India’s Free
DPDPA Tracker Radar
Under India's Digital Personal Data Protection Act (DPDPA 2023 / Section 6), non-essential scripts—advertising pixels, analytics beacons, session replays, and cookies—cannot fire before affirmative opt-in. Enter any domain below to launch an instant, headless Chromium radar scan and uncover unauthorized telemetry before regulatory scrutiny.
Why 90% of Cookie Banners in India Are Legally Ineffective
Under Section 6(1) of the DPDP Act 2023, consent must be unconditional, specific, and signified by a clear affirmative action. Here is why standard cookie notices fail an audit:
<head> scripts immediately._fbp and _ga written to browser local storage before visitor clicks anything.
"Wait, We Cannot Live Without User Analytics!"
Here Is How You Track Funnels Without Breaking the Law.
When companies run our scan and see Google Analytics, Meta Pixel, or Hotjar flagged as pre-consent violations, the immediate panic is: "If we turn off tracking, our marketing, conversion funnels, and product teams are completely blind!"
The Trap with Google Analytics & Meta Pixel
Foreign analytics scripts silently drop tracking cookies and send your customer's IP address abroad to US ad networks the exact second your website loads. Under Section 6 of India's DPDP Act, doing this before the user clicks 'Accept' is illegal and exposes your business to penalties up to ₹250 Crores.
The Solution: Kavach First-Party Cookieless Beacon
Instead of routing data through third-party ad brokers, we give your engineering team an in-house, cookieless telemetry beacon that runs on your own domain (e.g. analytics.yourbrand.in). It captures user journeys, page views, and conversion funnels cleanly—without saving tracking cookies on user devices.
Stays Completely Quiet Until Consent
Zero pre-firing. Zero rogue packets. Our beacon stays completely dormant until the user gives explicit, affirmative consent. If the visitor declines or ignores the notice, nothing is sent. If they accept, your product team gets rich, accurate funnel data with 100% legal backing.
Ad-Blockers Won't Blind Your Product Team
Up to 40% of tech-savvy visitors block Google Analytics via Apple Safari ITP, Brave, or uBlock. Because Kavach's beacon serves strictly as your own first-party utility without ad-broker scripts, your marketing and growth teams recover lost conversion visibility without invading user privacy.
Want to Keep Your Analytics and Stay 100% DPDPA Compliant?
We package and deploy this exact first-party beacon architecture inside your cloud or VPC. Connect with our engineering team to review your website's scan results and roadmap.
Enterprise Detection Engine
Our scanner evaluates every tier of your frontend and tag manager architecture to provide definitive proof of compliance.
Ready to Neutralize Your Pre-Consent Exposure?
Kavach Sovereign Consent Management Platform gives you 100% developer control, self-hosted infrastructure, and automated script gating to eliminate ₹250 Crore penalty risks.
Common Questions on Trackers & First-Party Analytics
Clear, straightforward guidance for product, marketing, and engineering teams.
Under Section 6 of India's DPDP Act, personal data (including IP addresses, device identifiers, and browsing patterns) can only be processed after receiving clear affirmative consent. Traditional Google Analytics and Meta Pixel scripts load immediately when a user visits your site and drop tracking cookies before the user even sees your banner. That means personal data was collected without consent—creating a direct statutory violation.
Yes. Modern telemetry doesn't need to permanently tag a person's device to understand site behavior. Kavach's first-party beacon uses an in-memory, daily-rotating code that counts unique visits, page journeys, UTM marketing campaigns, and checkout funnels accurately without saving persistent tracking cookies on the user's phone or computer.
Under DPDPA Section 6, if a visitor declines or ignores the notice, zero tracking packets are sent. Our beacon stays completely quiet. This keeps your business 100% audit-proof. When visitors do click 'Accept', rich conversion analytics fire immediately and link directly to your internal database.
