India

Consent under India's DPDP Act and the DPDP Rules 2025

What India's Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 require for notice and consent, when the duties apply, and how to meet them with Macaw.

Last reviewed

What the law requires

When it applies

The DPDP Rules were notified on 14 November 2025 and phase in. Consent manager registration applies after 12 months (14 November 2026). The substantive duties of data fiduciaries, including notice and consent (Rule 3) and security safeguards (Rule 6), apply after 18 months, from 14 May 2027.

Notice and consent

  • The notice must be clear, in plain language and standalone: it cannot be buried in a general privacy policy.
  • It must itemise the personal data collected and the specific purpose for each.
  • Consent cannot rely on pre-ticked boxes.
  • Withdrawing consent must be as easy as giving it, and you must publish how to do it.

Children

Verifiable parental consent is required before processing personal data of anyone under 18, and targeted advertising and behavioural profiling of children are prohibited.

Records and the burden of proof

  • In a dispute, the data fiduciary has to prove that notice was given and consent obtained (DPDP Act s.6(10)).
  • Data fiduciaries keep processing logs and traffic data for at least one year.
  • Registered consent managers keep records of consents, notices and sharing for seven years.

How to comply with Macaw

  1. Write an itemised notice

    Use the banner message and each category's description in Cookie Preferences to state what data the category collects and why. The Macaw banner is a standalone notice, separate from your privacy policy.

  2. Load optional tags only after consent

    Do not set analytics or marketing cookies until the visitor has granted that category. Listen for the consent.updated event and load each tag only when its category is true.

    macaw.on('consent.updated', (e) => {
  if (e.data.choices.analytics) loadAnalytics();
  if (e.data.choices.marketing) loadMarketingPixels();
});

  3. Keep proof of every decision

    Macaw stores each Reject all, Save choices and Accept all on its servers with every category's choice, the exact banner wording shown (as a notice version), the time, the page path and a truncated IP. Records are hash-chained, so a changed record is detected. Find one person under Compliance > Consent Records, or export everything as CSV for an audit.

  4. Let people change their mind at any time

    Add a persistent "Cookie settings" link to your site footer that reopens the Macaw banner. Visitors can change or withdraw their choice with the same effort it took to give it, and each change is stored as a new record.

    <a href="#" onclick="macaw.triggerCookie(currentUser && currentUser.id); return false;">
  Cookie settings
</a>

  5. Keep records for at least a year

    Under Compliance > Consent Records, set retention to 12 months or more (the default is 24). Retention can be set up to 84 months (seven years) if you need consent-manager-style records.

  6. Handle erasure requests

    Search a person by the user ID your app passes to the SDK, then choose "Erase this person". Their identifiers are removed from every record, and anonymous proof that consent was given and later erased remains.

What Macaw does not do yet

  • Macaw has no age gate or verifiable parental consent flow. If children may use your product, collect and verify parental consent in your own sign-up flow.
  • Macaw is not a registered DPDP consent manager; it is a tool you, as the data fiduciary, use to collect and record consent.

Sources

This guide summarises public regulator guidance and legal commentary to help you configure consent. It is not legal advice. Laws, deadlines and enforcement change; have your counsel confirm what applies to your business.

See Macaw consent management · All regions

More consent guides