Home › Free tools › Website DPDP check
We open your site the way a first-time visitor would, without clicking “Accept”, and report what loads: advertising and analytics tags, cookies, the consent banner, whether “Reject” really rejects, and what your privacy notice leaves out under DPDP.
Website DPDP and tracker report1 Summary
2 What we saw
3 What this could not check
Observations from one automated visit, from our server in India, set against the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. What a site loads can differ by visitor, country and time, and the notice is searched for words, so check anything marked missing by reading it. Guidance, not legal advice or an audit; see the terms.
The questions people search for before they run the check.
The Act does not mention cookies. It says personal data may be processed on consent, or on a listed legitimate use, and that consent must be free, specific, informed and given by a clear affirmative action. Advertising and analytics tags that identify a visitor process personal data, and no legitimate use covers advertising, so in practice they need consent first, and a banner is how most sites ask for it.
Open the site in a private window, open the browser's developer tools on the Network tab, and reload without clicking anything on the banner. Every request to another company's address is listed there. This check does the same from our server and names the common services for you: advertising, analytics and session recording.
Not under DPDP. Section 6(1) asks for consent that is unambiguous, with a clear affirmative action. Carrying on using the site is not an action that says yes. A banner needs a real choice, and nothing optional should load until the visitor makes it.
Section 5 and Rule 3: what personal data is collected and for what purpose, how to withdraw consent, how to use the rights to access, correct and erase data and to nominate someone, and how to complain to the Data Protection Board. Rule 9 adds the contact details of a person who can answer questions about the processing.
It opens the one page you name, and the privacy notice it links, in a headless browser on our server in India, the way a first-time visitor would. It clicks nothing except the banner's reject button, types nothing and submits nothing. The result comes back to your browser and nothing about the check is stored.
No. It reports what one automated visit observed, set against the sections of the Act and the Rules, which it names. What a site loads can differ by visitor, country and time, and whether a legitimate use applies depends on facts it cannot see.
The detailed review covers every page template, the “Accept” path, forms and signed-in pages, and the tag manager itself, so what you fix stays fixed when marketing adds the next tag.