Cookies
Small files that a website stores in a browser to remember settings, sessions and behaviour.
Cookies are small files that websites save in your browser to remember you, keep you logged in or track what you do. Under the DPDP Act, cookies that identify or follow a person are personal data and generally need consent.
Meaning of Cookies
Essential cookies keep a shopping cart or login working. Analytics and advertising cookies track behaviour and can identify a person over time, so they are personal data when linked to an identifiable individual. Non-essential tracking should rest on consent.
A cookie is a small text file stored by a browser at a website's request. First-party cookies are set by the site you visit; third-party cookies are set by other companies whose code is embedded on the page, such as advertising networks or analytics tools. Cookies can be session cookies, which vanish when the browser closes, or persistent ones that last days or years. Similar technologies, including SDKs in apps, pixels and device fingerprints, raise the same questions.
The DPDP Act does not mention cookies, but its definition of personal data in Section 2 covers any data about an individual who is identifiable by or in relation to that data. A cookie holding a random ID is not harmful alone, but when it is linked to a login, an email address, a device ID or a browsing profile, it relates to an identifiable person. Collecting and using it is then processing of digital personal data under Section 3.
Not all cookies are equal. Strictly necessary ones, such as those that keep a shopping cart, remember a login or protect against fraud, support a service the person asked for, and can often rest on voluntary provision under Section 7(a) or on the service itself. Analytics, personalisation and advertising cookies serve the organisation's own goals, and for these consent is the safer ground. Section 6 requires a clear affirmative action, so pre-set approval does not work.
Cookies and children do not mix with advertising. Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, so sites and apps used by under-18s need to avoid ad cookies and similar identifiers unless a notified exemption applies. Cookie compliance is also separate from security: Section 8(5) still requires reasonable safeguards for cookie data that counts as personal data, including secure flags and sensible lifetimes.
Examples of Cookies
A shop sets a session cookie to keep items in the cart, and a separate advertising cookie that follows visitors across other sites. The second one needs consent.
The shop sets a session cookie to keep items in the basket and another to remember the pin code. These work without a banner choice. A third-party advertising cookie loads only if the visitor chooses to allow advertising.
A hospital's booking pages once embedded a social-media pixel that sent page names to an ad platform. After an audit, the hospital removes the pixel from appointment pages, since page names could reveal health conditions.
An app for school students uses only a login-session identifier and no advertising SDK. The developer disables analytics profiles for under-18 accounts, in line with the limits on tracking and behavioural monitoring in Section 9.
Why Cookies matters
Cookies are often the least understood data flow in an organisation. Marketing teams add tags quickly, and each tag may send visitor data to a third party. If the organisation cannot say what is collected and by whom, it cannot give an accurate notice or valid consent, and the processing lacks a proper ground. Residual penalties reach up to ₹50 crore, and the Fiduciary stays responsible for what its processors and embedded vendors do under Section 8(1).
For visitors, cookies are the mechanism through which browsing across sites becomes a profile. Respecting their choice gives control back, and for the business it improves data quality and reduces regulatory and reputational risk. A site that can show a clean cookie inventory and working choices is better prepared for complaints and audits.
How it works in practice
- 1Run a cookie and tracker audit using a scanning tool, then add manual checks for logged-in areas and apps. Record the name, owner, purpose, lifetime and data sent for each item.
- 2Categorise them: strictly necessary, analytics, functional preferences, advertising. Only the first group should run without a prior choice.
- 3Implement a consent banner or preference centre that controls category-level loading, and confirm in a browser inspector that blocked categories do not set cookies until consent.
- 4Shorten lifetimes, set Secure and HttpOnly flags where appropriate, and avoid storing directly identifying data inside cookie values.
- 5Update the cookie notice and vendor list on every release, and have contracts with analytics and ad vendors that restrict their use of the data to your instructions.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Calling every cookie "essential". Analytics and advertising cookies are not needed to deliver the service.
Forgetting third-party scripts that add their own cookies. Audit what each tag actually does.
Treating anonymous-looking IDs as outside the Act. If the ID can be linked to a person, it is personal data.
Setting cookies for children's accounts for ad targeting. Section 9(3) bars it.
Compliance tips
Maintain a live cookie register and give a named owner to every tag, so removal is simple when it is no longer needed.
Use server-side settings or consent-aware tag managers to avoid scripts firing before choice.
Check your mobile apps as well; SDK identifiers often escape cookie-focused reviews.
Review cookie lifetimes once a year; many are far longer than the purpose needs.
Common questions about Cookies
Do cookies count as personal data under the DPDP Act?
They can. A cookie is personal data when it relates to an identifiable individual, for example when it is linked to an account, email or device profile. Random IDs that can never be linked to a person are less clear, so treat tracking cookies cautiously.
Do I need consent for all cookies?
Not always. Strictly necessary cookies that keep a service working, such as a login session or cart, are usually justified by the service the person asked for. Analytics, personalisation and advertising cookies are different, and consent is the safer ground for them.
Does the DPDP Act ban cookies for children?
Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, so advertising and profiling cookies on child-directed services should be avoided. Strictly necessary cookies for login or security remain possible, subject to the Act and any notified exemptions.