ASCI Academy releases white paper on navigating cookies in the age of DPDPA

The Advertising Standards Council of India (ASCI) Academy, in collaboration with PSA Legal and Tsaaro Consulting, has released a comprehensive white paper titled Navigating Cookies: Recalibrating your cookie strategy in light of the DPDPA to commemorate Data Privacy Day.

This paper builds on ASCI's ongoing efforts to address data privacy concerns, following the Privacy and Progress: Pillars of Digital Bharat paper published in March 2023, which focused on preparing organizations for Digital Personal Data Protection Act (DPDPA) compliance.

Manisha Kapoor, CEO & Secretary-General, ASCI, said, "The paper aims to help advertisers understand and prepare for cookie consent practices that are both compliant with the new DPDPA as well as build consumer trust and transparency. The paper provides practical knowledge and insights to create effective cookie practices in a privacy-conscious world."

Cookies are an important feature of most internet interfaces and can help create value for both advertisers and consumers. Advertisers use cookies to gather data on user behaviour, preferences and browsing history to deliver targeted ads that drive higher engagement and better ROI. For consumers, cookies can streamline browsing by personalizing content, remembering preferences and simplifying website interactions.

However, the use of cookies raises concerns about privacy, data security and user autonomy when users remain unclear about how their data is collected, shared, or monetized.

A dipstick done for the purpose of this paper analysed the cookie consent practices of the top 50 websites in India, accounting for 30 billion visits in December 2024 alone. The results show that only 6 percent of them are ready for specific consent as outlined by the DPDPA 2023, read with the draft DPDP rules published on January 3, 2025. While the DPDPA is likely to provide a runway for compliance, the results indicate a need for organizations to take up cookie consent best practices as a part of their compliance readiness efforts.

Dhruv Suri, Partner, PSA Legal, said, “With the final DPDPA Rules on the horizon, advertisers are at a crossroads where privacy, technology, and the law converge. Once the law is better understood, the technology, i.e., cookies, will no longer be mere marketing tools but will serve as a means to strengthen customer loyalty. Global precedents can serve as the perfect roadmap to tailor strategies and navigate cookie consent management in a country that is just beginning its data privacy journey.

The paper explores cases and examples in other jurisdictions and sheds light on how the issue of cookie consent has been addressed in different countries. The paper provides actionable insights on crafting an effective cookie policy to help stakeholders navigate the complexities of consent, transparency, and user control in an increasingly privacy-conscious world.

“Cookie consent is no longer a checkbox exercise; it’s a strategic element of modern advertising. The first step to creating a privacy-centric ecosystem that values the customer’s data rights when deploying cookies is to acknowledge that a gap exists between existing marketing tactics and the privacy laws and then to actively work towards bridging the gap between practicality and compliance,” Akarsh Singh, CEO, Tsaaro Consulting, added.