DPDP Act vs CCPA/CPRA: Selling Into the US From India

Introduction

Indian companies with US users face privacy laws state by state. California's is the most developed: the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the CCPA, Civil Code § 1798.100 onwards), enforced by the California Privacy Protection Agency (CPPA) and the Attorney General.

The two laws start from opposite ends. India's Digital Personal Data Protection Act, 2023 (the DPDP Act) is opt-in: consent or a listed legitimate use. The CCPA is largely opt-out: disclosed uses are allowed until the consumer stops a sale or sharing. Both can apply to the same Californian user, so the task is one design that satisfies both.

The legal position

Who the CCPA covers. A "business" is a for-profit entity that does business in California, decides how consumers' personal information is processed, and meets one of three tests (§ 1798.140(d)): annual gross revenues above $25 million in the preceding calendar year, as adjusted; buying, selling or sharing the personal information of 100,000 or more consumers or households a year; or deriving half its revenue from selling or sharing personal information. The CPPA raised the revenue figure to $26,625,000 from 1 January 2025; adjustments come in odd-numbered years, so the next is due in January 2027. The test is not limited to California sales, so in our view worldwide revenue counts. A "consumer" is any California resident (§ 1798.140(i)).

Conduct wholly outside California is exempt (§ 1798.145(a)), but an app used in California rarely qualifies. Medical information under California's Confidentiality of Medical Information Act or HIPAA is exempt too (§§ 1798.145(c), 1798.146), which helps health-tech business associates.

Who the DPDP Act covers. It applies to digital personal data processed in India (s.3(a)), wherever the person lives, so an app run from India processes Californians' data in India, in our view even on US servers. Section 17(1)(d) exempts most of the Act for data of people outside India processed under a contract with a person outside India. Read literally, a Californian accepting an Indian app's terms might fit; in our view that untested reading should not carry a compliance programme. The main duties commence on 13 May 2027.

Analysis

Whether data may be used: opt-in meets opt-out

The CCPA's central control is the right to opt out of the "sale" or "sharing" of personal information (§ 1798.120): making it available for valuable consideration, or disclosing it for cross-context behavioural advertising, paid or not (§ 1798.140(ad), (ah)). Advertising SDKs and retargeting pixels are the usual triggers. A business that sells or shares must offer a "Do Not Sell or Share My Personal Information" link or an alternative (§ 1798.135), and wait 12 months before asking an opted-out consumer to opt back in.

The DPDP Act asks first whether there is a ground at all. Advertising uses need consent that is free, specific, informed, unconditional and unambiguous (s.6(1)), after an itemised notice (s.5; Rule 3). For a Californian adult, India's rule is stricter: obtain consent first, then also honour the CCPA's opt-out mechanics.

Minors are where the CCPA turns opt-in. A business may not sell or share data of a consumer it knows is under 16 without affirmative authorisation, from the consumer if aged 13 to 15 or a parent if under 13 (§ 1798.120(c)). The DPDP Act goes further: everyone under 18 is a child, verifiable parental consent is needed for any processing (s.9(1); Rule 10), and tracking, behavioural monitoring and targeted advertising directed at children are banned (s.9(3)).

How people exercise control: rights, limits and signals

Both laws give request-based rights; only the CCPA adds standing controls over sale, sharing and sensitive data.

The right to limit turns on "sensitive personal information", which includes government identifiers, account log-ins, precise geolocation, racial or ethnic origin, genetic and biometric data, and health information (§ 1798.140(ae)). Since 1 January 2026 the regulations add data of consumers a business knows are under 16 (Cal. Code Regs. tit. 11, § 7001). Consumers can limit its use to what the service needs (§ 1798.121).

The DPDP Act has no sensitive category; sensitivity matters only for designating Significant Data Fiduciaries (s.10(1)) and setting penalties (s.33(2)), so a California-specific classification is needed.

Controls can also arrive automatically. A business that sells or shares must treat an opt-out preference signal, such as the Global Privacy Control (GPC) browser setting, as a valid opt-out, and show whether it has processed it (reg. § 7025). CPPA staff report enforcement over ignored GPC signals from July 2025 into 2026, and from 1 January 2027 browsers must offer such a setting (§ 1798.136, added by AB 566). Apply the signal to the logged-in account; the same switch can double as a DPDP withdrawal channel.

Who answers for vendors

A CCPA "service provider" processes data on a business's behalf under a written contract that bars selling or sharing it (§ 1798.140(ag)); a "contractor" receives data for a business purpose under a similar contract (§ 1798.140(j)). Contracts must set specified purposes, require CCPA compliance, allow the business to check use, require notice if the vendor can no longer comply, and let the business stop unauthorised use (§ 1798.100(d)); vendors must pass deletion requests down the chain (§ 1798.105(c)(3)). In our reading, a vendor without such a contract is not a service provider, so disclosures to it risk being sales.

