Cookies, Pixels and Analytics: Website Tracking Risk Checklist
A website-tracking control for cookies, pixels, SDKs, device identifiers, analytics, advertising and cross-domain data.
A cookie banner is not the control. The real control is whether scripts behave consistently with the user’s choice and stated purpose.
The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
Device identifiers, IP addresses and behavioural events can be personal data when they relate to an identifiable individual.
First-party analytics, security cookies, advertising pixels and embedded tools have different purposes and risks.
Notice and consent readiness should be built from the actual tag and SDK inventory.
What the organisation should understand
- The DPDP framework is phased. The 14 November 2025 commencement notification brought specified institutional and enabling provisions into force immediately; section 6(9), section 27(1)(d) and rule 4 follow after one year; most operating duties and rules follow eighteen months after Gazette publication. As of 22 June 2026, readiness should distinguish current law from future-state DPDP controls.
- Device identifiers, IP addresses and behavioural events can be personal data when they relate to an identifiable individual.
- First-party analytics, security cookies, advertising pixels and embedded tools have different purposes and risks.
- Notice and consent readiness should be built from the actual tag and SDK inventory.
- Server-side tracking and fingerprinting can continue even when visible cookies are limited, so technical testing matters.
The five-point review
| Check | What to examine |
|---|---|
| Tracker | Cookie, pixel, SDK or server event. |
| Provider | First party or external vendor. |
| Purpose | Security, function, measurement or advertising. |
| Choice | Before and after consent or withdrawal. |
| Transfer | Fields, destination and retention. |
Practical example
A site rejects optional cookies, but an advertising tag still sends an email hash and page events server-side. The preference record and actual system behaviour contradict each other.
How to apply the framework
Use automated scans plus manual network testing across logged-out, logged-in, accept and reject states.
Configure tag managers so optional categories cannot fire before the required signal and re-test after upgrades.
Operating workflow
Define the processing or incident precisely
Identify the people, data, system, purpose, owner, vendor and transaction or event. Review tracker, provider and purpose together. Do not start from a policy template or software feature; start from what the business and system actually do.
Separate current duties from future-state DPDP readiness
Apply the 14 November 2025 commencement notification provision by provision. Continue complying with currently operative IT, CERT-In, telecom, banking, insurance, employment, consumer, contract and criminal-law requirements. Build the future DPDP process now, but do not describe a scheduled rule as already legally operative.
Preserve proof and improve the system
Keep the approved decision, notice or workflow version, access or event logs, vendor evidence, user communications and remediation record. Update product design, role access, retention, support scripts or incident playbooks so the same weakness does not recur.
Action checklist
- Inventory tags and SDKs.
- Classify purposes.
- Test all consent states.
- Minimise transmitted fields.
- Assess vendors.
- Archive evidence.
Evidence to keep
- Tracker inventory
- Network scans
- Banner versions
- Tag-manager rules
- Vendor contracts
Warning signs
- All cookies called essential
- Reject does not stop tags
- Hashed email called anonymous automatically
- No pixel owner
- SDK added without review
Finin2min takeaway
Privacy governance is an operating system, not a policy PDF. The data map, purpose, access, vendor, retention, user workflow, incident response and evidence file must all tell the same story.