Cookie consent & scanner · DPDP S. 5, 6, 8(2), 9(3) · Rule 3

Cookie consent for Indian websites, with proof.

Find every cookie, pixel and script on your site. File each one under a purpose. Block it until the visitor allows that purpose, and keep a record of the choice like any other consent.

Book a demo→ What the law asks

1: script for the banner, tag blocking and records
23: languages for the banner and preferences
3: buttons: Accept all, Reject all, Manage preferences

Figure 1. A scan result and the banner on the same site. Sample data.

What the law asks

Does the DPDP Act require cookie consent?

The Act does not use the word "cookie". Its duties apply to personal data. If a cookie or tracker processes personal data for a purpose that needs consent, the notice and consent rules apply to it. Your legal team decides which trackers fall in scope.

Requirement	Source	What it means	How Promiz helps
Personal data	S. 2(t)	Any data about a person who can be identified by or in relation to that data.	The scanner lists what each tracker collects, so your legal team can decide.
Notice before consent	S. 5 · Rule 3	Tell the visitor what data you collect and for which purpose.	Banner and preferences window list purposes, cookies and vendors.
Specific, clear consent	S. 6(1)	Consent needs a clear action for a specific purpose. No pre-ticked choices.	Separate switch for each optional purpose. Tags wait for consent.
Withdraw as easily as you consented	S. 6(4)	The visitor can change or withdraw a choice at any time.	Floating button reopens the choices on every page.
Processors under a valid contract	S. 8(2)	Engage a processor only under a valid contract.	Vendor register records whether a data-processing agreement is signed.
No tracking of children	S. 9(3)	Do not track, monitor behaviour or target ads at children.	Child-restriction flags on purposes; tags stay blocked for a minor on return visits.

Sources: Digital Personal Data Protection Act, 2023, sections 2(t), 5, 6, 8(2) and 9(3); DPDP Rules, 2025, Rule 3. This page explains the law; it is not legal advice.

In Promiz

How does cookie consent work in Promiz?

One script on your site does the banner, the blocking and the record-keeping.

Figure 2. From the first scan to a recorded choice.

Step 1 Run the scanner
The scanner visits your website and lists the cookies and trackers it finds.
Step 2 Import and file
Import the results. Promiz files each one under a purpose using your cookie-category map.
Step 3 Add the script
Add one Promiz script. It shows the banner on a first visit and blocks tagged scripts.
Step 4 The visitor chooses
Accept all, Reject all, or turn each purpose on or off in the preferences window.
Step 5 The choice is recorded
Only allowed tags run. The choice goes into the chained consent record.

Capabilities

What does cookie consent in Promiz include?

Cookie scanner with history

Every scan is kept, so you can see what changed between runs as your site changes.

Auto-filing by category

Your cookie-category map in Purpose Management files new cookies under the right purpose.

Tag gating

Scripts tied to a purpose run only after that purpose is allowed.

Tracker register

For each cookie, pixel or SDK: what it is, who provides it, what data it collects and how long it lasts.

Vendor register

Record each vendor's purposes, data categories, privacy policy and DPA status, then approve or reject it.

Preference-center builder

Colours, logo, layout, button styles and a floating button, with a live preview.

Smart re-display

The banner shows again only when the choice expires or the notice changes.

Domain-bound keys

The script works only on the domains you allow, so a copied key does not work elsewhere.

Compare

Why not use a free banner plugin?

Task	Email, spreadsheets and a basic banner	Promiz
Know what runs on your site	Manual list, soon out of date	Scanner with history and auto-filing
Stop tags before consent	Banner shows, tags still fire	Tags wait until the purpose is allowed
Show the banner in Indian languages	English only	23 languages, switchable on screen
Prove the choice later	Browser cookie only	Chained record with notice version
Track vendors and DPAs	Separate spreadsheet	Vendor register with approval

FAQ

Cookie consent & scanner: frequent questions

Not answered here? Ask us in a demo.

Do Indian websites need cookie consent under the DPDP Act?

The Act does not name cookies. If a cookie or tracker processes personal data for a purpose that needs consent, the notice and consent duties apply. Strictly necessary cookies that do not need consent can stay on. Your legal team decides which trackers need consent.

Does the Promiz banner block cookies before consent?

Yes. Scripts tied to a purpose run only after the visitor allows that purpose.

Can visitors change their cookie choice later?

Yes. A floating button on every page reopens the choices. The change is recorded as a new entry.

How does the cookie scanner file new cookies?

You import the scan results. Promiz files each cookie under a purpose using the cookie-category map you keep in Purpose Management.

Is the cookie choice part of the consent record?

Yes. Cookie choices are written to the same chained, tamper-evident record as form and email consent.

See your own cookies in the demo.

Give us your website. We scan it before the call and show you what runs, what needs a purpose, and what the banner would block.

Book a 30-minute demo→ We reply within 1 business day.

This page explains the law in plain words. It is not legal advice. Your legal team decides how the Act applies to you. Last reviewed 21 September 2026.