That is a compliance failure with a compliant-looking interface. It is also the single most common privacy defect on Indian websites today, and you can confirm whether you have it in about ten minutes with tools already in your browser.
Why a banner doesn't stop tracking
A consent banner is an interface. It collects a choice and stores it. Whether anything acts on that choice depends entirely on how your tags are wired.
Three configurations look identical to a visitor and behave completely differently:
| Configuration | What happens on first page view |
|---|---|
| Tags hardcoded in the page source | They fire immediately. The banner is decoration |
| Tags in a container that fires on page load | They fire immediately. The banner is decoration |
| Tags gated on the consent signal | Nothing fires until the visitor chooses |
Only the third is compliant. Most sites are running the first or second, because that is how tags were installed years before anyone thought about consent — and nobody revisited it when the banner went in.
What does the DPDP Act require here?
The Act contains no cookie-specific provision the way the EU's ePrivacy regime does. It regulates the processing of digital personal data. Where a cookie, pixel or tag processes personal data — and most analytics and advertising trackers do — the consent requirements in section 6 engage from 13 May 2027.
Section 6 requires consent to be free, specific, informed, unconditional and unambiguous, given by clear affirmative action. A tracker that fired before the visitor acted has, by definition, processed data without affirmative action.
Strictly necessary cookies — session management, authentication, security, load balancing, and recording the cookie preference itself — are treated differently, because they deliver a service the user has asked for. That category should be genuinely minimal, not a convenient label for anything you'd rather not gate.
How to check your own site in ten minutes
Do this on your live site, not staging.
- Open a clean browser profile. A new incognito or guest window with no existing cookies. This matters — an existing consent cookie will hide the problem entirely.
- Open DevTools before you load the page. F12 or Cmd+Option+I. Go to the Network tab and tick Preserve log.
- Load your homepage. Do not touch the banner.
- Filter the Network tab for third-party domains. Look for anything that isn't your own domain — google-analytics.com, googletagmanager.com, facebook.net, doubleclick.net, hotjar.com, clarity.ms, linkedin.com, analytics.tiktok.com. Every request to one of these, before you clicked, is a tracker that fired without consent.
- Check Application → Cookies. Anything beyond your own session and preference cookies, before you clicked, is a cookie set without consent.
- Now click Reject All. Reload. Repeat steps 4 and 5. If the same third-party requests appear, your banner is recording a preference nobody acts on. This is the worse failure of the two, because you now have a record showing the visitor declined and evidence that you tracked them anyway.
- Write down what you found, with the date. That list is your remediation scope, and the dated record is useful evidence that you looked.
The five most common causes
Hardcoded tags in the theme or template. Someone pasted a GA snippet into the header years ago. It has nothing to do with your tag manager and your banner cannot see it.
Tag manager triggers set to Page View or All Pages. The container fires on load. The consent signal arrives later and is irrelevant.
Plugins with their own tracking. Chat widgets, review platforms, heatmaps, A/B testing tools and analytics plugins each load their own scripts and are frequently invisible to the consent platform.
Consent Mode switched on but left at defaults. Enabling it is not configuring it. Defaults commonly permit measurement before consent. → Read why Consent Mode v2 isn't DPDP consent
Tags added by someone else after the banner went live. A marketing team runs a campaign and adds a pixel. Nobody tells the person who owns the consent configuration. This is why a one-time audit is not enough — you need recurring scanning.
Find every tracker firing before consent
Consiva scans every domain you add and flags anything firing before the consent signal — no manual DevTools work required.
Start Free on Consiva.ai — No Credit Card →Whose problem is this?
Under section 8(1), the Data Fiduciary — the website owner — is responsible for compliance in respect of processing undertaken by it or on its behalf, notwithstanding any agreement to the contrary. So the liability is the site owner's even where an agency installed the tags.
In practice, though, the fix is almost always agency-side, and being able to hand a client a dated before-and-after tracker inventory is a genuinely billable deliverable. If you run an agency, this test is the fastest way to open that conversation. → See our guide for digital marketing agencies
Frequently Asked Questions
Because a banner records a preference; it doesn't enforce one. Unless your tags are gated on the consent signal, they will fire on page load regardless of what the banner says or what the visitor chooses.
Open a clean incognito window, open DevTools' Network tab with Preserve log enabled before loading the page, load your homepage without touching the banner, and look for third-party requests. Anything there fired without consent.
Cookies essential to delivering a service the user has requested — session, authentication, security, and the record of the cookie preference itself — are treated differently from analytics and advertising. Keep the category genuinely minimal.
No cookie-specific provision. It regulates processing of digital personal data, so where a cookie or tracker processes personal data, section 6's consent requirements engage from 13 May 2027.
At least quarterly, and after any change to the marketing stack. Marketing teams add tags; the most common way a compliant site becomes non-compliant is a pixel nobody mentioned.
Or Have It Done for You — Free
Consiva scans every domain you add, returns the full inventory of cookies, pixels, tags and third-party scripts, and alerts you when a new tracker appears.