The California Consumer Privacy Act (CCPA) and the European Union’s General Data Protection Regulation (GDPR) both give people greater control over their personal information. For businesses, however, they create different obligations around data collection, consent, consumer requests, and the use of information for advertising. Understanding those differences helps you decide which rules apply and how to put them into practice.
The CCPA must also be read alongside the changes introduced by the California Privacy Rights Act (CPRA). The CPRA amended the CCPA rather than replacing it with a separate privacy framework. Its core amendments took effect on January 1, 2023. This comparison uses the CCPA as amended, including those changes.
The differences between the CCPA and GDPR affect everything from whether your business falls within scope to how your website handles privacy preferences.
The table below summarizes the main distinctions.
Area | CCPA | GDPR |
|---|---|---|
1. Geographic scope | Protects California residents and can apply to businesses based elsewhere. | Covers processing connected to EU/EEA establishments and certain activities of organizations outside the region. |
2. Organizations covered | Primarily applies to for-profit businesses meeting specified thresholds. | Applies without a general revenue or consumer-count threshold, including to public bodies and nonprofits. |
3. Personal and sensitive information | Includes information linked to a consumer or household, with specific exclusions and sensitive information categories. | Covers identifiable individuals, with additional protection for special categories of personal data. |
4. Legal basis for processing | Establishes notice, purpose limitation, and consumer choice requirements without the GDPR’s six-basis model. | Requires an appropriate lawful basis for each processing activity. |
5. Cookies and advertising | Emphasizes the right to opt out of sales and sharing for cross-context behavioral advertising. | Works alongside ePrivacy rules requiring prior consent for cookies and tracking that need permission. |
6. Individual rights | Includes knowing, obtaining a portable copy, deleting, correcting, opting out, and limiting certain sensitive information uses. | Includes access, correction, erasure, restriction, portability under specified conditions, and objection. |
7. Response deadlines | Generally 45 calendar days for requests to know, delete, or correct. | Generally one month for individual rights requests. |
8. Children’s information | Requires opt-in authorization to sell or share information about consumers known to be under 16. | Sets specific parental authorization rules for consent-based online services offered directly to children. |
9. International transfers | Has no equivalent to the GDPR’s dedicated international transfer framework. | Requires appropriate transfer arrangements for personal data sent outside the EEA. |
10. Enforcement and legal claims | Uses per-violation penalties and a limited private right of action for certain data breaches. | Allows turnover-based fines, corrective measures, and compensation where the legal conditions are met. |
CCPA: The law protects California residents. “Consumer” extends beyond paying customers and can include employees and people acting in a business context. A business does not have to be headquartered in California to fall within scope. Its activities and the applicable statutory criteria determine whether the law applies.
GDPR: The regulation can apply to processing carried out in the context of an EU or European Economic Area establishment. It can also apply to organizations elsewhere that offer goods or services to people in the region or monitor their behavior there. Protection is not determined solely by citizenship.
CCPA: The main business definition covers qualifying for-profit entities that do business in California and determine the purposes and means of processing personal information. At least one of these thresholds must be met:
Annual revenue: Gross annual revenue exceeding $26,625,000 in the preceding calendar year.
Information volume: Annually buying, selling, or sharing the personal information of at least 100,000 consumers or households.
Revenue source: Deriving at least 50% of annual revenue from selling or sharing consumers’ personal information.
The revenue figure reflects the California Privacy Protection Agency’s updated CCPA monetary thresholds, effective January 1, 2025. Related entities and service provider relationships may require additional assessment.
GDPR: There is no general minimum revenue or number of customers required for the regulation to apply. Small businesses, charities, and public bodies can all fall within scope. Some obligations depend on the nature and risks of processing rather than the organization’s size alone.
CCPA: Personal information includes information reasonably linked to a consumer or household. Sensitive personal information includes categories such as precise geolocation, certain government identifiers, and credentials that allow access to an account. Consumers can limit certain uses and disclosures of this information.
Information meeting the CCPA’s definition of “publicly available” is excluded from personal information. Simply finding information online does not establish that the exclusion applies.
GDPR: Personal data is information relating to an identified or identifiable individual. Special categories of personal data, including health data, political opinions, genetic data, and biometric data used for unique identification, receive additional protection. Processing them requires an applicable Article 9 condition as well as a lawful basis.
Public availability does not, by itself, remove information from GDPR protection. The sensitive data categories also differ between the laws. Precise geolocation, for example, is sensitive personal information under the CCPA but is not automatically a special category under GDPR Article 9.
