Is the DPDP Act opt-in or opt-out?

The DPDP Act is opt-in where consent is the basis. Sec. 6(1) requires a clear affirmative action before processing for a specified purpose, and Sec. 4 allows processing without consent only under the legitimate uses in Sec. 7, subject to the Sec. 17 exemptions. California's CCPA, by contrast, is built mainly around a right to opt out of the sale or sharing of personal information.

How is the DPDP Act different from the CCPA?

The DPDP Act requires a lawful ground, normally consent, before personal data is processed. The CCPA, as amended by the CPRA, generally lets a business collect personal information with a notice and gives California consumers rights to know, delete, correct and opt out of sale or sharing. The DPDP Act has no revenue threshold for a Data Fiduciary, subject to the Sec. 17 exemptions, while the CCPA applies to businesses that meet defined thresholds.

How is the DPDP Act different from PIPEDA?

PIPEDA is a Canadian federal law for private-sector organisations built on a set of fair information principles, with accountability and consent among them. The DPDP Act is a statute with a closed list of lawful grounds, a regulator that can impose monetary penalties, and prescriptive rules on notice and breach reporting.

Do I need three separate compliance programmes for India, California and Canada?

Usually no. A consent and rights platform built to the DPDP Act's stricter opt-in standard covers most of the evidence the other two ask for. You still need regime-specific notices and checks, such as California's opt-out signals, which Indian law does not require.

Compare

Opt-in, opt-out and accountability: three ways to regulate the same data

Last updated

12 October 2026

The DPDP Act asks for consent before processing. California's CCPA lets you collect and offers opt-out; Canada's PIPEDA ties consent to accountability.

The DPDP Act, California's consumer privacy law and Canada's federal private-sector law start from different questions. India asks whether you had permission before you processed. California, in broad terms, asks whether you told the consumer and then honoured her choice to opt out. Canada asks whether you can account for what you do with the information, and whether the individual agreed in a way that fits the sensitivity of the information.

The Indian statements on this page are checked against the Act and Rules. The California and Canadian summaries are high-level and describe features of those regimes that are widely documented. Confirm any detail you intend to rely on with counsel qualified in that jurisdiction.

The DPDP Act: permission first

Sec. 4 allows processing only for a lawful purpose, and only with the Data Principal's consent or for a legitimate use in Sec. 7. Consent under Sec. 6(1) must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action, and limited to the data necessary for the specified purpose. The notice behind it must meet Sec. 5 and Rule 3. Withdrawal must be as easy as giving consent under Sec. 6(4), and after withdrawal the Fiduciary must cease, and cause its processors to cease, within a reasonable time under Sec. 6(6). The burden of proof sits with the Data Fiduciary under Sec. 6(10).

California: notice and opt-out

The California Consumer Privacy Act, amended by the California Privacy Rights Act, is organised around consumer rights against businesses that meet its thresholds. Its best-known rights are to know what is collected, to delete, to correct, and to opt out of the sale or sharing of personal information, with a further right to limit the use of sensitive personal information. A business generally does not need prior consent to collect. Opt-in is the exception, notably for the sale of data about minors below a set age. Enforcement is by the California Privacy Protection Agency and the state attorney general.

The practical difference for a product team is where the control sits. Under the DPDP Act, the default state of a non-essential purpose is off until the person acts. Under the CCPA model, the default state is on, and the interface exists to let the consumer turn off sale or sharing.

The Personal Information Protection and Electronic Documents Act applies to private-sector organisations in the course of commercial activity. It is built on ten fair information principles in a schedule to the law, and accountability comes first: an organisation is responsible for personal information under its control, including information it hands to a third party for processing, and must designate someone to be accountable. Consent is a principle, but the form it takes depends on the sensitivity of the information and the person's reasonable expectations, so implied consent is available in some cases. PIPEDA also requires reporting breaches that pose a real risk of significant harm.

The accountability principle resembles Sec. 8(1) of the DPDP Act, which keeps the Data Fiduciary responsible for processing undertaken on its behalf by a Data Processor irrespective of any agreement to the contrary. The Indian Act attaches a Board-imposed penalty table to it.

Where the three diverge most

Default state. DPDP: processing needs a ground, usually consent. CCPA: collection allowed with notice; opt-out rights. PIPEDA: consent required, with implied consent permissible in a range of cases.

Scope. The DPDP Act applies to digital personal data processed in India, and to processing abroad connected with offering goods or services to people in India (Sec. 3(a) and (b)). It has no revenue threshold for a Data Fiduciary, subject to the Sec. 17 exemptions. The CCPA applies to businesses that meet defined thresholds. PIPEDA applies to organisations carrying on commercial activity.

Regulator and money. The Data Protection Board imposes penalties after an inquiry, using the Schedule to the Act, with ceilings that run to 250 crore rupees. See DPDP penalties. The Canadian federal regulator's tools differ in kind, and details are best taken from that regulator's guidance.

Rights. The DPDP Act gives access, correction, completion, updating, erasure, grievance redressal and nomination under Sec. 11 to 14. California's opt-out of sale and sharing and PIPEDA's challenging compliance have no direct Indian equivalent, though the effect of withdrawal under Sec. 6(6) covers similar ground for consent-based purposes.

What a multi-jurisdiction team should do

Build to the strictest default. A system that records consent per purpose, stops processing on withdrawal and holds a record of the notice shown can answer an Indian regulator, and the same record supports a California opt-out log or a Canadian accountability review. The evidence record described in consent receipts is the common layer.

Add the jurisdiction-specific layers on top: browser opt-out signals for California, designated accountable person and breach register for Canada, and for India the Rule 3 notice and the Consent Manager route from 13 November 2026, once the Board publishes its registration process under Rule 4. Where you sell to Europe as well, the comparison with the GDPR is the next read.

Questions people ask

Is the DPDP Act opt-in or opt-out?: The DPDP Act is opt-in where consent is the basis. Sec. 6(1) requires a clear affirmative action before processing for a specified purpose, and Sec. 4 allows processing without consent only under the legitimate uses in Sec. 7, subject to the Sec. 17 exemptions. California's CCPA, by contrast, is built mainly around a right to opt out of the sale or sharing of personal information.
How is the DPDP Act different from the CCPA?: The DPDP Act requires a lawful ground, normally consent, before personal data is processed. The CCPA, as amended by the CPRA, generally lets a business collect personal information with a notice and gives California consumers rights to know, delete, correct and opt out of sale or sharing. The DPDP Act has no revenue threshold for a Data Fiduciary, subject to the Sec. 17 exemptions, while the CCPA applies to businesses that meet defined thresholds.
How is the DPDP Act different from PIPEDA?: PIPEDA is a Canadian federal law for private-sector organisations built on a set of fair information principles, with accountability and consent among them. The DPDP Act is a statute with a closed list of lawful grounds, a regulator that can impose monetary penalties, and prescriptive rules on notice and breach reporting.
Do I need three separate compliance programmes for India, California and Canada?: Usually no. A consent and rights platform built to the DPDP Act's stricter opt-in standard covers most of the evidence the other two ask for. You still need regime-specific notices and checks, such as California's opt-out signals, which Indian law does not require.

See the DPDP provisions in one map