GDPR vs CCPA vs DPDP: what actually changes in your consent flow

Most global consent failures are not failures of intent. They are the result of shipping one banner everywhere and assuming the strictest regime covers the rest. It does not — because some regimes are not stricter, they are structurally different.

The three shapes of consent

The practical consequence: a GDPR banner shown in California is legal but costs you data you were entitled to process. A CCPA banner shown in Germany is a violation. Region-aware serving is not an optimisation — it is the requirement.

GDPR: the burden is on the affirmative act

Consent must be freely given, specific, informed and unambiguous, indicated by a clear affirmative action. Four consequences follow directly, and each of them is a UI decision:

• No pre-ticked boxes. A toggle that starts on is not an affirmative action.
• Reject must be as easy as accept. If Accept All is one click, so is Reject All — at the same level, with comparable visual weight.
• Purposes must be separable. One switch for everything is not specific consent.
• Withdrawal must be as easy as giving. A persistent way back into the preference centre, not an email to a privacy inbox.

CCPA/CPRA: notice, opt-out, and the signal you must honour

California does not require an opt-in for most processing. It requires transparency and a working exit. That changes the interface from a gate into a notice.

• A conspicuous “Do Not Sell or Share My Personal Information” route, reachable from every page.
• Notice at or before the point of collection, describing categories and purposes.
• Recognition of the Global Privacy Control signal — a browser-level opt-out you must treat as a valid request.
• Separate handling for sensitive personal information, which carries its own limitation right.

GPC is the one most implementations miss. It arrives as an HTTP header or a JavaScript property before your banner has rendered, and honouring it means suppressing the sale/share categories without waiting for an interaction. If your consent layer only reacts to clicks, it cannot comply.

// GPC must be honoured before the banner ever paints.
const gpcEnabled =
  navigator.globalPrivacyControl === true ||
  request.headers.get('sec-gpc') === '1';

if (gpcEnabled && jurisdiction === 'US-CA') {
  consent.set({ sale: false, sharing: false, source: 'gpc-signal' });
  // Notice still shows; the opt-out is already applied.
}

DPDP: notice is a first-class artefact

India’s Digital Personal Data Protection Act puts unusual weight on the notice itself. It must be itemised, available in English and the scheduled Indian languages, and it must describe the specific personal data and the specific purpose. A generic “we use cookies to improve your experience” does not satisfy it.

• Itemised description of the personal data and purpose, not a category summary.
• Language choice offered to the data principal.
• A clear route to withdraw, to complain to the Data Protection Board, and to contact the Consent Manager.
• Consent must be as easy to withdraw as to give — same standard as GDPR, stated explicitly.

What this means for your architecture

You cannot express these differences with a stylesheet. The variation is behavioural, and it has to live in the consent layer itself.

1. 1Resolve jurisdiction server-side, before the first byte of tracking code is eligible to run.
2. 2Select an experience, not a theme — layout, default state, button set and copy all vary together.
3. 3Store the regime alongside the consent record, so a later audit knows which rules applied.
4. 4Re-evaluate on jurisdiction change: a user who travels is a different compliance context, not a cached one.