Website Consent Architecture: Evaluating Controls
What the automated test inspects:
- Presence of cookie consent banner markup
- Presence of explicit Accept and Reject buttons
- Link to granular preference controls
What requires human verification:
- Consent logs stored on backend servers
- Withdrawal mechanism usability (ease of revocation)
- Regional geolocation rules (e.g. EU vs India visitors)
The Pitfall of Asymmetric Consent UX
Under Section 6 of the DPDP Act and Rule 5 of the DPDP Rules, 2025, consent must be an affirmative, voluntary act. A recurring issue identified across Indian corporate websites is the presence of asymmetric interface designs — where a prominent “Accept All” button is paired only with a tiny close icon (“X”) or where rejecting cookies requires navigating through multi-step nested modals.
Automated crawlers inspect the initial DOM to detect whether visitors from Indian IP addresses are presented with an unambiguous choice.
Key UX Criteria for Defensible Consent
- Equal Visual Prominence: If your banner displays an “Accept” button, provide a “Decline” or “Reject” button with equal prominence on the initial view.
- Granular Category Controls: Allow visitors to accept strictly necessary operational cookies while declining analytics, advertising, or personalization tags.
- Accessible Revisit Mechanism: Provide a persistent link in your footer (e.g., “Cookie Preferences”) so data principals can exercise their statutory right to withdraw consent with the same ease with which it was given.
Test Your Website’s Consent Interface
Run the WebCompliance scanner to verify observable banner controls, reject button visibility, and pre-consent tracker states.
Scan Consent Controls →The presence of Accept and Reject buttons on a banner does not guarantee that the mechanism is legally valid under all circumstances. Back-end consent logging and withdrawal verification require comprehensive human review.