The main difference between the CCPA and the GDPR is the consent model. Together with the ePrivacy Directive, the General Data Protection Regulation (GDPR) requires opt-in consent before a website sets non-essential cookies. The California Consumer Privacy Act (CCPA) lets those cookies run and instead requires an opt-out of the sale or sharing of personal information. The GDPR also applies to any organisation that offers goods or services to people in the EU or monitors them, whatever its size, while the CCPA applies only to for-profit businesses that meet one of three thresholds.
A single website can trigger both laws at once. If you use analytics tools, advertising pixels or a customer relationship management system, your tracking scripts have to wait for consent from European visitors while California visitors get a working opt-out. The table below sets the two side by side, and the sections after it explain each row.
| Feature | GDPR (EU and EEA) | CCPA (California, as amended by the CPRA) |
|---|---|---|
| Consent model for cookies | Opt-in before non-essential cookies (ePrivacy Directive Article 5(3)) | Opt-out of sale or sharing, with opt-in only for known minors under 16 |
| Who it applies to | Any organisation offering goods or services to, or monitoring, people in the EU | For-profit businesses meeting a revenue, volume or data-sale threshold |
| Personal data | Relates to an identified or identifiable natural person | Identifies or could be linked to a consumer or household |
| Browser opt-out signals | No legal duty | Must honour Global Privacy Control as an opt-out |
| Deadline for rights requests | One month | 45 days |
| Maximum fines | 20 million EUR or 4% of global turnover | $2,663 per violation, $7,988 per intentional violation |
| Cookie banner | Must block trackers until the visitor agrees | Must offer a "Do Not Sell or Share" link or equivalent opt-out |
Territorial scope: who falls under each law
The GDPR casts a wide net based on where the people are, not where the business is.
Under Article 3(2) of the GDPR, an organisation outside the EU must comply when it offers goods or services to people in the EU or monitors their behaviour there. It does not matter if your company is headquartered in the United States, Asia, or South America. Tracking users across the internet to build profiles, analysing their purchasing habits, or using location data to serve targeted advertisements all count as monitoring. If your US-based e-commerce site actively targets European buyers by offering prices in euros or shipping to France, the regulation applies. There are no minimum revenue thresholds or exemptions for small businesses under the European framework.
The California law takes a narrower, business-based approach.
To fall under the CCPA (as amended by the CPRA), a for-profit business must do business in California and meet at least one of three thresholds. The first is annual gross revenue above $26,625,000, the figure the California Privacy Protection Agency set from 1 January 2025. Alternatively, the law applies if you buy, sell, or share the personal information of 100,000 or more California residents or households. The final trigger applies to businesses deriving 50% or more of their annual revenue from selling or sharing consumers' personal information.
Smaller organisations that do not meet these criteria might still face contractual obligations if they act as service providers for larger, regulated entities.
Defining personal data under both laws
What counts as regulated data shifts depending on which side of the Atlantic you are examining.
Article 4 of the GDPR defines personal data as any information relating to an identified or identifiable natural person. This expansive definition covers obvious identifiers like names and email addresses, but it also captures technical footprints such as IP addresses, mobile advertising IDs, and browser fingerprints. If a piece of data can be combined with other information to single out an individual, European regulators treat it as personal data.
California uses the term personal information and adds a dimension of its own.
The CCPA defines personal information as data that identifies, relates to, describes, or could reasonably be linked with a particular consumer or household. Because the definition includes households, data collected from smart home devices or shared IP addresses falls under the law. The Californian framework also excludes publicly available information from government records, a carve-out that does not exist in the European legislation.
The core difference: opt-in compared with opt-out consent
The most practical challenge for website operators lies in the conflicting consent requirements.
European law relies on an opt-in model. Article 5(3) of the ePrivacy Directive, operating alongside the GDPR, requires prior, informed consent before you store or read non-essential cookies on a user's device. Pre-ticked boxes do not count as consent. Your visitors must take a clear affirmative action to accept tracking, and you must block tracking scripts until that action occurs.
California flips this concept entirely.
Under the CCPA, you do not need prior consent to collect data or set tracking cookies on a visitor's browser. You may load your marketing and analytics scripts as soon as the page renders. Instead of asking for permission first, you must provide a clear, conspicuous link titled "Do Not Sell or Share My Personal Information" on your website. When a user clicks this link or their browser sends a Global Privacy Control (GPC) signal, you must stop transferring their data to third parties for sale or cross-context behavioural advertising.
This divergence means a website with visitors in both regions cannot use a single consent management platform configuration for everyone without either restricting data collection in the US more than the law asks or falling short of the law in Europe.
Analytics cookies are treated differently in each region
Website owners frequently misunderstand how standard traffic monitoring tools fit into these frameworks.
Under the GDPR and the ePrivacy rules, analytics cookies are non-essential trackers. European regulators treat standard Google Analytics 4 cookies as needing consent before they are set. Analytics tools gather data for the website owner's benefit, not to deliver something the visitor asked for, so you must block these scripts for European visitors until they agree in your consent interface.
The Californian perspective focuses on the destination of the analytics data.
