Consent Banner
A pop-up or bar on a website or app that asks visitors for permission to use cookies and trackers.
A consent banner is the pop-up or bar on a website or app that asks visitors whether they allow cookies and similar trackers. Under the DPDP Act, a banner works only if it gives a real choice and the tracking waits for the answer.
Meaning of Consent Banner
The Act does not mention cookie banners, but trackers and ad identifiers collect personal data, so consent rules apply to non-essential tracking. A valid banner lets people refuse as easily as accept, loads trackers only after consent and records the choice.
The DPDP Act does not mention cookie banners, but a banner is simply where consent for tracking is usually collected. When cookies, SDKs or pixels collect data that relates to an identifiable person, such as an advertising ID, device fingerprint or logged-in browsing history, that is personal data. Non-essential tracking therefore needs a lawful ground, and for most private organisations that means consent under Section 6, requested with a notice under Section 5.
A banner meets Section 6 only if its design does. The consent must be free and unambiguous, and given by a clear affirmative action. In practice that means non-essential scripts do not fire before the visitor chooses; there is a refuse option as visible and as easy as the accept option; categories are separated, for example analytics and advertising; and a link to change the choice later is always available. Closing the banner, scrolling or clicking elsewhere on the page is not agreement.
Content matters too. The banner should say, in plain language, what is collected, for what purposes and by whom, with a link to the fuller notice and the means to complain to the Board. It should offer English or an Eighth Schedule language, in line with Section 5(3) and Section 6(3). Essential cookies, such as those that maintain a login session, security tokens or a shopping cart, usually do not need a choice, but should still be described.
Banners overlap with children's rules. Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, so a site aimed at under-18s cannot use a banner to obtain permission for those practices. Banners are also different from the privacy notice: the banner is the gateway, and the notice carries the detail.
Examples of Consent Banner
A news site loads analytics and ad tags only after a visitor clicks "Accept" for those categories.
A regional news site shows a banner with "Accept all", "Reject non-essential" and "Choose", in equal size. Analytics and ad tags load only after a choice, and a footer link lets readers change it.
An app asks, on first launch, whether to allow personalised recommendations from browsing history. Tapping "Not now" keeps the shop fully usable. The app records the answer and uses it to configure its analytics SDK.
A school-fee portal used by parents and students avoids advertising trackers altogether. Its short banner lists only the session cookies needed for login and payment, and explains that no advertising or behavioural tracking is used.
Why Consent Banner matters
The banner is the most visible compliance artefact on a website. Complainants, journalists and regulators can inspect it in seconds, and a defective banner indicates that processing behind it is probably not properly founded. If trackers load regardless of the choice, the consent is not valid and the processing lacks a Section 4 ground; the exposure sits in the residual penalty tier of up to ₹50 crore.
There is also a commercial side. Ad-supported sites rely on tracking, so the banner affects revenue; but a well-designed, honest banner builds trust, and consent that is validly obtained is more useful than a high opt-in rate obtained by pressure, which can be invalidated. Keeping records of banner choices also gives proof under Section 6(10).
How it works in practice
- 1Inventory every cookie, SDK and pixel on your site and app, classify them as essential, analytics, personalisation or advertising, and note the vendor and retention period for each.
- 2Configure tag management so that non-essential tags are blocked until consent is given for their category. Verify with a browser tool that nothing fires beforehand.
- 3Design the banner with equal-weight buttons for accept and refuse, a settings layer with per-category toggles set to off, and language options.
- 4Store the choice with a time stamp and banner version, and honour it across subdomains and apps. Provide a persistent link, such as "Privacy settings", to change it any time.
- 5Re-ask when the vendors, purposes or banner wording change materially, and review the setup after every site release.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Loading all trackers first and showing the banner afterwards. The data has already been collected; block tags until a choice is made.
Making "Accept" a bright button and hiding "Reject" in a sub-menu. That tilts the choice and risks invalid consent.
Having a banner but ignoring the answer on the next page or in the mobile app. Choices must persist and apply across properties.
Copying a European banner template unchanged. It may not offer Indian languages or the grievance and Board complaint information.
Compliance tips
Run a periodic scan with a cookie-audit tool to catch new third-party scripts that marketing teams add without review.
Keep banner copy short and add a layered notice below for detail; people read the first two lines.
Test the banner on low-end phones and slow networks, where heavy scripts often fail and leave trackers running.
Record screenshots of each banner version with its dates, so you can show what visitors saw on a given day.
Common questions about Consent Banner
Does the DPDP Act require a cookie banner?
The Act does not use the term, but it requires valid consent for processing personal data that is not covered by a [legitimate use](term/legitimate-uses). Non-essential cookies that identify or track individuals generally need consent, and a banner is the usual way to ask. Essential cookies typically do not.
Can I use a banner that only has an Accept button?
That is risky. Section 6 requires consent to be free and unambiguous and withdrawal to be as easy as giving. A banner without a clear refusal option, or one that makes refusal much harder, may not produce valid consent for non-essential tracking.
Is scrolling or continuing to browse consent?
No. Consent must be signified by a clear affirmative action under Section 6(1). Scrolling, closing the banner or clicking elsewhere does not show agreement to specific tracking purposes, so non-essential trackers should stay off until the visitor actively chooses.