DPDP consent for GA4, cookies, ad pixels and CRM in India: May 2027

Summary. From 13 May 2027, the date India's DPDP Rules fully apply on the Gazette count, the consent provisions of the DPDP Act, 2023 reach, in our reading, the cookie IDs, IP addresses, click IDs and hashed emails that GA4, Google Ads, Meta and CRM tools collect. The Act allows processing only with consent or under the closed list of legitimate uses in section 7, so analytics and advertising tags need opt-in consent, a Rule 3 notice that itemises the data, and comparably easy withdrawal. Google's EU user consent policy covers the EEA, the UK and Switzerland, so Google does not force Consent Mode on Indian traffic; it is still the cleanest way to honour choices across Google tags. Meta's Conversions API is designed not to accept unhashed contact details. Server-side tagging on Cloud Run costs about $45 per server per month, with two servers recommended, and does not replace consent. Tracking or targeted advertising directed at children is barred unless an exemption applies, with penalties up to ₹200 crore. A 13-row tag audit table follows.

About this article. This is for marketing, analytics and privacy leads running tags and CRM for Indian audiences. On 1 November 2026 we checked the law against the English Gazette copies on MeitY's site (the Act as published on 11 August 2023, G.S.R. 843(E), G.S.R. 846(E) with the corrigenda G.S.R. 892(E), and S.O. 5458(E)), and vendor behaviour against Google and Meta documentation. This is general information, not legal advice, and the mapping of tags to legal grounds is our reading. Vendors change tag behaviour often, so re-check before you ship. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What changes for marketing data on 13 May 2027

The Act's consent provisions (sections 4 to 7, apart from section 6(9)) and Rule 3 on notices are in the eighteen-month commencement group, which computes to 13 May 2027. Penalties start then too: up to ₹50 crore for breaching provisions such as notice and consent, ₹200 crore for children's data failures and ₹250 crore for failing to take reasonable security safeguards, where the Board finds the breach significant. Our DPDP Rules 13 May 2027 checklist covers the full timeline, the 12-month proposal that has not been notified, the Board, and the news publishers' Supreme Court challenge. In that case the court issued notice on 27 October 2026 and reportedly refused an interim stay; it returns on 17 November 2026.

Six provisions decide what a marketing stack has to do:

1. Personal data is broad. Section 2(t) covers data about any individual who can be identified by or through it. A GA4 client ID, a Meta browser cookie, a GCLID tied to a CRM record or a hashed email used for matching all qualify, in our reading, once they can be tied to a person.

1. Two grounds only. Section 4 permits processing with consent or for the legitimate uses in section 7, a closed list: voluntarily provided data for a specified purpose, state benefits and functions, legal obligations, court orders, medical emergencies, epidemics, disasters and employment. Analytics and advertising are not on it.

1. The consent standard. Section 6(1) requires consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to the data the purpose needs. Pre-ticked boxes and banners that treat browsing as agreement do not meet it.

1. The notice. Rule 3 requires a standalone plain-language notice with an itemised description of the data, the specified purpose, and links to withdraw consent, exercise rights and complain to the Board. Section 5(3) adds the option to read it in English or any Eighth Schedule language.

1. Withdrawal and proof. Section 6(4) makes withdrawal comparably easy to giving consent. Section 6(10) makes you prove notice and consent in any proceeding, so the consent log is evidence.

1. Children. Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at anyone under 18, subject to the Rule 12 exemptions. Rule 10 requires verifiable parental consent before processing a child's data.

Consent or legitimate use? Sorting marketing activities

The table is our reading of how common activities map to the two grounds. It is not settled law, and we found no Board guidance on cookies. Our DPDP engineering playbook maps the wider systems work.

The practical result for most Indian sites: everything except strictly necessary storage should wait for an affirmative choice.

Google Consent Mode for Indian traffic

Consent Mode is Google's API for passing a visitor's choice to Google tags. It supplies no banner; it takes the choice from your banner or consent management platform (CMP) and changes tag behaviour.

What Google requires, and where

Google's EU user consent policy obliges advertisers to obtain consent from end users in the European Economic Area, the UK and Switzerland. India is not on that list. DPDP is the reason to use Consent Mode: it is the mechanism Google's own tags understand.

The consent types

Google documents these consent types; the purpose column is our mapping.

