GDPR and CCPA are often mentioned together as if compliance with one implies the other. They share objectives but differ on the points that determine what you actually have to build.
#Who each one applies to
GDPR applies to anyone processing personal data of individuals in the EU or EEA, regardless of where the processor is located. There is no revenue or size threshold. A one-person blog in Ohio with European readers is in scope.
CCPA/CPRA applies to for-profit businesses doing business in California that meet at least one threshold: annual gross revenue above roughly $25 million, buying or selling personal information of 100,000 or more California residents or households, or deriving 50% or more of annual revenue from selling or sharing personal information.
Practical consequence: most small websites are in scope for GDPR and out of scope for CCPA. That surprises people, because CCPA gets more attention in US media.
#The biggest difference: opt-in versus opt-out
This is the divergence that changes your implementation.
GDPR is opt-in. For most non-essential processing — analytics, advertising, marketing email — you need consent before processing begins. Consent must be freely given, specific, informed, unambiguous, as easy to withdraw as to give, and logged.
CCPA is opt-out. You may collect and use personal information by default, but you must disclose it and provide a mechanism to opt out of sale or sharing. Hence the "Do Not Sell or Share My Personal Information" link.
If you build for GDPR you have largely satisfied CCPA's mechanics, because opt-in is stricter than opt-out. The reverse is not true — a CCPA-compliant site typically fails GDPR because it sets cookies before consent.
#Personal data versus personal information
GDPR defines personal data broadly: anything relating to an identified or identifiable natural person. IP addresses, cookie identifiers and device fingerprints all qualify. Special categories — health, biometrics, political opinions, religious belief, sexual orientation — carry additional restrictions.
CCPA uses "personal information", defined at the household level as well as the individual, which is unusual. It also explicitly covers inferences drawn about a consumer, and CPRA added a "sensitive personal information" category with usage limits.
#The rights people have
Both grant access, deletion and portability. The differences worth knowing:
GDPR additionally provides: rectification, restriction of processing, objection to processing based on legitimate interests, and rights concerning automated decision-making and profiling.
CCPA/CPRA additionally provides: the right to opt out of sale or sharing, the right to limit use of sensitive personal information, and an explicit non-discrimination right for exercising rights.
Response times: GDPR one month, extendable to three for complex requests. CCPA 45 days, extendable by another 45.
#"Sale" is broader than it sounds
CCPA's definition of "sale" covers disclosure for "monetary or other valuable consideration". CPRA added "sharing" for cross-context behavioural advertising.
That means running advertising cookies may constitute a sale or share even though no money changes hands for the data. This is why sites with no data-broker relationship still display a "Do Not Sell or Share" link.
#Legal basis
GDPR requires a lawful basis for every processing activity: consent, contract, legal obligation, vital interests, public task or legitimate interests. You must identify and document which applies to what, and disclose it.
CCPA has no equivalent. If you disclose the processing and honour opt-outs, you may proceed.
This is why GDPR privacy notices contain a legal basis section and CCPA-only notices do not. The privacy policy generator includes the section only when you select GDPR.
#Enforcement
GDPR: supervisory authorities can fine up to 4% of global annual turnover or €20 million, whichever is higher. Enforcement is usually complaint-driven, with warnings and corrective orders more common than headline fines for small operators.
CCPA/CPRA: the California Privacy Protection Agency and Attorney General enforce, with civil penalties per violation. There is a limited private right of action for data breaches involving certain unencrypted personal information — not for general violations.
#What to build if you want to satisfy both
Build to GDPR and add the CCPA-specific pieces:
- Consent before non-essential cookies, with refusal as easy as acceptance, and logged
- A privacy notice covering categories, purposes, legal bases, recipients, retention, transfers and rights
- A "Do Not Sell or Share My Personal Information" link if you serve advertising and are in CCPA scope
- Honour Global Privacy Control browser signals, which California treats as a valid opt-out
- A working request process with a monitored inbox and a documented workflow
- A record of processing activities, which GDPR requires and which makes everything else easier
That set covers the overwhelming majority of small-site obligations under both, and translates reasonably well to the newer US state laws and to UK, Canadian and Brazilian regimes.
Frequently asked questions
Does GDPR apply to a US website?
Yes, if you process personal data of people in the EU or EEA. There is no size or revenue threshold. Simply having European visitors whose IP addresses appear in your logs and analytics brings you into scope.
Does CCPA apply to my small business?
Only if you meet a threshold: roughly $25 million in annual revenue, handling data on 100,000 or more California residents or households, or deriving half your revenue from selling or sharing personal information. Most small sites fall outside it.
If I comply with GDPR, am I CCPA compliant?
Largely, because GDPR's opt-in standard is stricter. You would still need to add CCPA-specific elements such as the "Do Not Sell or Share" link and honouring Global Privacy Control signals.