GDPR vs CCPA

The two laws side by side

These 11 lines carry most of the difference. Each cell names the article or section it comes from, so you can check the source before you act on it.

Who each law reaches

The GDPR has no size test and no revenue test. It reaches a firm in one of two ways. Either the firm has an establishment in the EU and processes data in the context of its activities, wherever the servers sit (Art. 3(1)). Or the firm has no EU establishment but offers goods or services to people in the EU, paid or free, or monitors their behaviour there (Art. 3(2)). A charity, a sole trader and a listed company are all in.

The CCPA starts from the business. It covers a for-profit entity doing business in California that decides why and how personal information is processed and meets one or more of three tests (§ 1798.140(d)(1)):

1. annual gross revenue over $26,625,000 in the preceding calendar year (CPI-adjusted from $25,000,000, effective 1 January 2025);
2. alone or in combination, annually buys, sells or shares the personal information of 100,000 or more consumers or households;
3. derives 50 percent or more of annual revenue from selling or sharing consumers’ personal information.

A nonprofit sits outside that first definition. The definition also reaches an entity that controls or is controlled by a covered business and shares its branding and consumers’ data (§ 1798.140(d)(2)), and a joint venture of businesses each holding at least a 40 percent interest (§ 1798.140(d)(3)). The CCPA threshold calculator runs the three tests on your own figures.

Whose data counts

The GDPR’s protection applies “whatever their nationality or place of residence” (Recital 14), and Art. 3(2) looks at data subjects “who are in the Union”: location, not passport. The CCPA protects a “consumer”, which it defines as a natural person who is a California resident (§ 1798.140(i)). The word misleads: the exemptions for job applicants, staff and business-to-business contacts became inoperative on 1 January 2023 (§ 1798.145(m), (n)), so a covered business must answer requests from its Californian staff as well as its customers. The GDPR never had that gap.

One firm, both laws

Take a 30-person online shop in Ohio with $28 million in revenue. It ships across the US, California included, and runs a German-language checkout priced in euros. The revenue alone makes it a CCPA business. The German checkout is the kind of sign the GDPR’s recitals treat as offering goods to people in the EU, so Art. 3(2)(a) very likely reaches it too, and it then needs an EU representative unless the narrow exception in Art. 27(2) fits. Does GDPR apply to US companies? walks through those tests.

Permission first, or stop on request

This is the difference that changes how a firm works day to day. Read the two tracks below from the top: the GDPR’s first step happens before any data moves, the CCPA’s last step happens after a Californian asks.

The GDPR: six bases, and consent is only one

The six are consent, contract, legal obligation, vital interests, public task and legitimate interests. Shipping an order runs on contract; keeping invoices runs on legal obligation; a newsletter usually runs on consent. Consent has to be freely given, specific, informed and unambiguous, and silence or a pre-ticked box is not consent (Art. 4(11), Recital 32).

Cookies sit on top of that. Art. 5(3) of the ePrivacy Directive asks for consent before a site stores or reads anything on a device that is not strictly necessary for the service the visitor asked for. That is why the analytics tag waits for the banner, and why most EU regulators treat a banner with no reject option as an infringement.

The CCPA: collect with notice, stop when told

Under the CCPA, collecting is not the act that needs permission; selling or sharing is the act a Californian can stop. “Sale” covers handing personal information to a third party for money or any other valuable consideration. “Sharing” covers handing it over for cross-context behavioural advertising, paid or not, so an ad pixel that follows a visitor to other sites is sharing even when no money changes hands.

The CCPA does turn to opt-in in three places: selling or sharing a known under-16’s data, starting again after someone has opted out, and enrolling a consumer in a financial incentive programme.

The opt-out has to be easy. A business that sells or shares must treat an opt-out preference signal such as Global Privacy Control as a valid request for that browser, and it may not demand identity verification for an opt-out (regs §§ 7025, 7026(d)). The guide to the “Do Not Sell or Share” link covers the link, the signal and the wording.

