The EU’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), both give people rights over their information, but differ in important ways.

GDPR Overview

The GDPR has applied since May 25, 2018. It covers processing of personal data in the context of an organization’s establishment in the EU, and processing by organizations outside the EU that relates to offering goods or services to, or monitoring, people in the EU.

CCPA Overview

The CCPA took effect on January 1, 2020, and the CPRA’s amendments on January 1, 2023. It protects California residents (“consumers”) and applies to for-profit businesses that collect California consumers’ personal information, do business in California and meet at least one threshold: annual gross revenue over $26,625,000 (inflation-adjusted, from January 1, 2025); buying, selling or sharing the personal information of 100,000 or more consumers or households a year; or deriving 50% or more of annual revenue from selling or sharing personal information. It also covers certain entities under common control and branding with such a business that receive consumers’ personal information from it, qualifying joint ventures, and businesses that voluntarily certify to the regulator that they are bound by it, and it places direct duties on service providers, contractors and third parties.

Key Differences

  1. Who is covered: The GDPR has no size threshold and covers companies, public bodies and non-profits. The CCPA’s main test is the for-profit thresholds above.
  2. What data: The GDPR protects “personal data”, meaning information relating to an identified or identifiable person. The CCPA protects “personal information”, which includes information that could reasonably be linked with a particular consumer or household.
  3. Consent: Under the GDPR, every processing activity needs one of six lawful bases, of which consent is one, and EU ePrivacy rules require consent before non-exempt cookies are used. The CCPA does not generally require consent to collect personal information; it relies mainly on notice and the right to opt out of sale or sharing. Opt-in authorization is required to sell or share the personal information of consumers a business knows are under 16, and businesses that sell or share must honor opt-out signals such as Global Privacy Control.
  4. Rights: Both laws give rights of access, correction and deletion, subject to exceptions. The GDPR also gives rights to restrict processing and to object to it, each with its own conditions. The CCPA also gives the right to limit a business’s use and disclosure of sensitive personal information to purposes the law permits, such as providing the goods or services the consumer requested (sensitive personal information collected or processed without the purpose of inferring characteristics about the consumer is outside this right), and protection against retaliation for exercising privacy rights.
  5. Enforcement: GDPR fines can reach €20 million or 4% of worldwide annual turnover (or €10 million or 2% for some infringements), and anyone who suffers damage from an infringement can claim compensation. CCPA fines and civil penalties are up to $2,663 per violation, or $7,988 per intentional violation or violation involving minors’ personal information (for administrative fines, where the business actually knows the consumer is under 16), enforced by the California Privacy Protection Agency and the Attorney General. Consumers can sue only over certain data breaches caused by inadequate security.

Conclusion

The GDPR applies broadly and requires a lawful basis for all processing; with EU ePrivacy rules, it requires consent for non-exempt cookies. The CCPA applies mainly to for-profit businesses above its thresholds and relies on notice and opt-out rights.

This article is general information, not legal advice.