Most Indian marketing teams know the DPDP Act exists and have decided it is next year’s problem. The phasing in the notification says otherwise, and the analytics stack is the part of the problem that is cheapest to fix now and most expensive to retrofit later.
This piece covers what the phasing actually says, which analytics platforms genuinely reduce your obligations rather than relocating them, and what the cookieless and no-personal-data claims in this market are worth. We are not lawyers and this is not legal advice. Everything legal below is attributed to a source you can check, and anything that matters commercially should go past counsel. The implementation side of consent, including the tag manager and consent mode work, is a separate subject we cover elsewhere on this site.
The clock, as published
MeitY notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025. The notification brings the Act into force in three phases, and the phases are defined relative to the date of publication in the Official Gazette rather than as calendar dates.
As the notification is reported, the phases are these. On publication: section 1(2), section 2, sections 18 to 26, section 35, sections 38 to 43, and sections 44(1) and 44(3). One year after publication: section 6(9) and section 27(1)(d). Eighteen months after publication: sections 3 to 5, sections 6(1) to 6(8) and 6(10), sections 7 to 17, section 27 except 27(1)(d), sections 28 to 34, sections 36 and 37, and section 44(2).
Read the third phase carefully, because sections 3 to 17 are the Act’s core. That is where the grounds for processing, the notice requirement, consent, and the rights of data principals sit. Those are the obligations that change how analytics may be deployed, and they are the ones arriving last.
If the gazette publication date is 14 November 2025, as reported, then the one-year provisions fall due around mid-November 2026, which is a fortnight from this article’s date, and the eighteen-month substantive obligations around mid-May 2027. We have not read the gazette itself and we are not going to assert a date from a secondary source as though we had. Verify the publication date and your own applicable dates with counsel, from the gazette.
The practical reading for a marketing team: you have roughly eighteen months from late 2025 before the consent and notice obligations bite, which sounds comfortable and is not, because the work is a platform decision plus a tracking rebuild, and both take longer than the quarter in which somebody finally reads the Act.
Why analytics is the right place to start
Three reasons.
It is usually the largest collection of personal data a marketing site holds, and the one with the least clear purpose documented against it. A tag that has been running for four years, collecting identifiers, with nobody able to state the purpose, is the exact shape of problem the notice and consent provisions are about.
It is replaceable. Unlike a CRM or a billing system, swapping an analytics platform is a few days of work and a historical data export. The cost of changing is low now and rises with every month of history you accumulate on the wrong platform.
And the choice determines how much consent machinery you need. A platform that collects no personal data and sets no persistent identifier changes the question from “how do we get valid consent at scale” to “do we need consent for this at all”, which is a far better position to be arguing from.
What cookieless and no-personal-data claims actually buy
This market is full of compliance claims and they need reading carefully, because they are vendor claims about vendor products, and the obligation remains yours.
Plausible states “We do not use cookies or any other persistent identifiers”, that it generates “a random string of letters and numbers to calculate unique visitors on a given day” which it resets daily, and concludes that “Because Plausible doesn’t use cookies or collect personal data, no consent banner is required”. Its stated basis is specific: “By not using cookies, you do not need to obtain consent from visitors to store and retrieve data from their devices.”
Note what that argument covers and what it does not. The no-consent-needed claim rests on not storing or retrieving anything on the visitor’s device, which is a cookie-law argument of the kind PECR embodies in the United Kingdom. Whether the processing that remains is lawful under a given data protection statute is a separate question, and the answer turns on whether what is processed is personal data at all under that statute’s definition. That is a legal question about Indian law, on an Indian site, and a vendor’s page about European law does not answer it.
Ahrefs makes a narrower claim about its free Web Analytics, describing it as a “Privacy-focused alternative to GA: no cookies by default, no personal data collected”. Same structure, same caveat.
So the honest position: a cookieless, no-identifier platform materially reduces your exposure and may remove the need for a consent banner for analytics specifically. It does not make you compliant, it does not cover your other tags, and the determination is counsel’s rather than the vendor’s.
Where residency matters, and where it does not
Cross-border transfer is the part most commentary gets backwards. The Rules set conditions and safeguards for transferring personal data outside India, and the Central Government can specify permitted countries or mechanisms. That is a different architecture from a blanket localisation requirement, and it means the question is not “is my data in India” but “is the destination permitted, and can I satisfy the conditions”.
The practical consequence for platform choice. A self-hosted analytics platform on infrastructure you control in India removes the transfer question entirely, which is the cleanest answer and the one that needs no monitoring of future notifications. A cloud platform hosted elsewhere does not become unlawful, but it does put you in a category whose permissibility depends on government notifications you will need to keep watching.
What the vendors state about location. Plausible says “Your website data never leaves the EU” and that “All visitor data is exclusively processed on servers owned and operated by European companies”, naming Hetzner servers in Falkenstein, Germany and a Slovenian CDN provider. Matomo’s FAQ states that for its Cloud product “the data is stored in Frankfurt, Germany”, and offers On-Premise described as “Host Matomo on your own infrastructure – take complete control of the system”, with a Community plan that is “Free forever” with “Unlimited users and hits”. Matomo Cloud’s entry Business tier is listed at 29 excluding tax, with higher tiers on request; the page’s monthly and yearly figures were not clearly distinguished when we read it, so confirm at checkout.
