A fair number of Indian Shopify stores already have some kind of cookie banner, usually left over from a theme, an app installed years ago for a GDPR audience, or a one-off copy paste from another store. It sits at the bottom of the page, has a single "Accept All" button, and the founder has not thought about it since. The problem is that this kind of banner was built to answer a European question, and the Digital Personal Data Protection Act is asking a different one.
What GDPR-style banners actually do
A typical "Accept All" banner is built around a single, bundled decision. The shopper sees one message about cookies and trackers in general, and one button that waves through everything behind it, analytics, advertising pixels, personalisation scripts, in one click. It is designed for speed, and it treats consent as a single yes or no gate at the front door, after which the visitor's relationship with every tool on the page is settled.
What DPDP consent is actually meant to be
The DPDP Act does not work that way. Consent under the Act is meant to be specific to the purpose the data is being collected for, and it has to be capable of being withdrawn as easily as it was given. That is a meaningfully different shape of permission than a bundled "Accept All" click. A shopper who is fine with you sending order updates on WhatsApp may not be fine with the same number being used for retargeting ads on Meta. A shopper who wants product recommendation emails may not want their browsing behaviour fed into an ad pixel. A single banner that bundles all of that behind one button cannot represent that shopper's actual choice, because it never gave them the chance to make it.
Withdrawal is the part that gets skipped most often. Once a shopper clicks Accept All, most store owners have no idea how that shopper would go back and say no to one specific use while keeping another. There is usually no visible way to revisit the choice at all. A consent mechanism that cannot be withdrawn as easily as it was given is not doing what the Act expects of it, regardless of how polished the banner looks.
Why this is an easy gap to miss
None of this is really a lapse in judgement by the founder. The cookie banner apps available to most Shopify stores were built for a different regulation, with a different definition of what counts as valid consent, and they were never rebuilt with DPDP's purpose-specific standard in mind. A store owner who installed one in good faith years ago has reasonable grounds to assume the box is ticked. It usually is not, and the gap only becomes visible when someone actually compares what the banner records against what the Act asks for: consent tied to a stated purpose, logged in a way that can be checked later, and withdrawable without the shopper needing to write in and ask.
The fix is not a more aggressive banner or a longer list of toggles that nobody reads. It is a consent record that is actually tied to the purposes you have told shoppers about, stored as proof rather than assumption, and visibly reversible.
Consent Jet puts a consent banner on your storefront that logs each shopper's answer as tamper-evident proof against the purposes named in your privacy notice, rather than a single bundled accept-all click, so what you can show you asked for matches what the Act actually requires.