Ahead of the roll out of the Digital Personal Data Protection (DPDP) act, the Advertising Standards Council of India (ASCI) Academy has released a report along with PSA Legal and Tsaaro Consulting to help brands navigate cookies post the implementation of it.

According to the report, currently only three websites among the top 50 in December 2024 (accounting for more than three billion visits) implement cookie consent banners, underscoring a significant gap in compliance readiness.

Among the websites that offer banners, they fall short of best practices, requiring improvements such as providing clear opt-out options and enabling users to give consent to use different types of cookies. 

Cookie consent management refers to a structured framework of systems and regulations that ensure organisations obtain valid, informed consent from users before storing or processing their data through cookies. 

While there is no specific cookie law in India, the DPDPA provides the principles for consent to be obtained from users in cookie banners and privacy statements. Since cookies collect and store information, they would require consent in line with sections 5 and 6 of the DPDPA. Every request made to a data principal for consent must be accompanied or preceded by a notice given by the data fiduciary informing the personal data collected and the purpose for which the same is proposed to be processed. 

This is similar to the General Data Protection Regulation (GDPR) requiring that the data subject be informed about each purpose for which their data is being processed before providing consent.

According to Europe's cookie laws, users must be given the opportunity to refuse cookies, particularly when privacy sensitive information is at stake, be informed about the purpose and nature of stored data, have user-friendly methods to give consent or refuse cookies, be allowed conditional access to website content if cookies serve legitimate purposes.