US State Privacy Laws (CCPA / CPRA / CPA / VCDPA) Compliance & Litigation Advisory
The United States privacy landscape has transformed into an intricate patchwork of state omnibus privacy statutes—spearheaded by California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), and over a dozen emerging state enactments. Our chambers counsel Indian software exporters, digital ad-tech networks, and e-commerce platforms on structuring unified US compliance frameworks, operationalizing 'Do Not Sell or Share' opt-out mechanics, honoring Global Privacy Control (GPC) signals, and insulating leadership from statutory private rights of action.
The Multi-State Fragmentation of US Privacy Law
In the absence of a comprehensive federal privacy statute in the United States, individual states have enacted robust omnibus consumer privacy laws. Spearheaded by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), this regulatory movement now encompasses the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), and an accelerating wave of statutes across Texas, Oregon, Florida, and Washington.
For Indian technology companies operating mobile apps, SaaS platforms, or e-commerce storefronts targeting American users, these statutes apply extraterritorially. Under the CCPA, a 'business' is subject to statutory jurisdiction if it does business in California, collects California consumers' personal information, and satisfies any of three statutory thresholds: (1) annual gross revenue exceeding $25 million; (2) annually buying, selling, or sharing the personal information of 100,000 or more consumers or households; or (3) deriving 50% or more of annual revenues from selling or sharing consumers' personal information.
'Selling' vs 'Sharing' Personal Information & The Ad-Tech Impact
A critical legal trap under US state privacy law is the extraordinarily expansive definition of 'selling' and 'sharing'. Under California Civil Code § 1798.140(ad), 'selling' is defined not merely as an exchange of personal data for monetary consideration, but as: "selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration."
Furthermore, the CPRA introduced the term 'sharing', specifically targeting cross-context behavioral advertising. If an Indian digital publisher or mobile app developer integrates third-party tracking pixels (e.g., Meta Pixel, Google Analytics, Criteo, TikTok SDK) that collect user identifiers to display targeted advertisements across unrelated websites, that activity constitutes legally actionable 'sharing' and 'selling'. Under Section 1798.120, consumers have an absolute statutory right to opt-out, requiring the business to display a prominent link titled 'Do Not Sell or Share My Personal Information' and honor universal browser-level Global Privacy Control (GPC) signals.
The Global Privacy Control (GPC) Mandate
"Following the California Attorney General's landmark $1.2 Million enforcement settlement in *People v. Sephora USA, Inc. (2022)*, failing to automatically detect and honor universal Global Privacy Control (GPC) browser opt-out signals constitutes a per se statutory violation of the CCPA."
Statutory Private Right of Action & Class Action Defense
While administrative enforcement under the CCPA is led by the California Privacy Protection Agency (CPPA) and the California Attorney General, California Civil Code § 1798.150 codifies a potent Statutory Private Right of Action. Consumers whose nonencrypted and nonredacted sensitive personal information is subject to unauthorized access, exfiltration, theft, or disclosure as a result of the business's violation of the duty to implement and maintain reasonable security procedures may initiate civil lawsuits.
Plaintiffs in CCPA breach actions are entitled to recover statutory damages of between $100 and $750 per consumer per incident, or actual damages, whichever is greater, alongside injunctive relief. In a consumer class action involving hundreds of thousands of users, statutory damages alone can quickly reach tens of millions of dollars without plaintiffs needing to prove actual financial harm. Our chambers advise Indian SaaS and IT exporters on architecting end-to-end encryption and tokenization standards that defeat statutory breach claims by demonstrating that exfiltrated data was encrypted or redacted pursuant to statutory safe harbors.
Statutory & Regulatory Framework Matrix
| Governing Statute / Regulation | Regulatory Authority | Mandatory Compliance Obligation | Legal Enforcement & Remedy |
|---|---|---|---|
| California Consumer Privacy Act (CCPA/CPRA), Cal. Civ. Code § 1798.100+ | California Privacy Protection Agency (CPPA) / CA Attorney General | Extraterritorial application to businesses collecting CA consumer data; rights to know, delete, correct, opt-out of sale/sharing, and limit sensitive data use. | Administrative fines up to $7,500 per intentional violation; statutory private right of action for data breaches ($100-$750 per consumer per incident). |
| CCPA / CPRA, Section 1798.120 & 1798.135 | CPPA Regulatory Enforcement | Mandatory prominent homepage links: 'Do Not Sell or Share My Personal Information' and 'Limit the Use of My Sensitive Personal Information'. | Direct enforcement actions and mandatory settlement decrees for dark patterns or missing opt-out links. |
| Global Privacy Control (GPC) Technical Standard | Cal. Code Regs. Tit. 11, § 7025 / Colorado AG Rules | Mandatory legal duty to treat universal browser opt-out preference signals (GPC) as a valid consumer opt-out request. | Regulatory enforcement (e.g., CA AG Sephora settlement); civil investigative demands. |
| Virginia Consumer Data Protection Act (VCDPA), Va. Code § 59.1-575+ | Virginia Attorney General | Opt-in consent for sensitive data processing; mandatory data protection assessments for targeted advertising and profiling. | Injunctions and civil penalties up to $7,500 per violation; 30-day cure period enforcement. |
| Colorado Privacy Act (CPA), Colo. Rev. Stat. § 6-1-1301+ | Colorado Attorney General / District Attorneys | Universal opt-out mechanism compliance; strict prohibition against dark patterns; annual algorithmic profiling assessments. | Deceptive trade practice enforcement under Colorado Consumer Protection Act; penalties up to $20,000 per violation. |
Enterprise US Multi-State Privacy Architecture Deliverables
Comprehensive CCPA 'Notice at Collection'
Drafting compliant Notices at Collection detailing statutory categories of personal information collected, sensitive personal data categories, commercial retention periods, and opt-out links.
