Only 6% of top Indian sites ready for DPDPA cookie consent compliance: ASCI dipstick

The Advertising Standards Council of India (ASCI), along with PSA Legal and Tsaaro Consulting released a white paper titled ‘Navigating Cookies: Recalibrating your cookie strategy in light of the DPDPA’, on the occasion of the International Data Privacy Day 2025, i.e. today.

The agencies carried out a dipstick survey as a preparatory part of the white paper creation exercise. The dipstick analysed the cookie consent practices of top 50 websites in India, accounting for 30 billion visits in December 2024. The survey showed that only 6% of them were ready for the cookie consent provisions as specified under the DPDP Act 2023 (DPDPA) and the draft DPDP rules published on January 3, 2025.

While the DPDPA is likely to provide guidelines for compliance, the dipstick survey indicated the need for brands in India to adopt cookie consent best practices as a part of their compliance readiness efforts, according to ASCI. Cookies, essential for online advertising and user experience, are used by brand advertisers to track user behaviour, personalise content, and target ads effectively. However, they also raise privacy concerns when users are unaware of how their data is collected or shared. The white paper published by the three agencies aims to guide Indian businesses to adjust their cookie strategies to comply with the DPDPA norms. It highlights the importance of consumer trust in the evolving digital privacy landscape.

Manisha Kapoor, CEO and Secretary-General of ASCI, said, “This paper aims to help advertisers understand and prepare for cookie consent practices that align with the DPDPA, building consumer trust and transparency.” The white paper also stresses the need for transparent and informed cookie consent practices to address these concerns.

The white paper examines how cookie consent is handled in other countries and provides businesses with actionable insights to navigate user consent, transparency, and control. Dhruv Suri, Partner at PSA Legal, said, “Once the law is clearer, cookies will evolve from marketing tools to instruments for strengthening customer loyalty. Global precedents can guide local strategies for managing cookie consent.”

Source: White paper by ASCI, PSA Legal, and Tsaaro Consulting

Some of the key areas that the white paper focuses on include the compliance readiness gaps, discussion on the DPDPA’s requirement for explicit, informed, and revocable consent for cookies, lessons from global standards like the GDPR, and an analysis of how industries such as e-commerce, social media, and healthcare are impacted by these regulations.

Akarsh Singh, CEO, Tsaaro Consulting, said, “Cookie consent is no longer a checkbox exercise. Acknowledging the gap between marketing tactics and privacy laws is crucial to building a privacy-centric ecosystem.”

The paper also stresses that brand advertisers can turn compliance into a competitive advantage by adopting user-centric practices and building consumer trust in a privacy-focused environment.

According to Dhruv Suri, partner, PSA Legal, said, “Once the law is better understood, cookies will no longer be mere marketing tools but will serve as a means to strengthen customer loyalty. Global precedents can serve as the perfect roadmap to tailor strategies and navigate cookie consent management in a country that is just beginning its data privacy journey.