GDPR vs. CCPA: Key Differences Explained

TL;DR

GDPR and CCPA both protect personal information, but they do not use the same rulebook. GDPR focuses on lawful processing across the EU framework, while California’s CCPA gives residents specific controls over covered businesses’ collection, sale, and sharing of data.

· GDPR has six lawful bases for processing, and consent is only one of them.

· CCPA gives California consumers rights to know, delete, correct, and opt out of selling or sharing data.

· Businesses may face both laws, and California’s updated regulations introduced additional phased requirements in 2026 and beyond.

Introduction

A company can sell a product in California, advertise to someone in France, and process both customers’ data on the same platform. That does not mean a single privacy notice or consent setting will satisfy every law. The General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) both give people control over personal information, but they regulate different activities and impose different duties.

Understanding GDPR vs. CCPA starts with three questions. Who is protected, what must a business do before using data, and how can someone challenge that use? The answers shape everything from website tracking to customer-service workflows.

What Is GDPR?

The GDPR is the European Union’s comprehensive personal data protection regulation, applicable since May 2018. It governs how covered organizations collect, use, secure, retain, and disclose information about identifiable individuals. Personal data can include names and email addresses, but also online identifiers or combinations of details that identify a person.

Its central requirement is lawful, fair, and transparent processing. Organizations must have an appropriate legal basis, use data for specified purposes, collect only what is needed, and protect it against inappropriate access. As European Commission guidance explains, the GDPR can apply to businesses outside the EU when they offer goods or services to people in the EU or monitor their behavior there.

What Is CCPA?

The CCPA is California’s consumer privacy law, first effective in 2020. It gives California residents rights to learn about personal information collected by covered businesses, ask for deletion or correction, and stop certain sales or sharing of data. The law also requires purpose limitation and data minimization, restricting collection, use, and retention to reasonably necessary and proportionate purposes. The California Privacy Rights Act (CPRA) amended the CCPA; it did not create an unrelated replacement law.

The amended framework also addresses sensitive personal information and discrimination for exercising privacy rights. California adopted updated CCPA regulations effective January 1, 2026, with later start dates for selected automated decision-making and cybersecurity audit obligations. This article reflects the rules in effect as of October 2026.

GDPR vs. CCPA: Key Differences at a Glance

The clearest distinction is structural. GDPR generally requires a lawful basis for processing personal data. CCPA also includes purpose limitation and data minimization duties, but places distinctive emphasis on notices, consumer controls, and the right to opt out of selling or sharing information for cross-context behavioral advertising.

These differences are a starting point, not a complete compliance test. Exceptions, regulatory definitions, and the particular purpose of processing can change the answer.

Who Must Comply With GDPR and CCPA?

GDPR applies to processing in the context of an EU establishment and can also reach certain organizations outside the EU. For example, an online service actively targeting customers in the EU may be covered even if its headquarters are elsewhere. It has no general $25 million revenue threshold or minimum number of customers.

CCPA typically applies to for-profit entities doing business in California that meet at least one statutory test. In 2026, those tests include annual gross revenue of at least $26.625 million in the preceding calendar year, buying, selling, or sharing the personal information of 100,000 or more California residents or households, or deriving at least half of annual revenue from selling or sharing that information. Certain related entities can also be covered. The California Privacy Protection Agency’s FAQ explains the tests.

A small business therefore cannot assume it is exempt from GDPR, while a larger US business cannot assume California coverage simply because its website is accessible worldwide. Actual activities, relationships, and legal definitions matter.

How Do Consent and Data Collection Rules Differ?

GDPR does not require consent for every use of data. It recognizes six lawful bases, including consent, contract necessity, legal obligation, vital interests, public tasks, and legitimate interests where appropriate. When consent is the basis, it must meet demanding standards, and withdrawal must be possible. Sensitive categories of data may require an additional exception under the law. See the European Commission’s legal-basis overview.

CCPA does not generally require advance consent for every collection or ordinary processing activity. Instead, covered businesses must explain their collection and uses, keep processing reasonably necessary and proportionate to permitted purposes, honor applicable privacy requests, and provide opt-out rights for the sale or sharing of personal information. In this context, “sharing” covers certain disclosures for cross-context behavioral advertising, even without a monetary payment. Specific opt-in rules apply when a business knowingly sells or shares personal information of consumers younger than 16.

Consider an advertising pixel on a shopping website. The GDPR analysis starts with a lawful basis for personal-data processing and applicable ePrivacy rules. Nonessential cookies and similar access to a user’s device generally require consent under the ePrivacy framework. The CCPA analysis asks whether collection, disclosures, and advertising practices trigger notice and opt-out duties, including recognition of applicable opt-out preference signals. See the European Data Protection Board’s cookie guidance.

What Rights Do Individuals Have Under GDPR and CCPA?

Both laws provide access, correction, and deletion rights, but the details differ. Under the GDPR rights framework, individuals may also have rights to restrict processing, receive portable data in specified cases, object to certain processing, and challenge certain solely automated decisions. These rights are not unconditional.

