One Consent Banner for DPDP, GDPR and CCPA: Multi-Region Guide
Serving users in India, the EU and the US? How to run one consent banner that follows the DPDP Act, GDPR and CCPA/CPRA by region, without losing proof.
A business serving users in India, the EU and California can run one consent platform that adapts by region. India's DPDP Act 2023 and the EU GDPR and ePrivacy rules are opt-in: non-essential tracking needs prior affirmative consent. California's CCPA/CPRA is mainly opt-out: businesses must offer a way to opt out of the sale or sharing of personal information and honour Global Privacy Control signals. The DPDP Act adds an itemised notice per purpose (Section 5), the option of English or any of the 22 Eighth Schedule languages (Sections 5(3) and 6(3)), withdrawal as easy as consent (Section 6(4)), and the burden of proving consent on the business (Section 6(10)). A practical setup detects the user's region, applies the strictest required rules there, and stores one signed record per decision.
The short answer
You can run one consent platform for India, Europe and the US, as long as it changes its behaviour by region. India and the EU are opt-in: no tracking until the user agrees. California is mainly opt-out: you may load some tracking but must let users stop the sale or sharing of their data. One record format, region-specific rules.
How the three laws differ
| DPDP Act (India) | GDPR + ePrivacy (EU) | CCPA/CPRA (California) | |
|---|---|---|---|
| Model | Opt-in | Opt-in | Opt-out for sale or sharing |
| Trackers before choice | Blocked | Blocked | Allowed, with opt-out |
| Notice | Itemised per purpose (Section 5) | Transparent, layered | Notice at collection |
| Languages | Option of English or 22 Indian languages | Language of the market | English plus languages you market in |
| Withdrawal | As easy as consent (Section 6(4)) | As easy as consent | “Do Not Sell or Share” link |
| Browser signals | Not specified | Not specified | Honour Global Privacy Control |
| Proof | Burden on you (Section 6(10)) | Must demonstrate consent | Keep records of requests |
| Legitimate interest | No general ground | Yes, as a legal basis | Not the model |
The DPDP Act has no “legitimate interest” basis for marketing or analytics. See 7 differences between DPDP and GDPR.
The setup that works
1. Detect region at the edge
Use the visitor’s location to choose the rule set. When you cannot tell, default to the strictest one (opt-in).
2. Use one set of purposes
Define purposes once (essential, analytics, personalisation, marketing) and map each law onto them. This keeps your records consistent.
3. Change the banner, not the system
- India: itemised notice, equal Accept and Reject, no pre-ticked boxes, language choice.
- EU: opt-in banner with Accept and Reject on the first layer.
- California: a “Do Not Sell or Share My Personal Information” link, and respect Global Privacy Control.
4. Gate scripts the same way everywhere
Mark trackers with their purpose so they only run when the current region’s rules allow. See React and Next.js setup.
5. Store one signed record per decision
Each record should hold the region, notice version, purposes chosen and a timestamp, so you can prove it under any of the three laws.
6. Send Google Consent Mode signals
Set defaults to denied in opt-in regions and update them on choice. See Google Consent Mode v2.
Common mistakes
- Using a US opt-out banner for Indian visitors. Under the DPDP Act, trackers must wait for consent.
- Relying on “legitimate interest” for Indian users.
- Showing the notice in English only, with no option of an Indian language.
- Different databases for each region, so you cannot prove what happened.
Data location
Consent records are personal data. Under Section 16, transfers out of India are allowed except to countries the government restricts. Check where your consent vendor stores records. ConsentPlix stores them in India, and our GDPR transfers page covers EU users.
How ConsentPlix helps
ConsentPlix applies region-aware rules for DPDP, GDPR, CCPA/CPRA, LGPD, PDPA and PIPEDA from one script, and stores every decision as a signed receipt. See supported regulations and the SaaS solution.
DPDP references checked against Act No. 22 of 2023, as of October 2026. GDPR and CCPA summaries are simplified; check current guidance for your markets.
Amjad Rathod
Co-Founder & Chief ArchitectLead architect of the ConsentPlix consent ledger and sub-12KB client SDK. Works on DPDP Section 6 consent flows and high-throughput privacy engineering.
Continue exploring sovereign compliance engineering.
Ready to deploy provable consent infrastructure?
Deploy in minutes with our sub-12KB SDK or schedule a customized technical consultation with our privacy engineering team.