Understanding the differences between GDPR vs CCPA is now a baseline requirement for any business that collects personal information from consumers in Europe and California. Both laws aim to protect individual privacy, but they diverge significantly in scope, definitions, enforcement mechanisms, and the obligations they place on organisations.
For a business with European and Californian operations, begin with separate scope decisions. Neither compliance programme automatically satisfies the other. The CCPA, as amended by the CPRA, has specific sale/sharing, opt-out and service-provider rules that do not map directly onto GDPR lawful bases and processor contracts.
This article provides a structured GDPR vs CCPA comparison across the dimensions that matter most to compliance teams: territorial scope, definitions, consumer rights, consent requirements, penalties, and practical compliance strategies.
How Do GDPR and CCPA Differ in Scope?
Territorial reach
The GDPR covers processing in the context of an EU establishment’s activities, wherever processing occurs. For a business without such an establishment, Article 3(2) addresses processing related to offering goods or services to people in the Union or monitoring their behaviour there. Holding an EU resident’s details or operating a globally accessible website is not by itself sufficient. Our non-EU applicability guide and guide for US companies explain those tests and the EEA context.
The CCPA’s main business definition covers qualifying for-profit entities doing business in California that determine purposes and means and meet at least one threshold: annual gross revenue above $26,625,000; annually buying, selling or sharing personal information of 100,000 or more consumers or households; or deriving 50% or more of annual revenue from selling or sharing consumers’ personal information. The revenue amount reflects the adjustment effective from 2025, still relevant in 2026. Examine controlled/common-branding entities, joint ventures, service-provider obligations and statutory exemptions separately; a simple revenue test is not the whole analysis. The California Attorney General’s overview explains coverage.
Protected populations
The GDPR protects natural persons within its material and territorial scope; citizenship is not the test. Under Article 3(1), an EU establishment’s relevant processing can include people outside Europe. CCPA consumers are California residents under the applicable residency definition, which includes people domiciled there who are temporarily outside the state and people there for other than temporary or transitory purposes. Employment and business-contact data are not subject to a general CCPA exemption.
The same exercise is worth running against any other domestic regime a company is already complying with, because the mismatches differ by jurisdiction. Our comparison of the Privacy Act 1988 and the GDPR covers the Australian Privacy Principles and the AU$3 million small business exemption, and our comparison of the Singapore PDPA and the GDPR covers the consent-centric model and the absence of a special-category tier.
Personal Information Definitions
The GDPR defines personal data broadly: any information relating to an identified or identifiable natural person. This includes names, IP addresses, cookie identifiers, location data, genetic data, and even pseudonymised data where re-identification is possible. The definition is deliberately technology-neutral, ensuring it captures new forms of data as they emerge. Our detailed guide on personal data under GDPR covers edge cases and regulatory interpretation.
The CCPA uses a similarly broad definition. Personal information is information that identifies, relates to, describes, or could reasonably be linked to a particular consumer or household. The inclusion of “household” is a notable difference: it means data about a home (such as energy consumption or smart device data) qualifies even if it cannot be tied to a single individual. The CCPA also explicitly lists categories such as biometric information, internet browsing history, geolocation data, and professional or employment-related information.
Both laws exclude genuinely anonymised or de-identified data from their scope, though the technical standards required for anonymisation differ.
How Do Consumer Rights Compare?
Both GDPR and CCPA grant individuals meaningful rights over their personal data, but the extent and mechanics vary.
The GDPR provides data subjects with the right of access, rectification, erasure (the “right to be forgotten”), restriction of processing, data portability, and the right to object. Article 12(3) generally requires a response within one calendar month, extendable by two further months where necessary because of complexity or number, with notice and reasons within the first month. A data subject access request and erasure request require different checks and applicable exceptions. There is also a right not to be subject to solely automated decision-making, including profiling, that produces legal or similarly significant effects.
The CCPA grants consumers the right to know what personal information is collected, the right to delete, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising those rights. Following the passage of the California Privacy Rights Act, additional rights were added: the right to correct inaccurate information and the right to limit the use of sensitive personal information. For requests to know, delete or correct, businesses acknowledge receipt within 10 business days and generally respond within 45 calendar days, with a possible further 45-day extension and notice. Sale/sharing opt-outs and sensitive-information limitation requests have a different rule: comply as soon as feasibly possible, within 15 business days. See the CPPA’s request guidance.
GDPR requires an applicable lawful basis, which need not be consent. CCPA does not reproduce that six-basis structure, but its notice, purpose, proportionality, contract and consumer-choice rules still constrain collection and use. Neither law is accurately described as permitting all processing once one banner choice has been collected.
Consent and Legal Basis Requirements
GDPR: six legal bases
Under the GDPR, every processing activity must rest on one of six legal bases defined in Article 6: consent, contractual necessity, legal obligation, vital interests, public interest, or legitimate interest. Consent must be freely given, specific, informed, and unambiguous. Pre-checked boxes and bundled consents have been repeatedly declared invalid by supervisory authorities. For detailed guidance, see our valid GDPR consent guide and the EDPB Guidelines on consent.