Under the CCPA’s consumer rights framework, California residents can ask to know, correct, or delete information, opt out of its sale or sharing, limit certain uses of sensitive personal information, and receive equal treatment for exercising their rights. Businesses must honor applicable Global Privacy Control signals as opt-out requests.

Timelines are also different. GDPR requests generally require a response without undue delay and within one month, subject to an allowed extension in certain cases. CCPA requests to know, correct, or delete generally have a 45-calendar-day response period, which may be extended by another 45 days when the requirements for an extension are met. Identity checks and statutory exceptions still apply.

How Do GDPR and CCPA Enforcement and Penalties Compare?

GDPR is enforced by independent data protection authorities in EU member states. Depending on the violation, authorities may issue warnings, order changes, restrict processing, or levy fines. The higher statutory fine tier reaches €20 million or 4% of annual worldwide turnover, whichever is higher. That is a maximum ceiling, not the standard penalty for every mistake. European Commission enforcement guidance explains the proportionality assessment.

California’s Attorney General and California Privacy Protection Agency enforce the CCPA. Following the inflation adjustment effective in 2025, the published upper administrative and civil penalty amounts are $2,663 per violation or $7,988 for intentional violations and specified violations involving children under 16. California also permits a limited private right of action for qualifying data breaches; it does not let people sue for every privacy-rights violation. See the official monetary thresholds.

The enforcement models should not be reduced to a contest over which fine looks bigger. Investigations, required corrective action, breach exposure, and business interruption can matter as much as the headline amount.

How Can Businesses Comply With Both GDPR and CCPA?

A workable program begins with a reliable picture of what data moves through the organization. From there, teams can use shared procedures while keeping jurisdiction-specific rules visible.

· Map personal information: Record collection sources, purposes, recipients, retention periods, advertising uses, and international transfers.

· Separate legal requirements: Identify GDPR lawful bases and sensitive-data conditions alongside CCPA notices, sale or sharing decisions, and opt-out mechanisms.

· Create a rights-request workflow: Verify requests appropriately, apply the correct exceptions, and track the different response deadlines.

· Review vendors and security: Check processor, service-provider, and contractor contracts, access controls, incident response, and any required transfer safeguards.

· Monitor regulatory dates: California’s 2026 regulations introduced phased obligations. Certain new high-risk processing requires risk assessments beginning January 2026, while some existing activities have a transition period. Automated decision-making requirements for significant decisions begin January 2027. Cybersecurity audit certification deadlines start in 2028 and vary by business revenue. Check the agency’s implementation timetable.

A single privacy operations system can support these tasks, but it should not erase legal distinctions. For example, honoring California advertising opt-outs is useful, yet it does not establish the GDPR lawful basis for the same tracking activity.

Looking Ahead

GDPR and CCPA share a broad goal of making personal data practices more accountable. Their differences are practical, however, not just geographic. GDPR scrutinizes the justification for processing, while CCPA also sets limits on collection and use and places distinctive emphasis on transparency and consumer choices about selling, sharing, and sensitive information.

Businesses operating across borders should build common data governance foundations, then check each activity against the rules that actually apply. Compliance with one law is not proof of compliance with the other.

FAQs

Is GDPR Stricter Than CCPA?

GDPR is often broader because most covered processing needs a lawful basis and must satisfy detailed accountability principles. CCPA has its own significant requirements, particularly around selling or sharing information, consumer opt-outs, and business disclosures. Which law places the heavier burden depends on the organization’s activities, the information involved, and the consumer rights being exercised. Neither law should be treated as a simplified substitute for the other.

Does CCPA Apply to Businesses Outside California?

Yes. A company does not need its headquarters in California to be covered. A for-profit business doing business in California may fall within CCPA if it satisfies a statutory threshold or is covered through certain qualifying relationships. Simply having a website that someone in California could visit does not, by itself, settle applicability. Businesses should assess their California activities, customers, data flows, and revenue.

Can a Business Be Subject to Both GDPR and CCPA?

Yes. A US company that meets California’s business applicability tests and offers services to people in the EU may need to comply with both. It could have to assess a GDPR lawful basis for processing while also honoring California requests to opt out of selling or sharing information. Shared tools can help with data inventories and requests, but legal decisions remain jurisdiction-specific.

Does GDPR Always Require User Consent?

No. Consent is one of six GDPR lawful bases. A business may instead be able to rely on contract necessity, a legal obligation, vital interests, a public task, or legitimate interests, depending on the facts. The chosen basis must be appropriate and documented. Some processing, including certain sensitive-data uses and tracking activities, involves additional rules that cannot be bypassed simply by choosing a different lawful basis.

What Happens if a Company Violates GDPR or CCPA?

Consequences depend on the violation and the enforcement process. Under GDPR, regulators can order corrective action, restrict processing, and impose proportionate fines. California regulators may investigate and seek per-violation penalties under CCPA. Individuals also have a limited right to sue over qualifying data breaches. Neither law makes its maximum penalty automatic, and a company may face remediation costs even without the highest possible fine.