A client came to us last month convinced his business was DPDP compliant. Privacy policy? Done. Terms of use? Done. Then we asked him one question: “What does your cookie policy say?” Silence. Turns out he didn’t have one — just a generic “Accept Cookies” banner his web developer added two years ago, copied from some template site.
That gap is more common than you’d think, and it’s exactly the kind of thing that gets flagged in a compliance audit.
Cookies Aren’t Just a Technical Detail Anymore
Here’s the disconnect we see constantly. Business owners think of cookies as a web development issue — something for the IT person to handle. Legally, though, cookies that track, identify, or profile a user fall squarely under personal data. And personal data is exactly what the DPDP Act governs.
If your website uses Google Analytics, runs retargeting ads through Meta or Google, or even just remembers a visitor’s login across sessions, you’re processing personal data through cookies. That means the same consent principles that apply to a signup form apply here too — clear notice, specific consent, and a genuine way to withdraw it.
Skipping this isn’t a minor oversight. It’s one of the more visible gaps a regulator or a disgruntled visitor could point to, precisely because cookie banners are the first thing anyone sees on your site.
What a Compliant Cookie Policy Actually Requires
A cookie policy shouldn’t be legal boilerplate nobody reads. It needs to hold up if someone actually asks questions about it. Here’s what belongs in there.
A clear explanation of what cookies your site uses. Not vague language like “cookies to enhance your experience.” Actual categories — which cookies are strictly necessary for the site to function, and which ones exist for analytics, marketing, or personalization.
Named third parties. If you’re running Google Analytics, Meta Pixel, or any ad platform, say so explicitly. Under DPDP, transparency about who else is receiving a visitor’s data isn’t optional — it’s the whole point of informed consent.
A genuine consent mechanism. This is where most websites fall short. A banner that only offers “Accept” with no equal option to decline doesn’t count as informed consent. Visitors need a real choice, and non-essential cookies shouldn’t load before that choice is made.
A working withdrawal process. Consent that can’t be withdrawn isn’t valid consent. If someone accepts cookies today and wants to change their mind next month, there needs to be an actual, functioning way for them to do that — not just an assumption that they’ll never bother checking.
Retention details. How long is cookie data held before it’s deleted or anonymized? This should be stated, at least in general terms, rather than left open-ended.
A contact point. Someone should be reachable if a visitor has questions about how their data is being tracked and used.
The Mistake We See in Almost Every Audit
Business owners frequently install a cookie consent plugin, accept the default settings, and consider the job done. The problem is, plugins don’t know what your website is actually doing. If your site runs three tracking tools but your cookie policy only mentions “some cookies for analytics,” that mismatch is precisely the kind of gap that shows up in a compliance review — and it’s an easy one to miss until someone points it out.
A cookie policy has to reflect your actual website, not a generic assumption of what a website “usually” does.
Why This Matters More Now Than It Did a Year Ago
The DPDP framework in India is no longer sitting quietly in the background. The Data Protection Board is now operational, with the authority to investigate complaints and impose penalties. A cookie policy that doesn’t match reality is a small, fixable problem today. It becomes a much bigger one if it surfaces during an actual inquiry.
Bottom Line
A cookie policy is easy to overlook precisely because it feels minor compared to bigger compliance concerns. In practice, it’s often the first thing a visitor — or a regulator — actually looks at. Getting it right isn’t complicated, but it does need to reflect what your website genuinely does, not what a template assumes.
Not sure if your website’s cookie consent setup would actually hold up? Book a free compliance assessment with Nitin Digital and get a clear answer.