The DPDP Act needs a valid contract (s.8(2)) and keeps the fiduciary responsible (s.8(1)). One template can combine CCPA purpose limits with DPDP security, breach and erasure terms.

What a failure costs

The CPPA imposes administrative fines of up to $2,663 per violation, or $7,988 for intentional violations and those involving consumers under 16 (§ 1798.155, as adjusted from 1 January 2025); the Attorney General can seek civil penalties of the same amounts (§ 1798.199.90).

Consumers can sue only over breaches (§ 1798.150). Where nonencrypted and nonredacted personal information is accessed and exfiltrated, stolen or disclosed through a failure to maintain reasonable security, each consumer can recover $107 to $799 per incident, or actual damages if greater, after 30 days' notice; post-breach security is not a cure.

India has nothing similar: Board penalties, capped by obligation at up to ₹250 crore for security safeguards, go to the Consolidated Fund of India (s.34), and the IT Act's compensation remedy in s.43A is omitted from 13 May 2027. One breach can bring a Board inquiry in India and a class action in California.

California's breach statute (Civil Code § 1798.82) requires notice to affected residents and a sample to the Attorney General where more than 500 are affected; an amendment effective 1 January 2026 sets a 30-calendar-day deadline. DPDP Rule 7 requires notice to every affected person without delay and a 72-hour report to the Board.

What comes next: ADMT, risk assessments and audits

The CPPA's regulations on automated decisionmaking technology (ADMT), risk assessments and cybersecurity audits were approved on 22 September 2025 and took effect on 1 January 2026.

• ADMT, from 1 January 2027. A business using technology that replaces or substantially replaces human decision-making for a "significant decision" must give a pre-use notice, offer an opt-out (with exceptions, including a human-appeal route) and explain the logic and outcome on request. Significant decisions cover financial services, housing, employment, healthcare and education, including admission to academic programmes.
• Risk assessments, from 1 January 2026. Required before selling or sharing personal information, processing sensitive personal information, or using or training certain automated technologies; an attestation and summary are due by 1 April 2028.
• Cybersecurity audits. Businesses meeting the § 7120 significant-risk tests, such as half of revenue from selling or sharing, or exceeding the revenue threshold while processing data of 250,000 consumers or sensitive data of 50,000, certify by 1 April 2028 (revenue over $100 million), 2029 ($50 to $100 million) or 2030 (under $50 million).

The DPDP Act reserves algorithmic due diligence, impact assessments and audits for Significant Data Fiduciaries (s.10; Rule 13); otherwise it requires accuracy where data feeds a decision (s.8(3)).

Practical implications

Worked example (illustrative). A Bengaluru ed-tech company runs a maths and coding app with 300,000 US users, 40,000 in California, and group revenue of about $38 million. A fifth of its Californian users are 13 to 17. Its free tier carries an advertising SDK, and an AI placement test decides entry to an advanced olympiad cohort.

1. 1.Both laws apply: the CCPA on revenue, the DPDP Act because the data is processed in India, without reliance on s.17(1)(d).
2. 2.Teenagers. The CCPA requires opt-in before selling or sharing under-16s' data and treats it as sensitive, which in our reading triggers a risk assessment. The DPDP Act requires parental consent for all under-18s and bans tracking and targeting them. The SDK goes for all under-18s; US parents are verified through details the company holds, such as the paying account, as DigiLocker-style tokens do not reach them. Trayambic's ed-tech study covers the Indian side.
3. 3.Adults. Advertising runs only on DPDP consent, and the app also shows a "Your Privacy Choices" link and honours GPC.
4. 4.Placement test. In our view, entry to the advanced cohort is admission to an academic programme, making the test ADMT for a significant decision. From 1 January 2027 a pre-use notice and human review route go live; accuracy is checked under s.8(3).
5. 5.Under-13s also bring the FTC's amended COPPA Rule (compliance from 22 April 2026); the free tier excludes them.
6. 6.Breach plan: CERT-In within six hours, Rule 7 notices, California's notice statute, and a reasonable-security file for any § 1798.150 claim.

Key takeaways

The DPDP Act usually sets the higher bar on whether data may be used; the CCPA sets detailed rules on how choices are offered and honoured, and adds breach litigation risk. Build to DPDP consent, then add the CCPA's links, signals, sensitive-data limits and 2027 ADMT duties.

• The DPDP Act applies to data processed in India whatever the user's location, so a Californian user of an Indian app can be covered by both laws at once.
• The CCPA business test is revenue above $26,625,000 (adjusted from 1 January 2025), 100,000 consumers or households, or half of revenue from selling or sharing.
• The CCPA is opt-out for adults but opt-in for selling or sharing data of under-16s; the DPDP Act requires consent throughout and parental consent for all under-18s.
• Fines are up to $2,663 per violation ($7,988 if intentional or involving under-16s), and consumers can sue for $107 to $799 each after a security breach.
• CPPA rules on ADMT apply from 1 January 2027, risk-assessment filings are due by 1 April 2028, and businesses that sell or share must honour Global Privacy Control signals.