What a DPDP consent banner must actually do (most get this wrong)

Most Indian websites that have a consent banner copied it from a GDPR template in 2020. Under the DPDP Act, a banner is not decoration - it is the visible half of a legal behaviour, and the behaviour is what the law judges. Here is the test, in the order an assessor would apply it.

1. Non-essential trackers wait for consent

Section 6 requires consent BEFORE processing that relies on it. Open your site in a private window with the network tab open: if requests to Google Analytics, Meta, or ad networks fire before you touch the banner, the banner is theatre. Fixing this usually means loading those scripts only after Accept - most tag managers and our own tag support holding scripts until consent.

2. The notice is itemised and understandable

Section 5 and Rule 3 require an itemised notice: what personal data, for what purposes, in clear language, with the means to complain. The banner links to it; the notice does the heavy lifting. A one-line "we use cookies" with no link fails before it starts. Remember the language point: the Act contemplates notices available in the Eighth Schedule languages your users actually use.

3. Decline is as real as Accept

A giant Accept and a grey "manage preferences" maze is a dark pattern - consent obtained that way is hard to call free or unambiguous. Two buttons, equal honesty: Accept, and Decline non-essential. Essential cookies (cart, login, security) need no consent - do not ask for what you do not need.

4. Withdrawal is one step, any time

Section 6(4): withdrawal must be as easy as consent was. If agreeing took one tap and withdrawing takes an email to support, you fail. A "Manage consent" link in the footer that reopens the same banner meets the bar.

5. You can prove what happened

When the Board asks "did this user consent, and when?", the answer cannot be a shrug. Keep a record of choice and time. Section 8 makes you accountable for demonstrating compliance - records are how.

Test yours now

The free PrivacyReady check runs the tracker-timing test and the notice checks against your live site in about a minute - no signup. And from the Micro plan up, our tag serves a banner that passes all five behaviours out of the box: held trackers, real decline, one-tap withdrawal, records kept. One paste. If you are unsure whether you even need a banner, the two-minute applicability checklist answers that first - and for the Consent Manager confusion, we wrote a separate plain answer.