Modern websites collect far more information than many businesses realise. A visitor may generate data through cookies, analytics scripts, advertising pixels, session replay tools, device identifiers, contact forms, chat widgets and other tracking technologies. For businesses operating in India, website data collection compliance therefore involves more than publishing a privacy policy. Organisations need to understand what information their website collects, why it is collected, where it goes, who receives it and what legal framework applies. India does not currently have a separate cookie law comparable to the EU ePrivacy framework. The Digital Personal Data Protection Act, 2023 regulates digital personal data rather than cookies specifically. A cookie or tracking technology becomes relevant when the information involved falls within the scope of personal data and the processing is subject to the Act. Other laws may also apply depending on the website, business model, sector and users involved.

What Does Website Data Collection Include?

Website data collection covers much more than information entered into an online form. A website can collect information directly from visitors or generate information through technical systems operating in the background. Common examples include names, email addresses, telephone numbers, account details, purchase information and enquiries submitted through forms. Technical data may include IP addresses, browser information, device identifiers, session information, approximate location, referral information and interaction records. Tracking technologies add another layer. Cookies can remember preferences, maintain sessions or support analytics. Pixels can record page visits or conversions. Software development kits can collect information from websites and connected applications. Tag management systems can activate multiple third party technologies. Fingerprinting techniques may use combinations of browser or device characteristics to distinguish users. The legal question is therefore not simply whether a website uses cookies. Businesses should ask whether the technology processes information relating to an identifiable individual, what purpose it serves and whether the processing has an appropriate legal basis.

What Is the Indian Legal Position on Cookies?

The DPDP Act does not expressly regulate cookies by name. It is a technology neutral law focused on the processing of digital personal data. The Act defines personal data broadly as data about an individual who is identifiable by or in relation to such data. It also defines processing broadly enough to cover automated operations performed on personal data. This creates an important distinction. A cookie is not automatically unlawful simply because it exists. A strictly necessary session cookie used to maintain a secure login may have a different legal analysis from an advertising cookie used to build behavioural profiles across websites. Similarly, a basic technical identifier may not always present the same privacy implications as a tracker linked with an identified customer account. Businesses should assess the actual data flow rather than classify every cookie as either automatically lawful or automatically unlawful. This approach also means businesses should avoid copying a foreign cookie compliance model without analysing Indian requirements. The GDPR and ePrivacy rules may impose additional requirements for organisations targeting users in Europe. Indian compliance should be assessed separately.

Website Data Collection Compliance Under the DPDP Framework

The DPDP framework establishes obligations for Data Fiduciaries, meaning entities determining the purpose and means of processing personal data. A website operator will often be a Data Fiduciary for information collected through its own website. Where consent is the legal basis, Section 6 of the DPDP Act requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. Consent must relate to a specified purpose and be limited to personal data necessary for that purpose. The Act also gives Data Principals a right to withdraw consent, with the ease of withdrawal comparable to the ease of giving consent. This has practical implications for website tracking. A business should not assume a visitor has consented merely because the visitor opened a webpage. Similarly, a pre selected option does not provide the same level of affirmative choice contemplated by Section 6 where consent is being relied upon. However, it is equally important not to state that the DPDP Act requires consent for every form of website processing. Section 7 recognises certain legitimate uses. Depending on the circumstances, processing may therefore be permitted without relying on consent. The correct legal basis must be determined from the purpose and circumstances of the processing.

Do All Cookies Need Consent?

There is no simple rule under Indian law stating every cookie requires consent. Essential cookies may be required for functions such as authentication, security, shopping baskets or basic website operation. A website may have stronger grounds for using such technologies where processing is necessary for providing a requested service or falls within another lawful basis. Optional analytics, advertising, personalisation and behavioural tracking require more careful assessment. If these technologies process personal data and the business relies on consent, the consent mechanism should meet the statutory standard. Businesses should therefore maintain a cookie and tracker inventory. Each technology should be assessed according to its provider, purpose, data collected, retention period, recipients, geographical destination and legal basis. A practical cookie audit can reveal technologies installed by marketing teams, advertising agencies, developers and third party vendors without the knowledge of the legal or compliance team. This is one of the most important areas where technical governance and legal governance need to work together.

What Should a Compliant Cookie Notice Explain?

