Running Ads on Your Website? Why the DPDP Act Requires Prior Consent Before Tracking

The Default State of Digital Advertising is Now Illegal in India

If your website runs paid advertising campaigns, retargeting pixels, or web analytics, your current setup is almost certainly firing tracking scripts the instant a visitor lands on your page.

In traditional digital marketing, standard practice has always been:

1. Visitor requests a web page.
2. The page loads Google Tag Manager (GTM), Meta Pixel, Google Ads remarketing tags, and analytics.
3. Cookies and device identifiers are dropped into the visitor’s browser before they have even seen your privacy banner.
4. A small banner pops up at the bottom saying: “We use cookies to improve your experience. By continuing to browse, you agree to our use of cookies.”

Under India’s Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025, this entire pattern is an explicit statutory violation.

If your website collects personal data from visitors in India to serve, measure, or optimize advertisements, you are legally required to obtain prior, unbundled, affirmative consent before any tracking scripts execute.

What the Law Actually Says About Ad Tracking

Three core sections of the DPDP Act govern every website running ad technology:

1. Section 6(1): Clear Affirmative Action Required

Under Section 6(1), consent must be:

• Free: Not coerced or bundled as a mandatory condition for basic browsing.
• Specific: Separated per processing purpose (analytics vs. marketing vs. essential functions).
• Informed: Accompanied by a standalone notice under Section 5.
• Unconditional & Unambiguous: Pre-ticked checkboxes, implied consent (“by continuing you agree”), or silence do not constitute valid consent.
• Affirmative Action: The visitor must perform a deliberate positive action (such as clicking an explicit “Accept” button) before data collection begins.

2. No “Legitimate Interest” Defense for Ads (Section 4 & Section 7)

Unlike the European GDPR—where advertisers often attempted to justify tracking cookies under the “legitimate interests” balancing test—the DPDP Act contains no commercial legitimate interest exception. Under Section 4, processing must be based either on consent or narrow statutory “legitimate uses” under Section 7 (such as state welfare, medical emergencies, or employment). Advertising, retargeting, and conversion optimization are strictly consent-based activities. (Read our detailed comparison on DPDP Act vs GDPR).

3. Absolute Ban on Tracking Children (Section 9(3))

If your website receives traffic from individuals under 18 years of age, Section 9(3) strictly prohibits:

• Any tracking or behavioral monitoring of children.
• Any targeted advertising directed at children.

Violating Section 9 carries one of the heaviest statutory penalties in the Act: up to ₹200 crore under The Schedule.

Which Ad Tracking Technologies Require Prior Consent?

If your website includes any of the following tags, they must be blocked by default until the visitor grants explicit consent:

Essential session cookies (such as maintaining an active shopping cart or security CSRF tokens) do not require consent, but every advertising and analytics tag does.

To find out which trackers are currently executing before consent on your domain, run our Free DPDP Website Scanner.

The 13 November Timeline: Why Acting Now Matters

The DPDP regulatory rollout operates on a phased timeline notified in the Gazette:

• 13 November 2025: DPDP Rules notified and Data Protection Board established.
• 13 November 2026: Statutory Consent Manager intermediary provisions take effect (see our explanation of Consent Manager vs CMP).
• 13 May 2027: Full enforcement date when all fiduciary duties, rights enforcement, and statutory penalties apply across India.

Why should marketing teams and website owners fix their ad tags now instead of waiting until May 2027?

1. Section 6(10) Burden of Proof: If a consent dispute or user complaint is lodged after enforcement, the Data Fiduciary must prove that prior notice was given and affirmative consent was granted. Historical data collected without valid consent cannot be legitimized retrospectively. Read how cryptographic Merkle roots solve the Section 6(10) burden of proof.
2. Ad Campaign Continuity: Rushing tag changes at the last minute leads to broken conversion tracking, corrupted attribution models, and wasted ad spend.
3. Small Businesses Are Not Exempt: Even small e-commerce stores and lead generation pages running ₹5,000/month in Meta Ads are fully subject to Section 6 consent rules. Review our DPDP small website checklist.

