Your Cookie Banner Is Not DPDP Consent

Silverline Interiors in Bengaluru has a tidy little banner at the bottom of its site. Grey box, two buttons, "We use cookies to improve your experience." Their developer added it in 2023 after reading about European rules. Their founder believes the site is covered. It is not, and the gap between that banner and a working DPDP consent banner India businesses actually need is wider than a plugin setting.

The DPDP Rules, 2025 were notified in November 2025, and the Consent Manager framework under Rule 4 becomes operational on 13 November 2026. Between now and then, a lot of Indian sites are going to discover their banner was decoration.

Two Different Things Wearing the Same Grey Box

A DPDP consent banner India businesses can actually rely on starts from a different question than a cookie banner does. Cookie consent, as most people implemented it, is about storage on a device: analytics identifiers, ad pixels, preference cookies. India's framework is about the processing of personal data for stated purposes, with notice and a record. Those overlap. They are not the same shape.

Your analytics cookie is in scope. So is the phone number typed into your quote form, the address given to your chat widget, the email captured by a downloadable brochure gate, and the record your CRM keeps of all three. A banner that mentions none of that is answering a different question.

Where the Copied Banner Falls Short of a DPDP Consent Banner India Needs

Anatomy of a DPDP Consent Banner India Sites Can Rely On

The Parts That Are Not the Banner at All

Here is the uncomfortable bit. Most of the work sits behind the interface, and no DPDP consent banner India vendor can install it for you.

Rebuilding Silverline's Flow

Illustrative, but typical for a design studio with a lead-gen site.

A DPDP consent banner India studio like this needs is small; the cleanup behind it is not. Silverline collects name, phone, budget range and project pin code. That data went into a CRM, a mailing tool and a shared Google Sheet the studio used for follow-ups. Their banner mentioned none of it.

The rebuild took nine working days. Three unbundled purposes replaced the single accept. Every form got one line of purpose text above the button, written by their studio head rather than a lawyer, then checked by one. Consent rows now carry timestamp and notice version. The footer has a preferences link. The Google Sheet is gone, because once you write down who can read a spreadsheet of customer phone numbers, the answer is usually too many people.

The trade-off they accepted: marketing opt-ins dropped noticeably compared with the old bundled tick. Their follow-up conversations got better, because the people on the list had chosen to be there. That is the deal a DPDP consent banner India businesses build properly will make you take.

Design Choices That Will Age Badly

• Accept in brand colour, Reject as small grey text
• Reject hidden behind a "Manage preferences" second screen
• Pre-ticked marketing boxes on the enquiry form
• Consent bundled into terms-and-conditions acceptance
• A banner that reappears on every page until the visitor gives in
• Storing the choice only in a first-party cookie with a 30-day life

Writing the Words, Which Is the Hard Part

Developers can build the plumbing in a week. The sentence that goes above the submit button takes longer, because somebody has to decide what the company actually does with the data and then say it out loud.

Bad notice copy hides behind categories. "Functional, analytical and marketing purposes" tells a customer nothing. Good notice copy names the outcome the person will experience. "To call you back about this quote and to send a designer to measure your space" is a purpose. If your team cannot write that line without a meeting, the meeting is the point of the exercise.

Three rules we use when drafting for a DPDP consent banner India customers will actually read. First, one clause per purpose, no conjunctions doing sneaky work. Second, name the third parties by what they do, not by brand name alone, because "we share your number with a messaging provider so we can WhatsApp you" is clearer than a vendor name nobody recognises. Third, say how long you keep it. A retention period in the notice is unusual, which is exactly why it builds trust.

Then test the copy the cheap way. Read the banner aloud to someone in your own office who does not work in marketing. Ask them what they just agreed to. If they hesitate, rewrite. Every DPDP consent banner India teams ship should survive that ten-second test before it survives a legal review, because a notice nobody understands is not notice in any meaningful sense.

One more trade-off, stated plainly. Longer, clearer notices lower form completion a little. We have watched it happen. What you get back is a list of people who understood the deal, a support queue with fewer angry "how did you get my number" calls, and a record you can stand behind. That is a good trade for most businesses. It is not a free one, and anyone promising you compliance with no conversion cost is selling something.