Free tool
DPDP website checker
Enter a website and get a checklist of what India's DPDP Act generally expects on it: notices at forms, consent before tracking, and a complete privacy notice.
We read the public homepage and up to 4 linked pages once and don't store them. Results are cached for an hour.
This first version reads each page's HTML and headers. It can't see trackers, banners or cookies that JavaScript adds after the page loads, or forms embedded from other services. For a full check, PrivacyPilot renders pages in a real browser.
PrivacyPilot renders every page in a real browser, catches trackers set by JavaScript, and drafts your privacy notice, data inventory and consent banner.
This is an automated check and general information, not legal advice.
What the DPDP Act means for a website
India's Digital Personal Data Protection Act, 2023, with its Rules now being phased in, applies to personal data collected in digital form. For most organisations the first place it shows is the website: contact forms, newsletter sign-ups, job applications and appointment bookings all collect personal data, and analytics and advertising tags collect identifiers about every visitor.
The Act generally expects you to give a clear notice when you ask for consent, saying what personal data you collect and why; to collect consent that is free, specific, informed and unambiguous; to make withdrawing consent as easy as giving it; to provide a way to raise grievances; and to tell people how to complain to the Data Protection Board of India.
What this checker looks at
- Forms: any form asking for a name, email, phone number, address, date of birth or a file such as a CV, and whether notice or consent text appears next to it.
- Trackers: Google Analytics and Tag Manager, Meta Pixel, LinkedIn Insight, Hotjar, Microsoft Clarity, TikTok and similar tags in the page's HTML.
- Consent tooling: consent management platforms such as Cookiebot, OneTrust or CookieYes, or cookie consent text on the page.
- Privacy notice: whether one is linked from the homepage, and whether it mentions the DPDP Act, the purpose of processing, how to withdraw consent, a grievance contact and the Data Protection Board.
- Cookies: cookies the server sets on the first response, before a visitor could make any choice.
Fixing the common gaps
Add a short notice beside every form: what you'll use the details for, how long you'll keep them, and a link to your full privacy notice. Use a separate, unticked checkbox for anything optional, such as marketing emails, rather than bundling it with the purpose the person came for.
Load analytics and advertising tags only after the visitor agrees. A consent tool helps, but check it actually blocks the tags until a choice is made: many sites install a banner while the tags still load first. Make "Reject" as easy to find as "Accept".
Rewrite the privacy notice in plain language. List what you collect and why, who you share it with, how long you keep it, how to withdraw consent, who to contact with a grievance, and how to complain to the Data Protection Board. The notice should be available in English and, where your visitors need it, in the languages of the Eighth Schedule.
Limits of an automated check
This check reads HTML; it doesn't run JavaScript or click anything. It can miss tags loaded by a tag manager, banners drawn by scripts and forms embedded from other services, and it can't judge whether your notice is accurate. It's a fast first pass, not an audit. Our DPDP website guide walks through each requirement.
FAQ
Questions
Does the DPDP Act apply to my website?
If the site collects personal data from people in India in digital form, such as through forms, accounts or tracking, it generally does, whatever the size of the organisation.
Do I need a cookie banner under DPDP?
The Act has no cookie-specific rule, but analytics and advertising tags process personal data, so consent is generally needed before they run. A banner is the usual way to ask.
Why does the check say no trackers when I know we use Google Analytics?
If the tag is added by Google Tag Manager or another script after the page loads, it isn't in the HTML this check reads. PrivacyPilot renders the page in a browser to catch these.
What should a form notice say?
What data you're collecting, why, how long you'll keep it, and a link to your privacy notice. Optional uses like marketing need their own unticked checkbox.
Do you store the pages you check?
No. Pages are read once to build the checklist and discarded. Results are cached for an hour, then deleted.
Is this legal advice?
No. It's an automated check of common website issues. Confirm your obligations with a lawyer.