Basic or advanced mode

Basic mode blocks Google tags until the visitor interacts with the banner, and Google says a visitor who declines sends nothing, not even the consent state. Advanced mode loads tags at once and, while consent is denied, sends cookieless pings that can carry a timestamp, user agent, referrer, whether an ad-click ID was present and the consent state. Google uses those pings for advertiser-specific conversion modelling; basic mode gets a general model.

Do not rely on Google's defaults. Its developer guide says no consent values are set unless you set them, and its Ads help says advanced mode can default to a consented state until a choice is made, with regional differences for the EEA, Switzerland and the UK. Set every default to denied yourself.

We recommend basic mode for Indian traffic until your counsel has signed off on advanced. The pings carry no cookie, but they are still requests from a person's browser, and the DPDP has no carve-out for cookieless measurement. If you choose advanced, set ads_data_redaction to true so ad-click identifiers are redacted while ad_storage is denied; without it, Google says full page URLs with click IDs are still collected.

Run the commands below before anything that sends measurement data. They do not give you basic mode by themselves: your CMP or tag manager must also keep the Google tag from loading until the visitor has acted on the banner.

            // Nothing non-essential until the visitor chooses
gtag('consent', 'default', {
  analytics_storage: 'denied',
  ad_storage: 'denied',
  ad_user_data: 'denied',
  ad_personalization: 'denied'
});
gtag('set', 'ads_data_redaction', true);

// After the visitor accepts analytics only
gtag('consent', 'update', { analytics_storage: 'granted' });
          

Ask separately for analytics and for advertising. A single accept-all with no granular option is hard to square with specific consent.

GA4 settings to change before May 2027

• Know what GA4 collects about Indian users. For users outside the EU, Switzerland and UK, Google says it collects IP addresses for spam detection and coarse location, discards raw addresses after use, and may pass encrypted ones to linked Google Ads accounts. Put this in your notice.

• Pick a retention period deliberately. GA4 offers 2 or 14 months for user-level data on standard properties, and cuts event-level retention to 2 months when a property becomes Large. DPDP pulls two ways: erase when the purpose is served (section 8(7)), but Rule 8(3) requires keeping personal data, traffic data and processing logs for at least one year for the Seventh Schedule purposes. Whether Rule 8(3) reaches analytics event data is unclear; 14 months clears that floor and 2 months may not. Take advice before choosing 2.

• Treat Google signals as consent-dependent. Signals adds data from signed-in Google users, can be switched off by region, and expires after 26 months or your shorter retention. With ad_storage denied, signals features do not accumulate data.

• Keep PII out of URLs and events. Google's policy bars sending it to Analytics, and it warns that page URLs and titles often carry it by accident.

• Wire up erasure. The Admin API's v1alpha submitUserDeletion method deletes a user's data from a property. Connect it to your rights-request workflow.

Google Ads and Meta pixels

Google Ads

With ad_storage denied, Google says no advertising cookies are written or read and Ads products truncate IP addresses at collection. With ad_user_data denied, user_id and hashed enhanced-conversions data are not collected for advertising. With ad_personalization denied, remarketing gets no data. For data uploads, Google tells advertisers to obtain consent where applicable and to send consent with the upload. Under DPDP, treat it as applicable: upload only contacts who agreed to ad matching, and record where that consent came from.

Meta Pixel

Meta documents a consent API for the Pixel: call fbq('consent', 'revoke') on every page before init, then fbq('consent', 'grant') once the visitor agrees. The Pixel receives HTTP headers including IP address, the Pixel ID and Facebook cookie, button-click data, optional custom values and form field names, with field values only if you send them through Advanced Matching or conversion tracking.

Meta Conversions API

Meta says its systems are designed not to accept unhashed contact information, and fields such as email (em) and phone (ph) require hashing. The same page says client_ip_address must never be hashed, client_user_agent is required for website events and must not be hashed, and contact information is used for matching. Matching a hash to an account is identification, so in our reading hashed fields remain personal data under section 2(t). Send these events only for visitors whose stored consent covers advertising.

Server-side tagging: what it fixes and what it does not

A server-side Google Tag Manager container receives browser events on your own subdomain and forwards them to vendors. Google's Cloud Run guide prices each server at about $45 a month and recommends a minimum of two instances. That puts the floor at about $90 a month (2 × $45) before the preview server, logging and traffic charges. Google warns that request logging above roughly a million requests a month can add significant cost.

What it fixes:

• Minimisation. You can strip IPs, truncate URLs and drop fields a vendor does not need.

• Control. One place to enforce consent before data is forwarded, and to log what was sent.