CCPA: The law does not use the GDPR’s six lawful bases. Instead, businesses must explain their collection purposes, keep processing reasonably necessary and proportionate, and respect applicable consumer choices. Consent can still be required in specific circumstances, including certain uses that are incompatible with the context in which information was collected.
GDPR: Each processing activity needs an appropriate legal basis for processing personal data. The European Data Protection Board identifies six legal bases for processing personal data: consent, contract, legal obligation, vital interests, public task or official authority, and legitimate interests.
For example, using a delivery address to fulfill an order may be necessary to perform a contract. Using that information for another purpose requires a separate assessment. GDPR compliance therefore does not mean asking for consent for every use of personal data.
CCPA: The law does not require prior consent for every cookie. When cookies or pixels facilitate a sale of personal information or sharing for cross-context behavioral advertising, applicable opt-out rights must be honored. Covered businesses must also act on valid opt-out preference signals, such as Global Privacy Control (GPC).
GDPR and ePrivacy: European cookie requirements involve both frameworks. ePrivacy rules govern storing information on, or accessing information from, a user’s device. GDPR governs the processing of personal data. Advertising and tracking cookies that require consent must wait until the user gives permission. Cookies strictly necessary for a service explicitly requested by the user may qualify for an exemption.
These differences shape cookie consent management. In the EU, consent-dependent tags stay inactive until permission is given. In California, applicable sale and sharing opt-outs must be reflected in the relevant advertising technologies and data flows.
CCPA: Consumers can request information about a business’s data practices, obtain a portable copy of their personal information, and request deletion or correction. They can also opt out of sales and sharing, limit certain uses of sensitive information, and exercise their rights without unlawful discrimination.
GDPR: Individuals have rights of access, rectification, erasure, restriction, portability, and objection. Some depend on the processing circumstances. The right to data portability, for example, applies to data provided by the individual where processing is automated and based on consent or a contract. An objection to direct marketing requires processing for that purpose to stop.
Both laws therefore contain portability provisions. The difference lies in their scope and conditions, rather than portability being available under only one law.
CCPA: Under the CCPA regulations on request response timelines, requests to know, delete, or correct generally require a response within 45 calendar days. Where reasonably necessary, the period may be extended by another 45 days with appropriate notice. Sale and sharing opt-outs must be implemented as soon as feasibly possible and within 15 business days.
GDPR: Individual rights requests must be answered without undue delay and generally within one month. An extension of up to two additional months is possible where justified by the complexity or number of requests. The individual must be informed of the extension and its reasons within the first month. One month is not necessarily the same as 30 days.
A data subject access request (DSAR) process should account for these differences rather than applying one deadline to every request.
CCPA: Businesses must obtain affirmative authorization before selling or sharing personal information about consumers they know are under 16. For children under 13, authorization must come from a parent or guardian. Consumers aged 13 to 15 can provide it themselves. This requirement specifically addresses sales and sharing.
GDPR: Specific age rules apply when an information society service is offered directly to a child and processing relies on consent. The default age is 16, but EU member states may lower it to no less than 13. Below the applicable age, consent must be given or authorized by the person holding parental responsibility. This is not a universal age rule for every activity involving children’s data.
CCPA: The law does not establish a country adequacy system equivalent to the GDPR’s. Disclosures to overseas recipients still require consideration of the recipient’s role, contractual restrictions, and applicable sale or sharing rules. Sending information abroad does not remove those obligations.
GDPR: Transfers of personal data outside the EEA must meet the GDPR’s international data transfer requirements. Options include adequacy decisions, standard contractual clauses, and binding corporate rules. Limited derogations are available in specific circumstances.
When choosing an overseas cloud provider, businesses therefore need to assess the international transfer mechanism as well as the processing agreement.
CCPA: The California Privacy Protection Agency and California Attorney General have enforcement roles. Following the adjustment effective in 2025, administrative fines can reach $2,663 per violation or $7,988 per intentional violation and violations involving consumers known to be under 16.
The CCPA’s private right of action is limited to certain qualifying data security breaches. Consumers cannot bring a private CCPA lawsuit for every violation of the law.
GDPR: Supervisory authorities can impose fines and restrict or prohibit processing. For the higher tier of infringements, fines can reach €20 million or 4% of the preceding financial year’s total worldwide annual turnover, whichever is higher. Individuals may also seek compensation for material or non-material damage caused by an infringement. An infringement alone does not automatically establish a right to compensation.