Ad-blockers and privacy browsers (like Brave and Safari) maintain public blocklists of known third-party advertising brokers (like google-analytics.com and facebook.net). Because Kavach's beacon runs on your own domain (e.g. analytics.yourcompany.in) and never sends data to external ad networks, browsers treat it as legitimate first-party communication—recovering up to 40% of conversion data normally lost to ad-blockers.
Not at all. The beacon is a lightweight script (under 2KB) that connects directly to whatever you already use—whether that is a PostgreSQL database, Snowflake, ClickHouse, BigQuery, or a simple webhook endpoint in your existing cloud.
How Kavach Engine v3.0 Audits Websites
To ensure 100% empirical, unbiased verification, every scan executed by Kavach uses low-level headless browser telemetry rather than simple static source-code analysis.
01 Ephemeral Clean-Room Sandbox
Spins up an isolated Chromium session in Google Cloud Run (Mumbai Region) with clean storage, empty cookie caches, and zero prior history—exactly replicating a first-time Indian citizen visiting the domain.
02 CDP Packet Interception & Scroll Triggers
Attaches packet listeners at the network layer, simulates human cursor trajectories, and executes a full 100% progressive scroll to trigger IntersectionObserver trackers, scroll listeners, and delayed timers before consent.
03 JavaScript Callstack Hooking
Wraps document.cookie and storage setters to map every tracking token back to the exact initiating script URL, line number, and stack trace.
04 Synthetic Consent Gating Verification
Detects consent banners and dispatches a synthetic click to test if non-essential tags were strictly blocked prior to the click (True Gating) or if the banner was merely cosmetic.
05 Statutory Exposure Mapping
Correlates unconsented marketing, profiling, and analytics beacons against Section 6(1) and the penalty schedule of the Digital Personal Data Protection Act, 2023.
1. Automated Diagnostic Simulation: The findings, compliance grades (Grade A to F), telemetry intercepts, and cookie callstacks generated by this tool are produced entirely by automated client-side network observation in a simulated headless browser environment. Results reflect conditions observed on public web pages at the specific timestamp of the scan and do not evaluate authenticated portal states, server-side consent synchronizations, or backend tag management configurations.
2. Not Formal Legal Advice or Regulatory Ruling: This diagnostic tool is provided strictly for technical evaluation, educational research, and internal engineering risk-benchmarking. Nothing in this report constitutes formal legal counsel, statutory certification, or a binding finding by the Data Protection Board of India (DPBI). Statutory liability figures (e.g. "Up to ₹250 Cr") refer strictly to the maximum statutory penalty ceilings established under Section 6 and the Schedule of the Digital Personal Data Protection Act, 2023 (DPDPA 2023); they do not imply that any regulatory sanction has been initiated or levied.
3. Independent Technical & Legal Audit Required: Data Fiduciaries, website owners, and compliance officers are strongly advised to independently verify their Tag Manager containers, tag execution triggers, and server-side configurations with qualified privacy counsel and cybersecurity engineers prior to making regulatory or architectural determinations.
4. Nominative Fair Use & Trademark Attribution: All third-party product names, logos, vendor names, and company identifiers referenced in this audit (including, without limitation, Google LLC, Meta Platforms, Inc., Microsoft Corporation, Shopify Inc., GoKwik, CleverTap, WebEngage, Criteo, Taboola, Outbrain, PubMatic, and others) are trademarks™ or registered® trademarks of their respective owners. Their nominative use herein is solely for factual, descriptive identification of third-party network scripts observed during the automated diagnostic process, and does not imply endorsement, affiliation, sponsorship, or liability by or with those entities.
5. Limitation of Liability: Kavach Privacy, its developers, operators, and hosting infrastructure provide this tool on an "AS IS" and "AS AVAILABLE" basis without warranties of any kind, whether express, statutory, or implied. Under no circumstances shall Kavach Privacy be liable for any direct, indirect, incidental, punitive, special, or consequential damages, or any claims arising from the use of, reliance upon, or inability to use the results of this scan.