Website Privacy Compliance in Singapore, Japan and the US: PDPA vs APPI vs CCPA

Website privacy compliance for a brand serving Singapore, Japan and the US means meeting three different laws: Singapore’s PDPA, Japan’s APPI and California’s CCPA. The PDPA centers on notification and consent, the APPI on stated purposes of use and rules for overseas transfers, and the CCPA on notices and the right to opt out of the sale or sharing of personal information. A single site can meet all three with a layered privacy notice and market-specific consent settings.

The three laws overlap in their basic ideas, but they differ on the details that shape a website: what triggers consent, how cookies and tracking tags are treated, what the privacy notice has to say and what happens when data leaves the country. This article compares those points for websites and is general information, not legal advice, so brands should confirm their own obligations with qualified counsel in each market.

The comparison below draws on material published by the regulators themselves: the Personal Data Protection Commission in Singapore, the Personal Information Protection Commission in Japan, the California Attorney General and the California Privacy Protection Agency.

How Do the PDPA, APPI and CCPA Compare for Websites?

The PDPA, APPI and CCPA all require a clear privacy notice and reasonable security, but they apply to different businesses and handle consent and tracking differently. The table summarizes the points that most often affect a multi-market website.

The rest of this article explains each row in more detail. Our international website development guide covers how privacy settings fit into the wider build for several markets.

What Does Singapore’s PDPA Require From a Website?

Singapore’s PDPA requires a website to tell visitors why their personal data is collected, obtain consent for those purposes and publish contact details for data protection queries. It also limits how data is kept, protected and sent overseas.

According to the PDPC, the PDPA’s obligations include accountability, notification, consent, purpose limitation, accuracy, protection, retention limitation, transfer limitation, access and correction, and data breach notification. For a website, the most visible of these are the notification and consent obligations at each form, sign-up and checkout.

The PDPA itself doesn’t contain a separate cookie rule. Where cookies or tracking tags collect personal data, the general notification and consent obligations apply, so many Singapore sites disclose analytics and advertising tags in the privacy notice and offer a cookie banner.

What are the PDPA penalties?

The PDPC can impose financial penalties of up to 10% of an organization’s annual turnover in Singapore, or S$1 million, whichever is higher. According to the PDPC (2022), this higher cap took effect on 1 October 2022 for organizations with annual local turnover above S$10 million.

What Does Japan’s APPI Require From a Website?

Japan’s APPI requires a business to specify the purpose of use for personal information, notify or publish that purpose, keep the data secure and follow set rules before providing it to third parties. Transfers to recipients outside Japan have their own conditions.

According to the Personal Information Protection Commission, a business may provide personal data to a third party in a foreign country on one of three bases: the individual’s prior consent, a recipient country with a protection system recognized as equivalent to Japan’s, or a recipient whose internal system meets PPC standards. The PPC also notes that only the original Japanese texts of the law have legal effect and that English versions are reference translations.

How does the APPI treat cookies?

The APPI treats browsing data collected through cookies as “personally referable information” (個人関連情報) rather than personal information in most cases. The PPC’s general guidelines (2026) list a person’s website browsing history collected through cookie identifiers as an example, and Article 31 of the Act restricts providing such data to a third party that is expected to acquire it as personal data unless the individual’s consent has been confirmed.

This matters for websites that pass identifiers to ad platforms or data partners. A brand using these tools on its Japanese site should map which tags send identifiers and whether any recipient links them to customer records.

What changes with the 2026 APPI amendment?

Japan’s Diet passed an amendment to the APPI on 10 July 2026, and the PPC announced its promulgation on 17 July 2026. According to the PPC, most of the amended provisions take effect on a date set by cabinet order within two years of promulgation, and the PPC plans to issue new cabinet orders, rules and guidelines before then.

What Does the CCPA Require From a Website?

The CCPA requires a covered business to give a notice at collection, publish a privacy policy and, if it sells or shares personal information, offer a “Do Not Sell or Share My Personal Information” link. It also requires businesses to honor opt-out preference signals such as Global Privacy Control.

According to the California Attorney General, the CCPA applies to for-profit businesses that do business in California and meet one of three thresholds, including annual gross revenue above a set amount. The California Privacy Protection Agency adjusted that revenue threshold to $26,625,000 from 1 January 2025, and set administrative fines at up to $2,663 per violation, or $7,988 for intentional violations or those involving consumers under 16.

California consumers also have rights to know, delete and correct their personal information, and to limit the use of sensitive personal information. The CPPA’s regulations page lists the CCPA statute and regulations as effective 1 January 2026, following the adoption of rules on risk assessments, cybersecurity audits and automated decisionmaking technology in September 2025.

Why does website tracking matter under the CCPA?

Third-party tracking on a website can count as a sale or sharing of personal information under the CCPA. According to the California Attorney General (2022), Sephora agreed to pay $1.2 million after allegedly allowing third-party tracking on its site without disclosing it as a sale and without honoring Global Privacy Control signals.

The CPPA has also acted on opt-out mechanics. According to the CPPA (2025), clothing retailer Todd Snyder was fined $345,178 after its privacy portal failed to process opt-out requests for 40 days and required identity verification before consumers could opt out.

Which Privacy Features Should a Multi-Market Website Include?

A multi-market website should include a market-specific privacy notice, a consent tool that can apply different defaults by market, opt-out handling for California visitors and a record of where personal data is sent. These features sit in the site’s templates and tag setup, so they’re easier to plan before the build than to retrofit.

1. Data map: list every form, tag, pixel and integration on the site, what each collects and which countries it sends data to.
2. Layered privacy notice: a shared core notice with market sections for Singapore, Japan and California, written in the language of each market.
3. Consent tool with regional settings: a consent management platform that can apply different banners and defaults by market.
4. Opt-out handling: a “Do Not Sell or Share” link where the CCPA applies, and Global Privacy Control signals honored in the tag setup.
5. Purpose-specific forms: each form states its purpose and links to the relevant notice, with marketing consent kept separate from service requests.
6. Transfer documentation: a record of overseas recipients and the basis for each transfer, which supports both the PDPA and APPI.
7. Request process: a route for access, correction, deletion and opt-out requests, with response times that meet each law.

How Does Creative For More Handle Privacy in Website Builds?

Creative For More builds the privacy features above into the website itself: the consent tool, tag setup, form wording and market-specific notice pages. We work from offices in Singapore, Tokyo and New York, and we coordinate the legal text with each client’s own counsel rather than drafting legal advice ourselves.

Our web design and development service covers multi-language WordPress and Shopify builds where analytics, paid media tags and consent settings are configured for each market from the start. Brands that already run a site in one market can use the data map step to check what the existing tags collect before adding a new market.

If you’re running one website across Singapore, Japan and the US and want the consent setup and privacy pages built correctly for each market, we can scope it with you and your legal advisers. If your company is looking for a strategic marketing partner, the Creative For More team can help. Book a discovery call to explore how we can support your brand’s growth.

Read More

• International Website Development: The 2026 Guide for Multi-Market Brands
• Japan Expansion Playbook: The Legal Basics for Foreign Firms Entering the Market
• How to Expand Into Singapore as a Foreign Brand
• The 5 Systems You Must Build Before Expanding Internationally
• B2B Market Entry in Asia: What Western Companies Must Know