GDPR vs DPDPA
GDPR (EU) and DPDPA (India, 2023) are often lumped together because both require opt-in consent before non-essential cookies run. That similarity hides some real differences in what a banner and backend actually have to do. Here's the practical, non-legal-jargon version — see the DPDPA Cookie Compliance Guide for the India-specific implementation checklist.
Where they agree
- Non-essential cookies (analytics, ads, personalisation) require opt-in consent — no pre-ticked boxes, no implied consent from browsing.
- Consent has to be as easy to withdraw as it was to give.
- You need a record of what was consented to and when.
- Strictly necessary cookies (session, security, load balancing) don't need consent under either law.
Where they differ
| GDPR (EU / EEA) | DPDPA (India) | |
|---|---|---|
| Legal basis beyond consent | “Legitimate interest” can justify some processing without consent | No legitimate-interest equivalent — consent is close to the only basis for non-essential cookies |
| Who has to name themselves | Data controller identified in the privacy policy | The “Data Fiduciary” name is expected inside the consent notice itself |
| Complaint contact | DPO contact, varies by controller size | Grievance officer details commonly shown alongside the consent notice |
| Children | Parental consent threshold varies 13–16 by member state | Verifiable parental consent required under 18 |
| Global Privacy Control (GPC) | Increasingly treated as a valid opt-out/objection signal by regulators and browsers | No GPC recognition in the statute — signal is not honoured |
| Regulator | National DPAs (e.g. CNIL, ICO-equivalent bodies) under the EU umbrella | Data Protection Board of India |
| Individual rights | Access, erasure, portability, objection, restriction — all explicit | Access, correction, erasure, grievance redressal, nomination (post-death) rights |
What this means for a banner and backend
In practice, a single generic “GDPR banner” reused worldwide tends to under-serve DPDPA visitors in two specific ways: it won't surface fiduciary/grievance-officer details in the notice, and it may apply the wrong age-gate threshold. The cleanest fix is treating GDPR and DPDPA as two distinct consent profiles rather than one, and routing visitors to the right one by jurisdiction.
Consenti models this directly as two separate compliance groups — opt-in for GDPR-style jurisdictions and opt-in-dpdpafor India — each with its own copy, age gate, and GPC behaviour, auto-resolved from the visitor's location. It's one implementation option if you'd rather not maintain that mapping by hand.