How to Implement Consent Before Ads Without Destroying Conversions

The primary fear of every growth marketer and performance agency is simple: “If we block Google Ads and Meta Pixel before consent, will our ad attribution and conversion tracking break?”

The answer is no, provided you implement Google Consent Mode v2.

1. Configure Google Consent Mode v2 Defaults

Google Consent Mode v2 allows Google tags (Google Ads, GA4, Floodlight) to adjust their behavior based on the user’s consent state. Before the user interacts with the banner, tags fire in a cookieless, non-tracking state:

// Set strict defaults BEFORE any tag library loads
window.dataLayer = window.dataLayer || [];
function gtag(){dataLayer.push(arguments);}

gtag('consent', 'default', {
  'ad_storage': 'denied',
  'analytics_storage': 'denied',
  'ad_user_data': 'denied',
  'ad_personalization': 'denied',
  'wait_for_update': 500
});

When configured this way:

• If the visitor accepts marketing cookies, ConsentPlix dispatches gtag('consent', 'update', ...) setting all parameters to 'granted'. Google tags seamlessly elevate and track full conversion data.
• If the visitor declines, Google uses cookieless conversion pings to model lost conversions through machine learning—keeping your ROAS measurement intact while staying 100% compliant with Indian law.

Read our complete engineering brief on the autonomous sub-12KB SDK and Google Consent Mode v2.

2. Itemise Notices Under Section 6

Your consent modal cannot feature a single “Accept All” button without choice. Under DPDP Act consent notice architecture, you must offer itemised toggles:

• Strictly Necessary: Core functionality (always enabled).
• Analytics & Measurement: Site performance and user experience metrics.
• Advertising & Personalization: Remarketing pixels, conversion tracking, and third-party ad networks.

3. Deliver Notices in Regional Languages

Under Sections 5(3) and 6(3), visitors must have the option to view notice terms in English or any of the 22 Eighth Schedule Indian languages (such as Hindi, Tamil, Telugu, Marathi, Bengali, or Gujarati).

Statutory Penalties for Advertising Tracking Breaches

Under The Schedule of the DPDP Act:

• Failing to obtain valid consent or provide proper notice: Up to ₹50 crore (under the general residual penalty provision).
• Tracking, behavioral monitoring, or targeted advertising of children (Section 9): Up to ₹200 crore.
• Failing to maintain reasonable security safeguards (Section 8(5)): Up to ₹250 crore.

The Data Protection Board of India has statutory powers to issue binding directions, order immediate cessation of non-compliant data processing, and impose substantial financial penalties based on the nature, duration, and gravity of the violation.

4-Step Action Plan for Website Owners and Marketing Teams

1. Perform a Script Audit: Run a scan using our DPDP Website Scanner to identify every ad pixel and third-party tracker firing on your domain.
2. Deploy an Automated Pre-Consent CMP: Replace generic cookie plugins with a DPDP-native Consent Management Platform like ConsentPlix that blocks scripts asynchronously before affirmative consent. Follow our CMS-specific tutorials for Shopify and WordPress.
3. Connect Google Consent Mode v2 & Meta Conversions API: Ensure marketing tags communicate real-time consent signals without breaking conversion tracking.
4. Export Sovereign Audit Receipts: Verify that every consent decision produces a tamper-evident receipt stored in AWS Mumbai (ap-south-1) to satisfy the Section 6(10) burden of proof.

Compare how ConsentPlix stacks up against legacy global alternatives in our Best DPDP CMP Buyer’s Guide, or check our direct comparisons for CookieYes vs ConsentPlix and OneTrust vs ConsentPlix.

Get DPDP Ad-Ready Today

You don’t need a six-month IT project or enterprise consulting contract to make your ad campaigns DPDP-compliant:

• Free Forever Plan: 1 domain, 1,000 consent events/month, sub-12KB SDK, and Google Consent Mode v2 integration.
• Starter Plan (₹399/mo): All 22 Indian regional languages, custom branding, and automated Data Principal rights portal.

Scan your website for free trackers or get started with ConsentPlix today.