A cookie notice should be understandable to an ordinary website visitor. It should not hide important information inside lengthy legal wording. The notice should explain what categories of cookies or tracking technologies are used, why they are used and whether third parties receive information. Where consent is required, the user should have a meaningful opportunity to provide or refuse consent. The DPDP Rules, 2025 provide detailed requirements for notices, including clear and plain language, an itemised description of personal data and the specified purposes of processing. These requirements are scheduled to commence 18 months after publication of the Rules, which means businesses should build their notice architecture before the applicable provisions take effect. A good website should also make it easy for users to revisit their choices. If consent can be given through a simple interface but withdrawal requires navigating several pages or contacting customer support, the process may not reflect the statutory requirement for comparable ease.

Cookie Banners Should Not Use Dark Patterns

Cookie compliance is not only a privacy issue. Website design can also raise consumer protection concerns. The Central Consumer Protection Authority's Guidelines for Prevention and Regulation of Dark Patterns, 2023 prohibit specified deceptive interface practices and apply to platforms systematically offering goods or services in India, advertisers and sellers. A consent interface should therefore avoid manipulative design. For example, a website should not make acceptance highly prominent while making refusal difficult to find if the design is intended to undermine genuine user choice. Businesses should also avoid misleading statements such as suggesting optional tracking is essential when it is not. Clear design supports both privacy transparency and consumer autonomy.

Analytics, Advertising Pixels and Tracking Tags

Google Analytics, advertising pixels, social media tags, heatmaps, session replay tools and similar technologies can create complicated data flows. The first question is whether the technology collects personal data. The second is why it collects the information. The third is who receives it. A business may install an analytics service believing it only receives anonymous statistics. The actual configuration may involve identifiers, user IDs, IP related information, event histories or account linked data. Advertising technologies can be even more complex because information may be transmitted to external platforms for measurement, audience creation, attribution or advertising. Businesses should therefore assess the actual configuration rather than relying only on the vendor's marketing description.

Third Party Trackers and Vendor Governance

Website compliance often fails at the vendor level. Marketing teams may deploy a new advertising tag, chat tool or analytics plugin without considering the privacy consequences. Every third party technology should pass through an appropriate review before deployment. The review should consider the data collected, purpose, security arrangements, sub processors, international transfers, retention, deletion mechanisms and contractual terms. The contract should reflect the actual relationship. A technology provider may be a Data Processor for one activity while acting as an independent Data Fiduciary for another. The classification depends on who determines the purpose and means of processing. Businesses should also maintain a process for removing unused trackers. Old advertising tags and abandoned analytics tools can continue collecting information long after the relevant marketing campaign has ended.

Privacy Policies and Cookie Policies Are Not the Same

A privacy policy explains broader personal data practices. A cookie or tracking policy can provide more detailed information about technologies operating on the website. The documents can be integrated where appropriate, but they should provide enough information for users to understand relevant processing. A generic privacy statement saying a website “may use cookies” is unlikely to provide a useful explanation of a complex tracking ecosystem. During the transition to the DPDP framework, businesses should also consider existing obligations under the Information Technology Act and the Information Technology Rules concerning sensitive personal data where they remain applicable. The DPDP commencement schedule does not mean every previous privacy requirement disappeared immediately.

Security Is Part of Website Data Collection Compliance

Privacy compliance cannot be separated from information security. A website may collect relatively small amounts of information, but the risk can increase significantly when data is combined across analytics platforms, customer databases and marketing systems. The DPDP framework requires appropriate technical and organisational measures for protecting personal data. The 2025 Rules specify security measures such as safeguards relating to encryption, masking or tokenisation, access controls, logging, monitoring and backups, subject to the applicable commencement provisions. Businesses should therefore control access to analytics dashboards, tag management systems and customer databases. Former employees should not retain administrative access. Marketing platforms should be reviewed regularly. Tracking data should not be retained indefinitely without a defined business or legal reason.

What Happens If a Tracking Technology Causes a Data Breach?

