Advertising Standards Council of India publishes a Whitepaper Titled “Navigating Cookies – Recalibrating your cookie strategy in light of the DPDPA”

05.02.2025
By Rishikaa

Saikrishna & Associates

The Advertising Standards Council of India (“ASCI”) has published a whitepaper “Navigating Cookies – Recalibrating your cookie strategy in light of the DPDPA” (“Whitepaper”). The Whitepaper addresses the treatment of cookies under the Digital Personal Data Protection Act, 2023 (“DPDPA”) read with the draft of the Digital Personal Data Protection Rules, 2025 (“Draft DPDP Rules”) and how advertisers can deploy cookies and also comply with the consent-related requirements under the DPDPA.

The ASCI, through this Whitepaper, encourages advertisers to leverage the findings in designing strategies that respect user preferences and enable them to optimise the use of cookies for targeted advertising, behavioural tracking and personalised content delivery.

A brief overview of the Whitepaper is below:

Definition of cookies: Cookies are small text files that are placed by websites on a device during their browsing session to collect and store information that can be used to identify a user, their details, preferences, and browsing history. This information can subsequently be used for tailoring advertisements, tracking, and undertaking user analytics.
Types of cookies: The Whitepaper identifies the following six types of cookies:
- Essential/strictly necessary cookies that are fundamental for websites’ functioning and enable basic features.
- Performance/Analytics cookies that collect anonymised data on how users interact with a website to help optimise performance.
- Functionality cookies that store user preferences and settings to improve user experience.
- Targeting/Advertising cookies that track user activity to deliver personalised advertisements.
- Social media cookies that are developed by social media platforms to track user activity, recommend content, and track interactions for analytics and advertising.
- Security cookies that protect user accounts by preventing fraudulent access and identifying traffic.
Cookie consent in other jurisdictions: The Whitepaper examines laws in other countries, including the General Data Protection Regulation (“GDPR”) to offer practical insights for Indian advertisers.
- EU GDPR: While the GDPR does not specifically address cookie consent management, it mentions how online identifiers such as IP addresses and cookie identifiers, combined with other information received by the servers can be used to create profiles of persons and identify them. Further Directive 2002/58/EC or the “e-Privacy Directive” provides key principles for cookie consent management including, informing the user about the purpose and nature of information stored, methods to give/refuse consent, providing an opportunity to refuse cookies, and conditional access to website content if cookies can justify legitimate purpose.
  The Whitepaper also discusses how GDPR requires consent to be granular to allow users to give consent for each purpose instead of bundled permissions. The Whitepaper suggests that this can be achieved through detailed cookie banners, granular opt-ins and providing easy, straightforward and readily accessible mechanisms to withdraw consent.
- Specific European countries: In addition to discussing the GDPR, the Whitepaper also mentions the cookie consent practices followed in specific countries such as scrolling not amounting to consent in Italy, prohibition on cookie walls and offering alternatives in France, emphasising user control within 24-month interval and limiting persistent cookies to 12 months in Spain and Luxembourg respectively.
- Canada: As per the Whitepaper, Canada requires organisations to provide options to withdraw consent.
- UK GDPR: The UK GDPR requires obtaining explicit consent and providing the option to periodically renew the consent preferences.
- California: Lastly, California laws require providing the rights to know, delete and correct data.
Gaps in current cookie consent practices per the DPDPA and Draft DPDP Rules: Based on a survey of various websites across various sectors, the ASCI identified certain gaps in the current cookie consent practices in India. As per the Whitepaper, only a few websites displayed cookie consent banners. Moreover, these banners did not follow best practices, lacking clear opt-out options and proper user functionality. Further, these banners did not adopt user-friendly designs and lacked transparency, failing to provide meaningful options to manage cookie preferences by presenting an “accept all” option. A lack of a proper mechanism to withdraw consent was also noticed.
In light of these gaps, the ASCI suggests implementing transparent and user-friendly cookie consent banners, clear opt-out mechanisms for non-essential cookies, and providing granular consent options to enable users to manage their cookie choices.
Applicability of the DPDPA on cookies: The Whitepaper acknowledges that India does not have a specific law governing the use of cookies. Accordingly, the notice and consent requirements under the upcoming DPDPA would be applicable since cookies collect and store information.
To comply with the DPDPA, websites will be required to provide notice prior to/along with the request for consent informing the users about the personal data being collected and the purpose for collecting the same, among other things. The websites will also have to obtain consent that is free, specific, informed, unconditional, and unambiguous, signifying an agreement for processing personal data for a specific purpose, and being limited to that specific purpose.
The Whitepaper states that the requirement of obtaining ‘specific’ consent under the DPDPA is comparable to the requirement of granular consent under the GDPR. It also briefly analyses the impact of the DPDPA on various industries, namely, e-commerce, social media platforms, tech and SAAS companies, digital advertising and marketing, healthcare, and finance. To comply with the DPDPA, the Whitepaper proposes that these industries consider inter alia redesigning their cookie management practices and user interfaces to provide clear information on the purpose of each cookie and the data being processed and allow users to make granular choices.
Other considerations:
- Dark patterns: The Whitepaper discusses how dark patterns can appear in cookie consent banners in the form of visually biased displays such as making the “accept all” button brighter and more accessible, using larger fonts and high contrast colours, use of pre-selected checkboxes etc.
- Consent or Pay model: Websites also use the “consent or pay model”, which creates a cookie wall and forces users to either accept all the cookies being shared through the consent option or pay a subscription fee to ensure that the data is not being shared with third parties. As per the Whitepaper, not providing a “reject all cookies” option even under the pay option would create issues from providing a meaningful and granular consent perspective.
- Consumer protection: While the Consumer Protection Act, 2019 (“CPA”) does not specifically govern the use of cookies, it places obligations on advertisers to ensure transparency and fairness in advertising and marketing. Particularly, the CPA considers disclosure of personal information (which was shared in confidence) without obtaining consent as unfair trade practice. To ensure compliance with the CPA, the Whitepaper suggests that cookie banners clearly articulate the type of data being collected, purpose of collection, disclosure with third parties for personalised advertising, use of simple and easily understandable language, providing unambiguous options for providing/withdrawing consent, and disclosing how the data will be used and managed.
Core Principles for Compliance: The Whitepaper identifies the following as the core principles for compliance with Indian laws including the DPDPA –
- Providing a clear cookie consent banner with the options to accept, reject, and customise preferences
- Classifying cookies to allow users to make informed choices
- Conducting regular audits and removing outdated cookies
- Legal scrutiny of tracking and storage of content
- Providing clear options to withdraw and modify consent
- Providing detailed privacy policy outlining the practices pertaining to data collection, data usage and user rights.
Recommendations:
- The Whitepaper suggests using a “Cookie Preference Center” which is a website tool that allows users to grant or withdraw consent and manage their cookie preferences ensuring compliance with data protection regulations.
- Creating an effective cookie policy providing details of the technical specifications, consent management, information transparency, and user control interface has also been suggested.
- Practices of implied consent, concealing consent options, use of non-compliance dark patterns and neglecting third-party cookies should be avoided.
- Automation tools that inter alia automatically adapt cookie banners to comply with region-specific regulations, regularly scan websites and categorise cookies, maintain a centralised database of user consent, and keep cookie banners and policies updated with regulatory changes should be leveraged.

