DPDP consent: what a valid consent request looks like
A cookie banner that says "By continuing you agree" will not meet the DPDP Act's definition of consent. This is what Section 6 asks for, in plain language.
The six tests in Section 6(1)
Consent must be free, specific, informed, unconditional and unambiguous, given with a clear affirmative action. It must be for a specified purpose and limited to the data necessary for that purpose.
- Affirmative action: the customer has to do something, such as ticking a box or pressing "Accept". Pre-ticked boxes and silence do not fit this.
- Specific: ask per purpose (analytics, marketing and so on), not one lump agreement.
- Unconditional: do not make unrelated consent a condition of buying.
Plain language, and the choice of language
Section 6(3) requires every consent request to be in clear and plain language. The customer must be able to read it in English or any language listed in the Eighth Schedule to the Constitution, and it must give contact details for the person who handles their requests.
Withdrawing must be as easy as giving
Section 6(4) gives the customer the right to withdraw consent at any time, and says the ease of withdrawing must be comparable to the ease of giving it. If saying yes takes one click, saying no cannot take a form and a week. Under Section 6(6), once consent is withdrawn you must stop processing for that purpose within a reasonable time, unless the law requires or authorises it.
You have to be able to prove it
Section 6(10) says that if a question arises in a proceeding, you must prove that a notice was given and that consent was given in accordance with the Act. Keep a record of each decision: when it happened, what the customer chose, and which version of the notice they saw. A banner that is only a visual layer, with nothing saved, does not give you that.
Your tracking has to follow the choice
Collecting a choice is half the job. If a customer declines marketing, your marketing tags must stop. On Shopify the platform route is the Customer Privacy API, which tells Shopify's pixel manager what the customer allowed. A banner that ignores the answer does not protect you.
What does not need consent
Do not ask consent for things you can do under a legitimate use in Section 7, for example processing needed to deliver an order the customer placed. Asking where you do not need to can confuse customers and muddy your records.