The Cookie Consent Standard We Build to Under DPDP: A Complete Reference

The Non-Negotiables

Any project, new build or existing site, should satisfy every item below before it's considered launch-ready from a consent standpoint. This isn't a best-practice wish list; each of these maps directly to a real requirement under India's DPDP Act, 2023 and the DPDP Rules, 2025.

The Reference Pattern: What “Good” Actually Looks Like

Use this two-layer pattern as the default reference implementation unless a specific design system dictates otherwise. It's a widely adopted, low-risk pattern that satisfies every non-negotiable above.

Layer 1, the initial banner: shown on first visit, with three actions at equal prominence, Accept All, Decline All, and Manage Cookies (which opens Layer 2). Plain-language copy states that a default applies if the user doesn't choose, and links to the full Cookie Policy.

Layer 2, the preference centre: opened from “Manage Cookies” on the banner, or from a persistent footer link at any later time. Necessary is locked on; every other category is an independent toggle. Accept All and Decline All remain available here too, alongside a Save Settings action for a custom mix.

Category Definitions

The Step-by-Step Build Guide

Whether building fresh or retrofitting an existing site, these seven steps cover the full implementation.

Setting the Default Consent State

Place this immediately above the GTM snippet in the page's , so it's the very first thing that runs.

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  // Default: everything denied until the user chooses
  gtag('consent', 'default', {
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'analytics_storage': 'denied',
    'wait_for_update': 500
  });
</script>
<!-- GTM snippet goes here, unmodified -->

Wiring Accept, Decline, and Save Settings

GA4, Google Ads, and Floodlight tags configured in GTM with Consent Settings on each tag respect this state automatically. Non-consent-mode-aware tools (Meta Pixel, LinkedIn Insight, chat or video widgets) must be held back manually, shown next.

document.getElementById('acceptBtn').addEventListener('click', function () {
  var consent = { necessary: true, analytics: true, marketing: true,
                  ts: Date.now(), version: 'v1' };
  localStorage.setItem('cookie_consent', JSON.stringify(consent));
  gtag('consent', 'update', {
    'ad_storage': 'granted', 'ad_user_data': 'granted',
    'ad_personalization': 'granted', 'analytics_storage': 'granted'
  });
  if (typeof fbq === 'undefined') { loadMetaPixel(); }
  logConsent(consent);
  hideConsentPopup();
});

document.getElementById('rejectBtn').addEventListener('click', function () {
  var consent = { necessary: true, analytics: false, marketing: false,
                  ts: Date.now(), version: 'v1' };
  localStorage.setItem('cookie_consent', JSON.stringify(consent));
  gtag('consent', 'update', {
    'ad_storage': 'denied', 'ad_user_data': 'denied',
    'ad_personalization': 'denied', 'analytics_storage': 'denied'
  });
  logConsent(consent);
  hideConsentPopup();
});

Holding Back Meta Pixel Until Consent Is Granted

Meta Pixel has no native consent-mode support, so it must be held back entirely, not just muted.

function loadMetaPixel() {
  !function(f,b,e,v,n,t,s){/* ...standard fbq bootstrap, unchanged... */}
  (window, document,'script','https://connect.facebook.net/en_US/fbevents.js');
  fbq('init', 'YOUR_PIXEL_ID');
  fbq('track', 'PageView');
}

// On page load, auto-load only if a prior visit already granted marketing consent
(function () {
  var stored = localStorage.getItem('cookie_consent');
  if (stored && JSON.parse(stored).marketing) { loadMetaPixel(); }
})();

A Real, Minimal Consent Log

This is what turns “we have a banner” into “we can demonstrate consent was obtained.” A simple append-only log table (session reference, categories, timestamp, notice version, user agent) is enough on the backend.

function logConsent(consent) {
  fetch('/api/consent-log', {
    method: 'POST',
    headers: {'Content-Type': 'application/json'},
    body: JSON.stringify({
      sessionOrUserRef: /* existing session identifier */,
      categories: consent,
      timestamp: consent.ts,
      noticeVersion: consent.version,
      userAgent: navigator.userAgent
    })
  });
}

Consent Auto-Expiry

Supports the requirement that consent isn't treated as indefinite. Run this on every page load, before re-applying any stored consent.

(function () {
  var EXPIRY_DAYS = 365; // align with your own re-consent policy
  var stored = localStorage.getItem('cookie_consent');
  if (stored) {
    var consent = JSON.parse(stored);
    var ageDays = (Date.now() - consent.ts) / (1000 * 60 * 60 * 24);
    if (ageDays > EXPIRY_DAYS) {
      localStorage.removeItem('cookie_consent');
      // Denied defaults apply again; banner logic shows the prompt
      // as if this were a first visit.
    }
  }
})();

Reusable Reference Copy

The wording below is genuinely reusable, organisation-agnostic reference copy. Replace the organisation name and Cookie Policy link with your own, and translate it if your audience meaningfully includes non-English speakers, since real, informed consent depends on language a visitor actually understands.

A QA Checklist Anyone Can Run, No Coding Required

Use this before any launch, and periodically on live sites. Open the site in an incognito or private window, open the browser's DevTools (F12) and go to the Network tab, before doing anything else.