GPC Universal Browser Signal Integration
Engineering client-side JavaScript listeners capable of detecting the `navigator.globalPrivacyControl` header, automatically toggling off third-party advertising SDKs without user friction.
Multi-State DSAR Workflow Automation
Deploying automated Consumer Rights Request portals supporting California, Virginia, and Colorado consumers, fulfilling 45-day response statutory timelines with identity verification.
Service Provider & Contractor Pact Overhaul
Re-drafting vendor agreements with mandatory statutory certifications under Cal. Civ. Code § 1798.140(ag), prohibiting retention, use, or disclosure of personal data outside the direct business relationship.
Precedential Judicial Enforcement & Attorney General Actions
Enforcement of US state privacy statutes has shifted from educational advisories to aggressive multi-million dollar penalties. In People of the State of California v. Sephora USA, Inc. (2022), the California Attorney General secured a $1.2 Million settlement and comprehensive injunctive relief against an international retailer for failing to disclose that it 'sold' consumer personal data via third-party analytics trackers and failing to process user opt-out requests submitted via Global Privacy Control (GPC).
Similarly, in DoorDash CCPA Enforcement Action (2024), the California Department of Justice penalized a delivery platform for participating in marketing data cooperatives without providing consumers with prior notice and an opportunity to opt out, establishing that sharing consumer data with marketing consortiums constitutes a prohibited 'sale'.
Our chambers ensure that Indian companies deploying digital products into the US market maintain bulletproof compliance. We design single, unified multi-state privacy policies that satisfy California, Virginia, Colorado, and emerging states simultaneously, eliminating legal fragmentation and protecting clients from aggressive class-action litigation and state Attorney General subpoenas.
Frequently Asked Questions
Does the California Consumer Privacy Act (CCPA) apply to Indian IT and software companies?
Yes, if the Indian company collects personal information from California residents, does business in California (e.g., provides software, apps, or services accessible to Californians), and meets any of the statutory thresholds: $25 Million annual gross revenue, buying/selling/sharing personal data of 100,000+ consumers, or deriving 50%+ of revenue from data sales/sharing.
What constitutes 'selling' or 'sharing' personal data under the CCPA/CPRA?
'Selling' is any disclosure of personal data to a third party for monetary or other valuable consideration (including free analytics services). 'Sharing' specifically refers to disclosing personal data to a third party for cross-context behavioral advertising (retargeting ads across different websites). Both activities require explicit consumer opt-out rights.
What is Global Privacy Control (GPC) and must an Indian website support it?
Global Privacy Control (GPC) is a browser-level technical specification that signals a consumer's universal opt-out preference. Under California and Colorado privacy regulations, websites are legally required to recognize GPC signals as valid, binding requests to opt out of the sale and sharing of personal data without requiring manual form submissions.
What is the statutory private right of action under the CCPA?
Under Cal. Civ. Code § 1798.150, consumers whose nonencrypted or nonredacted personal information is breached due to a failure to maintain reasonable security safeguards can sue directly in court for statutory damages of $100 to $750 per consumer per incident, creating massive class-action financial exposure.
How does an Indian company qualify a vendor as a 'Service Provider' under CCPA?
To avoid third-party data sharing being treated as an illegal 'sale', the vendor contract must contain specific statutory restrictions: prohibiting the vendor from retaining, using, or disclosing personal data for any purpose other than performing the specific services specified in the contract, and certifying that the vendor understands and will comply with these restrictions.
Related Statutory Treatises & Practice Areas
Standard Contractual Clauses, Adequacy, Section 16 DPDP Act, and Schrems II.
Extraterritorial data jurisdiction, localization mandates, and bilateral treaties.
Comparative compliance matrices across Indian and European privacy standards.
Advocate Ritik Khurana
Advocate enrolled with the Bar Council of Punjab & Haryana, practicing before the Punjab & Haryana High Court, Delhi High Court, and Supreme Court of India. Counsel at LLM Advocates, specializing in Aviation Law, DGCA Regulatory Inquiries, Cape Town Convention Enforcements, and High-Stakes Aerospace Transactions.