DPDP Rules 2025: 5 Changes to Make on Your Website (Checklist for Indian Site Owners)

If you run a website that collects anything from Indian visitors (a contact form, a newsletter signup, Google Analytics, a Meta pixel), the Digital Personal Data Protection (DPDP) Rules now apply to you on a fixed timetable. Today, 13 November 2026, the second phase starts, and the rules that matter most to website owners start on 13 May 2027.

That gives you six months. Most of the work is technical, and it is the kind of thing a sysadmin can finish in an afternoon. This checklist covers the five changes to make on your site, in the order I would do them.

Note: this is a practical guide from an infrastructure point of view, not legal advice. If you process data at scale or handle children’s data, talk to a lawyer.

The key dates (bookmark these)

The DPDP Rules, 2025 were notified by MeitY on 13 November 2025 (Gazette notification G.S.R. 846(E)) and roll out in three phases:

Date	What starts	Does it affect your website?
13 Nov 2025	Rules 1, 2 and 17–21: definitions and the Data Protection Board of India	No direct work
13 Nov 2026 (today)	Rule 4: registration and duties of Consent Managers	Only if you plan to accept consent through a registered Consent Manager
13 May 2027	Rules 3, 5–16, 22 and 23: notice, consent, security, breach reporting, data erasure, user rights, children’s data	Yes, this is the big one

Until 13 May 2027 the older SPDI Rules, 2011 stay in force, so you are not in a gap where nothing applies.

1. Put up a real consent banner

The DPDP Act does not use the word “cookie”. What it regulates is personal data, and analytics and ad tools collect plenty of it: IP addresses, device IDs, cookie IDs tied to a browser. Running analytics or ads is not one of the Act’s “legitimate uses”, so consent is the basis you should rely on.

Consent under the Act has to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. In practice that means your banner needs:

• “Accept” and “Reject” buttons of equal size and weight. No hiding Reject behind a settings link.
• No pre-ticked boxes and no “by continuing to browse you agree” wording. Scrolling is not consent.
• Separate choices per purpose (for example Analytics and Advertising), since consent must be specific.
• A way to change your mind later: a “Cookie settings” link in the footer. Withdrawing consent must be as easy as giving it.
• A record of the choice (what was accepted, when, banner version). Store it in a first-party cookie or localStorage and, if you can, log it server-side.

On WordPress, plugins such as Complianz, CookieYes or Cookiebot handle the banner and the blocking. If you do not want a plugin, the next section shows the manual way.

2. Block analytics and ad pixels until the visitor agrees

This is the easiest high-impact fix, and you can do it today. Most sites load Google Analytics, Google Ads tags and the Meta pixel on every page view, before the visitor has said anything. Change that so nothing that tracks fires until consent is given.

Google tags: use Consent Mode v2 with “denied” by default

Put this above your Google tag (gtag.js or GTM) in the <head>:

<script>
  window.dataLayer = window.dataLayer || [];
  function gtag(){dataLayer.push(arguments);}
  // Everything off until the visitor chooses
  gtag('consent', 'default', {
    'analytics_storage': 'denied',
    'ad_storage': 'denied',
    'ad_user_data': 'denied',
    'ad_personalization': 'denied',
    'wait_for_update': 500
  });
</script>

When the visitor clicks Accept, update it:

gtag('consent', 'update', {
  'analytics_storage': 'granted',
  'ad_storage': 'granted',
  'ad_user_data': 'granted',
  'ad_personalization': 'granted'
});

Be aware that in “advanced” Consent Mode Google still sends cookieless pings while consent is denied. If you want nothing sent at all before consent, use “basic” mode: do not load the Google tag until Accept is clicked.

