Cookies & Tracking

SL-03

The Act never says the word cookie, and that is the point. A cookie is not regulated as a cookie — it is regulated by what it does. If it carries personal data, setting it is processing, and processing needs a lawful ground. Everything here follows from that one sentence.

DischargesS.4 S.6 S.5 S.9 S.16

Live preview Run a scan

7 non-essential cookies are set before the visitor has agreed

_ga, _gid, _fbp, IDE, yt-remote-device-id, advertising_id, canvas_fp. Each carries personal data and fires on page load, which means consent under Section 6 was never obtained — the banner is asking permission for something that has already happened. This is the single most common cookie finding and the easiest for anyone to verify from outside with a browser inspector.

Set before consent

Blocked

180 records

Scan in progress — pension.aiventuretech.io

418 pages crawled so far.

All scans

62% complete · 6 cookies found · started yesterday

By category

Only the first band may be set without consent.

Strictly necessary3
Functional3
Analytics4
Advertising & targeting4

Banner outcomes over 30 days

Reject is a valid outcome and a healthy signal. A banner with a 99% accept rate is usually a banner with no real reject button.

Records

Findings worth acting on

Ordered by how quickly a regulator or a journalist could verify them from outside.

Critical7 trackers fire before consent

Verifiable with a browser inspector in under a minute. Section 6.

Critical6 cookies carry personal data with no declared purpose

A cookie without a purpose in the registry is processing without a stated purpose. Section 4 read with Section 5.

High8 cookies send data outside India

Each needs a basis under Section 16 and an entry in the transfer register.

CriticalAdvertising trackers on a portal used by students

Section 9(3) prohibits tracking and behavioural advertising directed at children outright. ₹200 crore ceiling.

HighSession replay records form fields as they are typed

On a page collecting income and bank details, that is a recording of sensitive data labelled as analytics.

Current banner

What visitors are being shown right now.

Edit

v3.1bottom barEN · HIRe-ask after 180 days

Reject-all button present: Yes
Buttons equally prominent: Yes
Per-category choice offered: Yes

See it as a citizen does

Who is answering it

Across the last 45 days of records.

Accepted: 82
Rejected: 52
Chose individually: 38
Answered in Hindi: 59%

More than half of visitors answer in Hindi. A banner available only in English would not be informed consent for most of the people seeing it.

Why a cookie banner is not the compliance

It is the visible part, and the part most often mistaken for the whole.

A banner that appears after the tracker fires

changes nothing. Consent must precede processing, so the tag has to be held back — which is a script-loading problem, not a design problem.

A cookie that leaves India

engages Section 16 whatever the visitor clicked. Consent to analytics is not consent to transfer.

A tracker that stores nothing

is invisible to a cookie banner and survives clearing cookies. Fingerprinting is still processing.

Children cannot consent to tracking

and no banner design fixes that. On any surface a child may reach, behavioural advertising is simply not available.

Cookie inventoryEvery cookie, tracker, pixel and SDK, with whether it carries personal data and which purpose authorises it.Banner designerLayout, wording in both languages, and the symmetry checks that stop a banner becoming a dark pattern.Live previewSee the banner and the preference centre exactly as a citizen sees them, on a website and in the app.Script controlWhich tags are held back until consent arrives. This is where the pre-consent problem is actually fixed.

Related