Both laws can apply when a business meets their respective scope requirements. For example, an e-commerce company doing business in California and meeting the CCPA thresholds may also fall under the GDPR if it offers products to people in the EU/EEA. Compliance with one does not automatically satisfy the other.
A shared privacy program can cover common requirements while addressing the differences:
Map your data: Identify what you collect, why you use it, who receives it, and how long you retain it.
Adapt your notices: Explain relevant rights and request methods. Use a privacy policy template as a starting point, then align it with your actual practices.
Apply user choices: Obtain prior consent where required and enforce applicable sale and sharing opt-outs, including valid preference signals.
Set appropriate request procedures: Match verification steps and response deadlines to the applicable law.
Review vendors: Check contracts, processing purposes, and international transfers.
Keep the program aligned with current implementing rules. California regulations effective January 1, 2026 introduced additional provisions on risk assessments, cybersecurity audits, and automated decisionmaking technology for specified businesses and activities. Their compliance schedules differ, so they should not all be treated as having the same implementation deadline.
Okito supports the website consent and preference controls involved in GDPR compliance and CCPA compliance. Identifying cookies and tracking technologies gives you a clearer starting point for reviewing their purposes and configuring the appropriate controls. Through Okito, you can present understandable choices, keep consent-dependent technologies inactive until permission is given, and maintain records of user preferences.
For CCPA requirements, applicable sale and sharing opt-outs and supported preference signals can be applied to the relevant tags and technologies configured within the platform. Visitors can revisit their preferences, with changes reflected in the configured tracking behavior. Okito brings scans, settings, and preference records together so you can review your setup as services and data practices change. These website controls form part of a broader compliance program that also covers security, consumer requests, and vendor contracts.
The main difference is how each law regulates the use of personal information. The GDPR requires businesses to identify a lawful basis for each processing activity and follow data protection principles throughout the data’s lifecycle.
The CCPA places particular emphasis on transparency and consumers’ control over their information, including the right to opt out of sales and sharing for cross-context behavioral advertising. These differences affect how businesses collect data, present privacy choices, and respond to requests.
GDPR stands for General Data Protection Regulation, the European Union’s main framework for protecting personal data. CCPA stands for California Consumer Privacy Act, which gives California residents rights over personal information handled by covered businesses. The California Privacy Rights Act, or CPRA, amended the CCPA by adding and expanding protections. Businesses should therefore assess the CCPA in its amended form.
Both laws require businesses to explain how they use personal information and give people meaningful control over it. They share rights such as access, correction, deletion, and obtaining portable copies, although the conditions differ. Both also require businesses to translate their privacy commitments into actual procedures and safeguards. These similarities make a shared data inventory and request-handling process useful, with adjustments for each law’s requirements.
The GDPR imposes broader requirements in areas such as lawful bases for processing, special categories of data, and international transfers. The CCPA has more specific requirements around sales, sharing for cross-context behavioral advertising, and valid opt-out preference signals.
A business may therefore face obligations under the CCPA that its GDPR processes do not address. The practical answer depends on what information the business uses, whose information it handles, and what it does with that information.
A business’s location does not determine applicability on its own. Businesses in other states or countries can fall within scope if they do business in California and meet the relevant statutory conditions.
US businesses can fall under the GDPR when they offer goods or services to people in the EU/EEA or monitor their behavior there. Processing connected to an EU/EEA establishment can also bring activities within scope. For example, a US retailer deliberately serving customers in the region may need to meet GDPR requirements for the related processing. Simply having a website that people in Europe can access does not, on its own, establish applicability.
GDPR compliance provides a useful foundation, but it does not automatically meet every CCPA requirement. Covered businesses must separately address applicable sale and sharing opt-outs, valid GPC signals, and rights to limit certain uses of sensitive personal information. They also need notices and request procedures that reflect CCPA terminology, conditions, and deadlines. The most effective approach is to build on existing privacy processes and add the controls required by California law.
GDPR compliance means handling personal data lawfully, fairly, and transparently from collection through deletion. Organizations need an appropriate lawful basis, clear purposes, suitable retention periods, security measures, and procedures for respecting individual rights. They must also address relevant vendor relationships and international transfers, and be able to demonstrate their compliance.
Cookie consent management supports the website side of this work, while the broader obligations extend across the organization’s personal data processing.
Türkçe
English