A website breach can involve more than the main customer database. Compromised analytics accounts, advertising platforms, tag management systems and third party scripts can also expose personal data. Businesses should maintain an incident response process covering these systems. The organisation should know who investigates the incident, who preserves evidence, who assesses affected data and who determines applicable notification obligations. CERT In's cyber security directions require specified cyber incidents, including data breaches and data leaks, to be reported within six hours. The DPDP Rules also contain a separate personal data breach notification framework. Rule 7 requires notification to affected Data Principals without delay and detailed information to the Board within the prescribed period, subject to the Rule's commencement. These obligations can operate alongside sector specific requirements. A financial services company, healthcare organisation or regulated technology business may have additional incident reporting duties.

Cross Border Tracking and International Vendors

Many common website technologies involve overseas service providers. Analytics platforms, advertising networks, cloud services and customer engagement tools may process information outside India. The DPDP Act does not impose a blanket localisation requirement for all personal data. Section 16 allows the Central Government to restrict transfers of personal data to specified countries or territories through notification, while other Indian laws can impose additional restrictions. Businesses should therefore map where tracking information travels. The privacy review should identify the vendor, processing location, sub processors and contractual safeguards. Sector specific rules may create additional requirements.

What Businesses Should Do Before the DPDP Provisions Become Fully Applicable?

The best approach is to treat website privacy as an ongoing governance process rather than a one time cookie banner exercise. Start with a technical scan of the website. Identify cookies, pixels, scripts, SDKs, tags, local storage mechanisms and other tracking technologies. Record their purpose and provider. Then determine which technologies process personal data and identify the relevant legal basis. Next, review the privacy notice and cookie information. Make sure the language reflects actual website behaviour. Consent mechanisms should be designed around genuine choice rather than simply displaying a banner. The next stage is vendor governance. Review contracts with analytics providers, advertising platforms, hosting providers, customer relationship tools and other technology vendors. Confirm how data is used, where it is processed and how deletion and security are handled. Businesses should also document consent records where consent is relied upon. The record should allow the organisation to establish what was presented, what choice was made, when it occurred and whether the user later withdrew consent. For complex websites, organisations may benefit from independent legal review. privacy compliance lawyers can help connect the technical cookie inventory with applicable privacy obligations, contractual requirements and sector specific rules.

Technical implementation should then follow the legal assessment. A consent management system is useful only when its configuration reflects the organisation's actual legal and data processing position. Technology cannot compensate for an inaccurate privacy notice or an incorrect legal basis. Businesses should also establish internal ownership for website privacy. Legal, compliance, information security, technology, marketing and product teams may all influence website data collection. A defined governance process can prevent new tracking technologies from being introduced without privacy review.

Preparing for the 2026 and 2027 DPDP Timeline

Businesses should pay close attention to the phased commencement of India's new privacy framework. The DPDP Rules were notified on 13 November 2025. Rules 1, 2 and 17 to 21 commenced on publication. Rule 4 is scheduled to commence one year later, while Rules 3, 5 to 16, 22 and 23 are scheduled to commence 18 months after publication. The Act itself follows a corresponding phased commencement structure. For website operators, this means compliance planning should begin before the substantive requirements become operative. Organisations should use the transition period to understand their tracking ecosystem, correct privacy notices, review consent flows, assess vendors and establish evidence of compliance.

digital business lawyers can also assist businesses in reviewing website terms, technology contracts, digital business models and privacy responsibilities where website data collection forms part of a wider online operation.

Common Website Data Collection Compliance Mistakes

One common mistake is assuming a privacy policy automatically makes website tracking compliant. It does not. The technical configuration must match the statements made in the policy. Another mistake is treating all cookies as identical. Essential functionality, analytics, advertising and personalisation can have different purposes and legal implications. Businesses also frequently overlook third party scripts. A website may have only a few internally developed cookies but dozens of external technologies loading through marketing tags. Another issue is failing to maintain withdrawal mechanisms. Consent is not a permanent permission where the legal basis is consent. Businesses need a practical process for updating preferences and stopping processing where withdrawal applies. Finally, organisations sometimes focus entirely on DPDP compliance while ignoring other applicable requirements. Consumer protection, cybersecurity, sector specific regulations, contractual obligations and foreign privacy laws may all become relevant.