What it does not fix:

• Consent. Google says consent mode is set up in the web container and Google product tags in the server adjust to it. That covers Google's tags only. Third-party server tags, such as a Meta Conversions API template, need their own consent condition.

• Data location. Hosting the container in an Indian Google Cloud region does not keep GA4 or Meta data in India. The Act allows transfers abroad unless the government restricts a country by notification, and we found no published country list or order as of 1 November 2026.

CRM, email and messaging

The CRM is where marketing data lives longest, so it carries the most DPDP risk after 13 May 2027. Our guide to a consent-aware first-party CDP covers the schema side.

• Forms. Separate unticked checkboxes for each purpose: reply to my enquiry (section 7(a)), send me product updates (consent), share with partners (consent, named). Store the notice version and timestamp with the record.

• Unsubscribe is withdrawal. One click to subscribe means one click to leave (section 6(4)), and section 6(6) requires processing to stop within a reasonable time, at your email platform too.

• Erasure across processors. Section 8(7) requires your processors to erase as well. A CRM deletion that leaves the contact in the email tool or ad audience has not been honoured. Rule 8(3) still sets a one-year minimum for personal data and processing logs, so agree the timing with counsel.

• Suppression lists. Keeping a minimal record so a withdrawn contact is not re-imported is common, but we found no explicit DPDP rule on it.

• Legacy lists. Section 5(2) covers consent given before commencement: you owe those people a notice and may keep processing until they withdraw. Section 1(2) reads such references as the provision's own start date, which for section 5 points to 13 May 2027, so consent you collect until then may count as legacy consent. It does not rescue contacts who never consented. Our legacy data remediation guide covers the steps.

A CMP is not a DPDP Consent Manager

A cookie CMP is software you buy. A DPDP Consent Manager is a company incorporated in India, with net worth of at least ₹2 crore, registered with the Data Protection Board under Rule 4, which lets individuals manage consent across many businesses. Rule 4 starts on or about 13 November 2026, but registration needs a working Board, and we found no published appointment of a chairperson or member as of 1 November 2026. Our consent manager readiness checklist covers integration.

The tag audit table

Run this against your tag manager, site source and CRM, one row per tag or tool. The signals come from the Google and Meta pages cited above.

A worked example: what consent does to your numbers

Take a D2C site with 300,000 monthly sessions from India and assume, for illustration only, that 40% of sessions come from visitors who decline analytics and advertising. In basic mode, GA4 observes about 180,000 sessions (300,000 × 0.6) and Google Ads sees conversions only from the consenting 60%. Server-side tagging costs a floor of about $90 a month, or $1,080 a year ($90 × 12), plus logging. The bigger job is the reporting reset: brief leadership in March 2027 that observed numbers will fall, and that the drop reflects consent, not demand. Measure your own decline rate during a soft launch.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our server-side tagging and consent measurement service audits tag managers, CMPs and CRMs against these rules and rebuilds measurement on consented data, alongside your legal counsel. Talk to us at /contact-us/.

Last updated: 1 November 2026.

References

1. Commencement notification, G.S.R. 843(E), Gazette No. 757 dated 13 November 2025 — Ministry of Electronics and Information Technology

1. Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), Gazette No. 760 dated 13 November 2025 — Ministry of Electronics and Information Technology

1. Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Gazette No. 25 dated 11 August 2023 — Ministry of Electronics and Information Technology

1. EU user consent policy — Google

1. Customer Information Parameters, Conversions API — Meta for Developers

1. Set up server-side tagging with Cloud Run — Google for Developers

1. Newsrooms will shut down: digital news publishers challenge DPDP law in SC, 27 October 2026 — The Federal

1. About consent mode — Google Ads Help

1. Consent mode overview, last updated 30 July 2026 — Google for Developers

1. Set up consent mode on websites — Google for Developers

1. Usage of IP address for non-EU, non-Switzerland, or non-UK users — Google Analytics Help

1. Data retention — Google Analytics Help

1. Activate Google signals for Google Analytics properties — Google Analytics Help

1. Best practices to avoid sending Personally Identifiable Information (PII) — Google Analytics Help

1. Method: properties.submitUserDeletion, Admin API v1alpha — Google for Developers

1. General Data Protection Regulation, Meta Pixel implementation — Meta for Developers

1. Implement consent mode with server-side Tag Manager — Google for Developers

1. Judgment in WP(PIL) No. 15 of 2026, C R Neelakandan v Union of India, 7 October 2026 (copy hosted by LiveLaw) — High Court of Kerala