Our Take

ASCI’s Whitepaper offers useful guidance as businesses gear up to navigate compliance with the DPDPA, especially following the release of the draft DPDP Rules for public consultation.

While similar guidance has been issued in other jurisdictions, it has typically come from regulatory authorities. For example, Singapore’s Personal Data Protection Commission has published advisory guidelines on various topics, including the treatment of cookies under its Personal Data Protection Act. In contrast, ASCI is a self-regulatory body that has not been formally recognized under India’s data protection laws. It remains to be seen whether the yet-to-be-established Data Protection Board of India will release its own guidance on cookies or endorse ASCI’s Whitepaper.

Having said that, given the growing regulatory focus on data protection and user consent, the Whitepaper provides much-needed guidance to advertisers on navigating compliance while optimizing their cookie strategies.

However, certain aspects could have been addressed in greater detail. For instance, while the Whitepaper categorises different types of cookies, it does not acknowledge that not all cookies collect personal data, meaning consent may not be required for their deployment under the DPDPA. Additionally, although it highlights the requirement for obtaining verifiable parental consent when processing children’s personal data, it lacks practical guidance on how this can be achieved for cookies, particularly in line with the proposed framework under the Draft DPDP Rules. Moreover, the Whitepaper does not discuss the DPDPA’s restrictions on tracking, behavioural monitoring, or targeted advertising directed at children, all of which can be facilitated through cookies.

As businesses adapt to evolving legal requirements, ASCI’s insights may help bridge the gap between regulatory expectations and practical implementation, enabling advertisers to balance personalization with privacy in a compliant manner. While the Whitepaper serves as a valuable resource for advertisers, further guidance—whether from ASCI or the upcoming Data Protection Board of India—will be essential to fully navigate compliance under the evolving data protection framework.

Links

ASCI’s Whitepaper: https://www.ascionline.in/wp-content/uploads/2025/01/Navigating-Cookies-Whitepaper.pdf

Singapore’s Advisory Guidelines on the Personal Data Protection Act (PDPA) For Selected Topics: https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-selected-topics/advisory-guidelines-on-the-pdpa-for-selected-topics-(revised-may-2024).pdf

This article was originally published by Saikrishna & Associates