Meta pixel and other third-party scripts: don’t let the browser run them

Change the script type so the browser ignores it, then switch it on after consent:

<!-- Browser will NOT execute this -->
<script type="text/plain" data-consent="ads">
  !function(f,b,e,v,n,t,s){ /* Meta pixel code here */ }
  fbq('init', 'YOUR_PIXEL_ID');
  fbq('track', 'PageView');
</script>

<script>
function enableScripts(category) {
  document.querySelectorAll('script[type="text/plain"][data-consent="' + category + '"]')
    .forEach(function (old) {
      var s = document.createElement('script');
      s.text = old.text;
      if (old.src) s.src = old.src;
      old.replaceWith(s);
    });
}
// Call from your Accept button handler:
// enableScripts('analytics'); enableScripts('ads');
</script>

Check it actually works

1. Open the site in a private window.
2. Open DevTools → Network, filter for google-analytics, googletagmanager, facebook, doubleclick.
3. Before clicking anything, you should see no tracking requests (or only gcs=G100 pings if you chose advanced Consent Mode).
4. Check Application → Cookies: no _ga, _gid or _fbp before consent.
5. Click Reject, reload, and confirm the same. Then click Accept and confirm the tags load.

Do this check after every theme or plugin update. Plugins love to re-inject tracking code.

3. Rewrite the privacy notice

From 13 May 2027, Rule 3 sets out what your notice must contain. Most Indian sites have a copy-pasted privacy policy that will not meet it. The new notice should be:

• Standalone and in clear, plain language, understandable on its own, not buried inside the terms of service.
• An itemised list of the personal data you collect (name, email, phone, IP address, cookie IDs, and so on) and the specific purpose for each item.
• A direct link to withdraw consent, as easy to use as giving it was.
• How visitors can exercise their rights (access, correction, erasure, nominating someone) and how to complain to the Data Protection Board.
• Contact details of the person who answers privacy questions (Rule 9 requires this to be published on your site). A dedicated address like privacy@yourdomain works.

Also list the third parties you share data with: your analytics provider, ad networks, email service, hosting/CDN. Visitors will often see the notice in English, but the Act lets them ask for it in any of the Eighth Schedule languages, so keep it simple enough to translate.

4. Fix your forms

Contact forms, newsletter signups, comment forms and lead-gen popups are where most small sites actually collect personal data.

• Collect only what you need. A contact form rarely needs a phone number and a city. Remove optional fields you never use.
• Add a short notice next to the submit button: what you collect, why, and a link to the privacy notice.
• Use an unticked checkbox for anything beyond answering the request, such as marketing emails. Answering the enquiry itself does not need a separate marketing consent.
• Set a retention period and enforce it. Delete form entries once the purpose is served. In WordPress, plugins like Flamingo, WPForms and Contact Form 7 add-ons keep entries forever by default; add a cron job or use the plugin’s auto-delete setting.
• Check your logs and backups. Rule 6 asks you to keep access logs for at least one year for security, but form data sitting in old database dumps is still personal data. Encrypt backups and rotate them.
• Children: under the Act anyone under 18 is a child, and processing their data needs verifiable parental consent (Rule 10). If your site targets students or kids, plan for this now.

5. Prepare for breaches and erasure requests

The last part of the checklist is not on the website itself but behind it:

• Breach reporting: under Rule 7 you must tell affected users without delay and send a detailed report to the Data Protection Board within 72 hours. Write down now who does what if your database leaks.
• Security basics: HTTPS everywhere, encrypted backups, MFA on the admin panel, least-privilege database users, and access logs kept for a year. Penalties for failing to protect data can reach ₹250 crore, so this is not optional.
• Erasure requests: know how to find and delete one person’s data across your database, form plugin, email list and CRM.
• Vendors: your email marketing tool, CRM and hosting are processing data on your behalf. Check their terms cover security and deletion.

Quick summary: the 5-point checklist

1. Consent banner with equal Accept/Reject, per-purpose choices and a footer link to change settings.
2. Block analytics and ad pixels until consent: Consent Mode v2 “denied” by default, type="text/plain" for other pixels, verify in DevTools.
3. Privacy notice rewritten: itemised data, specific purposes, withdraw-consent link, rights, contact person.
4. Forms: collect less, explain why, unticked marketing checkbox, auto-delete old entries.
5. Key dates: Consent Manager rules from 13 Nov 2026; full website duties from 13 May 2027. Have a breach plan ready before then.

Item 2 alone takes less than an hour, and it is the one change I would make today. The rest you can schedule across the next six months.