What the DPDP Act requires
Cookies and trackers that collect personal data need the same lawful basis as any other collection — a clear notice and, where applicable, consent before tracking begins. Analytics, advertising and other non-essential cookies cannot fire until the visitor has agreed, and the visitor must be able to refuse as easily as accept and change their mind later.