Conclusion

Website data collection is now a legal, technical and governance issue. Cookies are only one part of the wider tracking ecosystem. Pixels, analytics platforms, advertising tags, SDKs, session replay tools and other technologies can all influence a business's privacy obligations. For Indian organisations, the key is not to ask only whether a website has cookies. The better question is what information the website collects, why it collects it, how the information is used, where it goes and which legal basis supports the processing. The DPDP Act and Rules provide an important framework, but their phased commencement makes careful transition planning essential. Businesses should use the current period to audit website technologies, improve transparency, establish appropriate consent processes, review vendors, strengthen security and prepare evidence of compliance. A well designed website privacy programme should be accurate in law, practical in technology and understandable to users.

Frequently Asked Questions (FAQs)

Q1. Does Indian law require a cookie banner on every website?

No universal Indian rule currently states every website must display a cookie banner. The legal analysis depends on the data being processed, the purpose of processing and the applicable legal basis. Where personal data processing relies on consent, the consent mechanism should meet the requirements of the DPDP Act once the relevant provisions commence.

Q2. Does the DPDP Act specifically regulate cookies?

The DPDP Act does not specifically mention cookies. It regulates digital personal data and its processing. Cookies, pixels and other tracking technologies may therefore fall within its scope where they process personal data covered by the Act.

Q3. Are essential cookies exempt from consent?

There is no blanket statutory classification declaring every cookie labelled “essential” exempt. Businesses should assess whether the processing is necessary and whether another lawful basis applies. The purpose and actual operation of the cookie matter.

Q4. Is Google Analytics covered by data protection requirements?

Potentially. The answer depends on the configuration, information collected, identifiers used, purpose and recipients. Businesses should not assume analytics information is anonymous merely because the organisation uses it for statistical reporting.

Q5. Can a website use advertising pixels without consent?

The answer depends on the applicable legal basis and the nature of the processing. If personal data is processed on the basis of consent, the organisation must obtain valid consent before relying on that basis. Businesses should also consider applicable consumer protection and foreign privacy requirements.

Q6. Is a cookie policy legally required in India?

Indian law does not establish a standalone universal cookie policy requirement in the same manner as some foreign regimes. However, applicable privacy and transparency obligations can require businesses to explain their personal data processing. A clear cookie or tracking policy is often an effective way to provide this information.

Q7. Can users withdraw cookie consent?

Where consent is the legal basis, the DPDP Act provides for withdrawal of consent at any time, with ease comparable to the ease of giving consent. Businesses should design a practical preference management mechanism.

Q8. Are third party cookies more risky than first party cookies?

Not automatically. Risk depends on the data, purpose, technology, recipients and legal basis. Third party technologies can create additional governance challenges because information may be transferred to external providers.

Q9. Does the DPDP Act apply to website visitors outside India?

The territorial application depends on the circumstances described in the Act. Section 3 includes processing outside India in connection with offering goods or services to Data Principals within India. Businesses serving international users should separately assess the privacy laws of the countries concerned.

Q10. What should a business do if it discovers unknown trackers on its website?

The organisation should identify the technology and provider, determine what information is collected, assess the purpose and legal basis, review data transfers and contracts, and decide whether the tracker should remain. Unnecessary tracking technologies should be removed rather than simply hidden from users.

This update was released on 07 Oct 2026.

The views expressed in this update are personal and should not be construed as any legal advice. Please contact us directly on +91 22 40565252 or contact@mhcolaw.com for any assistance.

Legal Update Team
MANSUKHLAL HIRALAL & COMPANY
Advocates, Solicitors and Notaries
T: +91 22 40565252
Mumbai Office: Surya Mahal, 2nd Floor, 5, Burjorji Bharucha Marg, Fort, Mumbai-400 023, India
Delhi Office: Block C-9, Lower Ground Floor, Jangpura Extension, New Delhi - 110 014, India
www.mhcolaw.com

"Noted lawyer in the Real Estate practitioner from India" - Chambers & Partners

Please consider the environment before printing this email

The information contained in this communication is intended solely for the use of the individual or entity to whom it is addressed and others authorized to receive it. This communication may contain confidential or legally privileged information. If you are not the intended recipient, any disclosure, copying, distribution or action taken relying on the contents is prohibited and may be unlawful. If you have received this communication in error, or if you or your employer does not consent to email messages of this kind, please notify the sender immediately by responding to this email and then delete it from your system. No liability is accepted for any harm that may be caused to your systems or data by this message.