Using analytics tools often involves sharing data with third-party vendors who might use that information for their own purposes or to build user profiles across different websites. Under the CPRA amendments, sharing for cross-context behavioural advertising is a "share" of personal information, and an exchange for valuable consideration can be a "sale". You must allow California residents to opt out of these data flows. If a vendor processes the data only on your behalf, under a service provider contract, the transfer is usually neither, but this requires careful vendor contract management.
Categorising your tracking scripts correctly is the first step toward proper technical implementation. Understanding the distinction between essential, performance, and marketing tools lets you apply the correct cookie categories based on the visitor's location.
Running one banner for both regions
Most websites with visitors in both places use geo-targeting: the banner checks the visitor's region and applies the rule set for it. European visitors see an opt-in banner with an equally prominent "Reject all" choice, and nothing optional loads until they decide. California visitors see an opt-out notice with a "Do Not Sell or Share" choice, and a GPC signal counts as an opt-out without any click.
The region rules are yours to set. Some businesses show the opt-in banner everywhere because it is simpler to run, accepting less US analytics data in return. Others use opt-out in California and notice-only elsewhere in the US. Both approaches start from the same inventory: knowing which cookies your site sets and which of them share data with third parties.
User rights and subject requests
Both frameworks grant individuals significant control over their data, though the specific mechanisms vary.
The GDPR provides a set of eight data subject rights. These include the right to access, the right to rectification, the right to erasure, and the right to data portability. European residents can also object to specific types of processing, particularly direct marketing, and are protected against decisions based solely on automated processing. Individuals can also ask you to restrict processing while the accuracy or legality of their data is checked. Managing these requests requires strict internal data governance, because missing the one-month deadline in Article 12(3) often triggers complaints to national supervisory authorities.
California initially offered a narrower set of rights, but later amendments have closed the gap.
The CPRA expanded the original law by adding the right to correct inaccurate information and the right to limit the use of sensitive personal information. California residents can request details about the specific pieces of data you have collected, the categories of sources, and the third parties with whom you have shared it. The Californian framework also requires businesses to treat opt-out preference signals sent by web browsers as valid requests to stop selling or sharing data, and since 1 January 2026 the regulations require you to show that the signal was processed. You cannot force the user to fill out a separate web form to honour this automated signal. You generally have 45 days to verify and fulfil a CCPA consumer rights request.
Enforcement, fines and recent actions
Regulators on both continents are pursuing companies that fail to meet their privacy obligations.
The financial penalties under the GDPR are famously severe. Data protection authorities can levy fines up to 20 million EUR or 4% of a company's global annual turnover, whichever is higher. In May 2023, the Irish Data Protection Commission issued a record 1.2 billion EUR fine to Meta Platforms Ireland for unlawful data transfers to the United States. In August 2024, the Dutch DPA fined Uber 290 million EUR over transfers of drivers' data to US servers, and on 2 May 2025 the Irish regulator fined TikTok 530 million EUR over transfers of EEA user data to China.
California relies on a different penalty structure that focuses on per-violation fines.
As of October 2026, the maximum is $2,663 for each violation and $7,988 for each intentional violation or one involving a known minor under 16. While these numbers sound smaller, they multiply quickly across thousands of website visitors. The California Privacy Protection Agency issued its first fine in March 2025, $632,500 against Honda, and fined Tractor Supply $1.35 million in September 2025. On the Attorney General's side, the list of enforcement actions runs from Sephora ($1.2 million, 2022) and DoorDash ($375,000, 2024) to Healthline ($1.55 million, July 2025), Disney ($2.75 million, February 2026) and General Motors ($12.75 million, May 2026), the largest CCPA penalty so far.
Brazil's LGPD and the newer US state laws add their own variations, so the same inventory of what your site sets serves more than two laws.
Questions about the CCPA and the GDPR
Do US companies have to follow the GDPR?
Yes, when they offer goods or services to people in the EU or monitor their behaviour there. Where the servers or headquarters are located does not change that.
Does meeting the GDPR mean a website also meets the CCPA?
No. European consent rules give you a strong base for data mapping, but California law requires specific disclosures, a dedicated opt-out mechanism and honouring GPC signals, which standard European cookie banners do not include.
Do European analytics rules apply to US visitors?
No. The GDPR and the ePrivacy rules protect people in the EU and EEA. You can configure your website to load analytics tools immediately for US visitors while blocking them for European traffic until the visitor agrees.
What is considered a sale of data under the CCPA?
A sale is not only exchanging data for money. Disclosing personal information to a third party for monetary or other valuable consideration is a sale, and disclosing it for cross-context behavioural advertising is a share, whether or not money changes hands.
Can I use a single cookie banner for both regions?
Yes, with geo-targeting. The banner checks the visitor's region and applies the rules you set for it, so Europeans see an opt-in banner while Californians see a privacy notice and an opt-out choice.
See what your site loads before you set the region rules
The opt-in and opt-out rules both start from knowing which scripts run on your pages. Kukie.io scans your site, sorts the cookies it finds, and shows the banner model you set for each region: opt-in for the EU, opt-out for California, with GPC treated as an opt-out where you choose that model.
