How do I build a DPDP cookie consent banner?
What a compliant cookie banner looks like — and what gets you in trouble.
Essential vs non-essential
Cookies strictly necessary to deliver the service the user asked for — session, security, load balancing — don't need consent. Everything else, including analytics and advertising trackers, is non-essential and must wait for an affirmative opt-in. The banner should categorise cookies and let users choose by category.
Design that passes
Give equally prominent 'Accept' and 'Reject' options, default non-essential categories to off, and store a consent record with timestamp and scope. Provide a persistent way to change the choice later. Avoid dark patterns — making 'reject' harder than 'accept' undermines the freely-given requirement.
Don't forget the back end
A banner that blocks nothing is theatre. Ensure tags actually fire only after consent, your tag manager respects the choice, and third-party scripts are gated. The user's stored preference should propagate to every downstream tracker.
Frequently asked questions
Do I need consent for analytics cookies?
Yes. Analytics cookies are non-essential, so they require an affirmative opt-in before they load.
Is a 'cookie wall' allowed?
Forcing acceptance to access the site is risky because consent must be free and unconditional. Provide a genuine reject option.
Are session cookies exempt?
Strictly necessary cookies, such as session and security cookies, can run without consent. Tracking and advertising cookies cannot.
Generate a compliant cookie banner
Use the Cookie Consent Generator to produce a categorised, opt-in banner with consent logging.
Generate a Cookie Banner