what they chose, and when, retained for at least one year. You also need to publish a grievance officer’s contact details and report any personal-data breach to users and the Board within 72 hours.