CCPA: notice and opt-out
The CCPA requires notice at or before collection and limits collection, use, retention and sharing by purpose and proportionality requirements. A business that sells or shares information must provide required opt-out mechanisms and honour qualifying opt-out preference signals, such as Global Privacy Control. “Sharing” includes disclosure for cross-context behavioural advertising even without payment. Required links and any permitted alternative depend on the regulations. For sale or sharing involving consumers known to be under 16, affirmative authorisation is required, with a parent or guardian authorising for those under 13.
A GDPR consent banner therefore cannot be treated as proof of CCPA compliance. Test the California opt-out signal and downstream sale/sharing controls as distinct requirements, and check cookie consent under applicable European ePrivacy rules separately.
Penalties and Enforcement
GDPR has two principal administrative fine tiers, with the higher maximum at EUR 20 million or 4% of the undertaking’s worldwide annual turnover, whichever is higher. Article 82 also provides a route to compensation for material or non-material damage under its conditions. See the GDPR fines overview for the framework; not every infringement receives the maximum.
California enforcement involves both the Attorney General and the California Privacy Protection Agency. The inflation-adjusted amounts effective in 2025 include administrative fines up to $2,663 per violation or $7,988 for intentional violations and specified known-under-16 cases. The statutory-damages range is $107–$799 per consumer per incident, or actual damages if greater, for the limited private-action circumstances in section 1798.150. That action is not available for every CCPA infringement: assess the specified data, security breach and statutory conditions.
The final CPPA regulations took effect on 1 January 2026, with staged compliance dates. Covered risk-assessment duties begin in 2026, and activities started earlier and continuing afterwards have a completion deadline of 31 December 2027 under section 7155. The first risk-assessment submission is due 1 April 2028. ADMT requirements for significant decisions begin 1 January 2027. For businesses subject to cybersecurity audits, initial certification deadlines fall in 2028, 2029 or 2030 according to the applicable revenue band. These duties do not apply uniformly to every covered business or every automated system.
Use the CPPA’s implementation timetable alongside the final regulations to assign each applicable duty and deadline. An effective date, the date an assessment must be completed and the date information is submitted are different milestones.
Practical Steps for Dual Compliance
Organisations subject to both GDPR and CCPA should map shared evidence while preserving each law’s distinct decisions. In practice, this means:
- Map your data flows. Identify what personal data you collect, where it flows, who receives it, and under what legal basis. The map supplies evidence for GDPR records and CCPA disclosures, which still require their own fields, scope and delivery checks. A GDPR compliance checklist provides a structured starting point.
- Implement consent management for both regimes. Use a consent management platform that supports granular opt-in for GDPR purposes and opt-out mechanisms for CCPA purposes. Ensure the tool distinguishes between EEA and California users.
- Honour all data subject and consumer rights. Build a single intake system for privacy requests, then route them according to the applicable law. Track response deadlines carefully under each regime.
- Conduct impact assessments. The GDPR requires a data protection impact assessment for high-risk processing. California’s final risk-assessment regulations have their own processing triggers, content, review and submission rules; do not assume that a GDPR DPIA automatically satisfies them.
- Align your privacy principles. Both laws reflect shared underlying values: transparency, purpose limitation, data minimisation, and accountability. Reviewing the foundational data privacy principles will help your team internalise these standards rather than treating compliance as a checklist exercise.
Example: One Advertising Vendor, Two Control Checks
For a retailer using an advertising pixel, trace what leaves the browser, which entity receives it and what that entity can do with it. For the European flow, assess ePrivacy consent, the GDPR basis, transparency, vendor role and any international transfer. For the Californian flow, determine whether the disclosure is a sale or sharing, whether the recipient contract meets the relevant requirements, and how an opt-out signal stops the activity.
Keep a test record for a fresh browser, a rejected European consent choice, a California opt-out preference signal and a returning user who changes their choice. Check actual network requests and downstream audience use rather than only the banner’s appearance. A shared data inventory supports both analyses; the legal conclusions and technical acceptance conditions remain explicit.
FAQ
Is the CCPA the same as GDPR?
No. GDPR uses territorial/activity tests and requires one of six lawful bases, not universal opt-in consent. CCPA covers qualifying businesses and California residents under its definitions, with specific notice, sale/sharing, choice and service-provider rules. Both contain exceptions and additional obligations.
Does a company need to comply with both GDPR and CCPA?
Yes, if the particular processing and business satisfy both laws’ applicability rules. Document the GDPR Article 3 analysis and the California business/residency/exemption analysis separately. A person’s location at one moment or a company’s revenue alone may not settle either question.
Which law is stricter, GDPR or CCPA?
Compare obligations for the actual activity rather than ranking the laws. GDPR has lawful-basis, accountability and transfer requirements; California adds distinctive sale/sharing and opt-out-signal duties. Both can expose organisations to regulatory action and civil claims under their respective conditions.
How can small businesses manage compliance with both laws?
Build a shared inventory and request intake, then assign the applicable obligations and deadlines under each law. Check California thresholds and exceptions, test opt-out signals and recipient contracts, and document GDPR lawful bases, rights and transfer safeguards. Reuse verified evidence while preserving the different legal decisions.