For an Indian business that wants the transfer question closed rather than managed, self-hosted Matomo on Indian infrastructure is the obvious candidate, and the free Community tier means the cost is hosting and someone’s time rather than a licence.
The options, assessed
| Platform | Model | Cost as published | Stated data location | Honest assessment |
|---|---|---|---|---|
| Matomo On-Premise | Self-hosted, open source | Community plan free forever, unlimited hits; paid bundles above | Wherever you host it | The cleanest answer on transfer and control. Costs engineering time, not licence fees |
| Matomo Cloud | Managed | Entry Business tier listed at 29 excl. tax, 50,000 hits a month | Frankfurt, Germany | Full-featured, but a transfer to monitor |
| Plausible | Managed, open source, self-hostable | Not verified for this reference | EU only, Hetzner in Germany, Bunny CDN in Slovenia | Strong no-cookie claim; lightweight; less depth than Matomo |
| Ahrefs Web Analytics | Managed, free tier | Free, up to 1M events per project | Not verified | Free and no cookies by default; basic reporting only |
| Umami, Fathom and similar | Managed or self-hosted | Not verified | Varies | Same family of claims; verify each from its own page |
| Google Analytics 4 | Managed | Free at the tier most Indian businesses need | Not verified for India residency | Deepest features and the whole Google stack; the heaviest consent and transfer position |
| Microsoft Clarity and session recorders | Managed | Clarity free | Not verified | Session recording captures far more than analytics; treat as a separate, higher-risk decision |
| Server log analysis | Your own infrastructure | Free | Your server | No client-side collection at all; no behavioural data either |
The decision, honestly
Three situations, three different answers, and anyone telling you there is one right platform is selling something.
If your analytics requirement is traffic, sources, pages and conversions, which describes most Indian service businesses, manufacturers and local businesses, a cookieless platform is the better trade. You lose cross-session user journeys and the Google Ads integration, you gain a much simpler consent position, and nobody on the team was reading the cohort reports anyway.
If you run paid media at scale and depend on conversion import and audience building, you are staying on the Google stack, and your work is consent machinery, documented purposes, retention limits and a defensible transfer position rather than a platform change. That is a bigger project and it should start now rather than in 2027.
If you are in a regulated sector, healthcare, financial services, education, anything touching children, the calculation is different again, the stakes are higher, and this is counsel’s decision with your input rather than the reverse. The sector pieces on this site cover the marketing side of several of these.
What to do regardless of platform
Six things that are worth doing on any stack, and that the eighteen-month phase will make necessary.
- Inventory every tag. What collects what, for what stated purpose, sent where, retained how long, with a named owner. Most sites cannot produce this document, and it is the first thing anyone will ask for. The method is the third-party script audit approach: the tag manager export, the templates, and a request map, because the tags nobody remembers are the ones that matter.
- Delete what has no purpose. In every audit we have run, a substantial share of tags have no current owner and no decision depending on them. Removing them is the cheapest compliance work available and it makes the site faster, which is the argument in performance budgets for marketing websites.
- Write the notice before you build the banner. Purposes, categories, retention, and how consent is withdrawn, in language a person can read. If you cannot write the purpose for a tag, that is the answer about the tag.
- Set retention deliberately rather than accepting the platform default, and be able to say why.
- Know your transfer position. For each platform, where the data goes and on what basis, written down, so that a change in notified countries is a review rather than a crisis.
- Make sure analytics still works when consent is refused. A site that can report nothing about the share of visitors who declined has lost the ability to measure anything, and server-side log analysis is the fallback that needs no consent at all. The approach is in log file analysis at scale with Python, which is a crawl piece but the same technique.
What is a waste of effort
Treating a vendor’s GDPR compliance claim as an answer about Indian law.
Assuming the DPDP Act requires data localisation. The Rules set conditions on transfer and allow the government to specify permitted destinations, which is a different thing.
Building an elaborate consent banner before inventorying the tags it is meant to gate.
Switching to a cookieless platform and leaving eleven advertising pixels firing on page load.
Waiting for the eighteen-month date, when the work is a platform decision plus a tracking rebuild.
Taking any date in this article, including ours, as authoritative without checking the gazette.
If nobody at your company can produce a list of what your site collects and why, get in touch, and bring your lawyer into the conversation early.
Last verified: 2 November 2026. We review this page quarterly, and sooner as further DPDP provisions commence.
Sources, all read 2 November 2026. For the notification date and the Rules’ scope: the Wikipedia article on the Digital Personal Data Protection Rules, 2025. For the three-phase commencement structure and the section lists: the enforcement timeline published at dpdpa.com, which reproduces notification G.S.R. 843(E); we have not read the gazette directly. For vendor claims: plausible.io’s privacy-focused web analytics page, matomo.org pricing page and FAQ, and ahrefs.com/webmaster-tools. All vendor compliance claims are the vendors’ own and are not legal advice or independently verified.