Introduction
Almost every internet user has encountered a cookie banner while visiting a website.
A website asks whether the visitor wishes to accept cookies, reject optional cookies or customise privacy preferences. The visitor makes a selection and continues browsing.
But does this mean that the website is providing a Consent Manager under India’s Digital Personal Data Protection (DPDP) Act, 2023?
The answer is no.
Although cookie banners and Consent Managers may both involve consent-related activities, they serve different purposes and operate under different legal and technological frameworks.
Understanding this distinction is important for businesses preparing for India’s new data protection regime.
1. What is a cookie banner?
A cookie banner is a notification displayed on a website or application informing visitors about the use of cookies and, depending on its design, allowing them to accept, reject or customise certain cookie preferences.
Cookies are small data files stored on a user’s device by websites or related services.
They may be used for several purposes, including:
- Maintaining login sessions.
- Remembering user preferences.
- Analysing website traffic.
- Measuring advertising performance.
- Personalising online experiences.
A cookie banner is generally a user-interface mechanism through which a website communicates information and collects user preferences concerning cookies.
Its presence does not automatically establish compliance with the DPDP Act.
The legal requirements depend on the personal data being processed, the purpose of processing and the applicable legal basis.
2. What is a Consent Manager under the DPDP Act?
Section 2 of the DPDP Act defines a Consent Manager as a person registered with the Data Protection Board of India who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw consent through an accessible, transparent and interoperable platform.
Unlike an ordinary cookie banner, a Consent Manager is a regulated entity.
Its purpose is not restricted to collecting a visitor’s initial consent on one website.
It is intended to facilitate consent management across multiple Data Fiduciaries onboarded onto its platform.
For example, an individual may use a registered Consent Manager to manage consent relating to personal data processing by different financial institutions.
The individual may be able to review consent given to one organisation, withdraw it and manage other consent relationships through the same platform.
3. The difference in their legal functions
The most important distinction lies in their scope and statutory status.
| Parameter | Cookie banner | Consent Manager |
|---|---|---|
| Nature | Website interface or tool | Registered entity |
| Legal status | Not automatically a regulated Consent Manager | Requires registration |
| Scope | Usually website-specific | Designed for multiple onboarded Data Fiduciaries |
| Primary purpose | Communicating cookie choices | Managing consent |
| Withdrawal | Depends on website implementation | Must facilitate consent withdrawal |
| Recordkeeping | Depends on applicable requirements and implementation | Specific statutory recordkeeping obligations |
| Interoperability | Not necessarily required | Required platform characteristic |
A cookie banner may be an effective component of a company’s privacy compliance programme.
However, it cannot simply claim the statutory status or functions of a Consent Manager.
4. Why is interoperability important?
Interoperability is one of the defining features of the Consent Manager framework.
The First Schedule to the DPDP Rules, 2025 requires the applicant to have an interoperable platform that enables Data Principals to give, manage, review and withdraw consent.
The platform must also undergo independent certification against applicable data protection standards and the assurance framework published by the Board.
This requirement is significant.
Consider an individual who has accounts with three banks and two insurance companies.
Without a common consent-management mechanism, the individual may have to visit each organisation’s website or application to manage consent.
A registered Consent Manager is intended to provide a common interface through which the individual can manage consent involving different onboarded organisations.
A conventional cookie banner does not ordinarily provide this cross-organisation functionality.
5. Can a company use both?
Yes.
A business may use cookie banners and other consent interfaces on its website while also using the services of a registered Consent Manager.
These tools need not be mutually exclusive.
For example, an e-commerce company may display a cookie preference interface for website-related technologies.
Separately, it may onboard with a registered Consent Manager to facilitate consent management for personal data processing through the Consent Manager’s platform.
The two mechanisms serve different purposes.
Businesses should not, however, assume that implementing a cookie banner automatically satisfies all DPDP consent requirements.
6. What should businesses do?
Businesses should examine their consent architecture carefully.
First, identify the personal data collected through websites and applications.
Second, distinguish between cookies that involve personal data processing and other technical cookies or storage mechanisms.
Third, identify the purpose for which the relevant information is processed.
Fourth, ensure that the consent notice and consent mechanism satisfy the applicable legal requirements.
Fifth, consider whether integration with a registered Consent Manager is relevant to the business model.
A particularly important point is that the DPDP Act does not make a cookie banner a substitute for the requirements of Section 6 and the applicable Rules.
Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, wherever consent is the applicable basis for processing.
Conclusion
Cookie banners and Consent Managers may appear similar because both involve user consent.
However, their legal functions, scope and regulatory status are fundamentally different.
A cookie banner is generally a website-level mechanism for communicating and collecting cookie preferences. A Consent Manager is a regulated entity intended to provide individuals with an interoperable platform for managing consent across onboarded Data Fiduciaries.
For businesses, the lesson is simple: implementing a cookie banner is not equivalent to engaging or becoming a registered Consent Manager.