The rights, matched article to section

Most GDPR rights have a California cousin, but few are twins. The table pairs them and says where each pair parts. If a request has just landed, what a DSAR is covers what must go back to the person.

Identity checks differ too. The GDPR lets a controller ask for more information only where it has reasonable doubts about who is asking (Art. 12(6)). The CCPA expects a business to verify requests to know, delete and correct, and forbids verification for an opt-out of sale or sharing.

The clocks

The GDPR’s main clock is shorter: one month beats 45 days. The CCPA has more clocks, and two of them count business days. The bars turn months and business days into rough calendar days, so read them as a sketch; the DSAR deadline calculator works out the real dates for a given day of receipt.

Under the CCPA regulations the 45 days run from the day the request is received, however long verification takes. The regulations also ask for a log of requests and how each was answered, kept for at least 24 months (§ 7101(a)), which is the record you will want under either law.

Breaches run the other way round. The GDPR gives 72 hours, where feasible, to tell the supervisory authority, asks you to tell the people affected when the risk to them is high, and wants every breach logged, reported or not (Arts 33–34). The CCPA’s text sets no notice clock at all; its breach section is about what a consumer can sue for.

Fines, enforcers and who can sue

GDPR caps are built for groups with a turnover: the percentage only bites once 4 % of turnover passes EUR 20 million. CCPA amounts are small per violation and multiply by the number of violations, so a defect in a form that thousands of Californians used adds up. Amounts read 22 Oct 2026.

Who brings the case

In the EU each Member State has an independent supervisory authority (Art. 51). Anyone can complain to one (Art. 77), and anyone who suffered material or non-material damage from a breach of the GDPR can claim compensation from the controller or processor (Art. 82(1)).

In California the California Privacy Protection Agency fines through its own process and the Attorney General sues for civil penalties of the same amounts. Consumers can sue only over certain data breaches; the statute rules out a private action for any other section (§ 1798.150(c)). The dollar figures move with inflation on 1 January of every odd year, next on 1 January 2027.

What a case looks like: in March 2025 the Agency’s Board ordered American Honda Motor Co. to pay $632,500 and change its practices. The Agency alleged Honda asked people to verify themselves and hand over too much information to opt out or limit, offered choices that were not symmetrical, made authorised agents hard to use, and shared data with ad tech firms without the required contract terms. None of it was a data breach; most of it was how requests were taken in. The guide to CCPA penalties covers the amounts and the published cases.

Running one programme for both

A firm under both laws does not need two programmes. It needs one set of habits tuned to the stricter rule wherever the two overlap, plus a short list of things only one law asks for.

What you can share

• One request intake and one log, with the person’s location recorded so each request gets the right clock.
• One privacy policy with an EU part listing the Art. 13 items and a California part listing the rights and request methods.
• One vendor contract template: GDPR Art. 28 terms for processors, plus the CCPA’s own terms for service providers, contractors and third parties (§ 1798.100(d)).
• One data inventory: the GDPR record of processing and the CCPA notice categories come from the same map.

What only one law asks for

• GDPR only: a lawful basis for every purpose, an EU representative for a firm with no EU establishment (Art. 27), and a DPIA before high-risk processing (Art. 35).
• CCPA only: honoured opt-out signals plus the “Do Not Sell or Share My Personal Information” link, which only a business that processes the signals frictionlessly may leave off (regs § 7025(e), (g)), a toll-free request line unless you are online-only, and a risk assessment before selling or sharing personal information (regs § 7150(b)(1)); for such processing that began before 1 January 2026 and continues, the deadline is 31 December 2027.

California is not the only state. Other US states have their own comprehensive privacy laws, each with its own thresholds, clocks and enforcer; US state privacy laws lists them. If you would rather run all of it from one tool, privacy management software compares platforms that cover the GDPR and the US states together.

Questions