GDPR vs CCPA: Key Differences Explained (2026)

Regulation (EU) 2016/679 (GDPR) requires a documented lawful basis before any personal data processing begins, making it an opt-in framework. California's CCPA, codified at Cal. Civ. Code 1798.100, permits data collection by default and gives consumers the right to opt out. That structural difference defines the divide between the two laws.

The EU's General Data Protection Regulation (GDPR) and California's consumer privacy regime: the California Consumer Privacy Act (CCPA) as fundamentally reshaped by the California Privacy Rights Act (CPRA), are the two most influential data privacy frameworks operating in the English-speaking world. Both give individuals meaningful control over personal information. Beyond that broad alignment, the two laws diverge sharply in their scope, philosophy, consent model, enforcement machinery, and the specific obligations they impose on organizations.

This guide compares every major dimension of the GDPR and the CCPA/CPRA, incorporates the CPPA's September 2025 rulemaking on automated decision-making, and closes with practical guidance for businesses that must satisfy both frameworks.

Quick Answer

The GDPR is an opt-in, permission-based framework covering virtually any organization that processes EU/EEA residents' data. The CCPA/CPRA is an opt-out framework covering for-profit California businesses that meet defined size thresholds. GDPR penalties dwarf CCPA penalties in maximum dollar terms, but California's dedicated enforcement agency, the CPPA, has accelerated its enforcement pace significantly since 2024.

The Two Regimes at a Glance

Scope and Who Must Comply

GDPR Territorial Reach

The GDPR applies to any organization, regardless of where it is incorporated or physically located, that processes the personal data of individuals in the European Economic Area. A Chicago-based SaaS company with EU customers falls under the GDPR. A Japanese electronics manufacturer whose website is targeted at EU consumers falls under the GDPR. Article 3 makes this extraterritorial reach explicit: the regulation applies to organizations that offer goods or services to EEA individuals or monitor their behavior within the EEA.

Organizations outside the EU/EEA that fall within the GDPR's scope must appoint an EU representative under Article 27, unless they qualify for a narrow exception.

CCPA/CPRA Threshold Model

The CCPA, effective January 1, 2020, and significantly amended by the CPRA (Proposition 24, approved by California voters in November 2020, with most amendments effective January 1, 2023), applies to for-profit businesses that collect personal information from California residents and meet at least one of three thresholds:

• Annual gross revenues above $26,625,000 in the preceding calendar year (the $25 million statutory figure as adjusted for inflation from January 1, 2025)
• Alone or in combination, annually buying, selling, or sharing the personal information of 100,000 or more consumers or households
• Deriving 50% or more of annual revenues from selling or sharing consumers' personal information

Nonprofit organizations and government agencies fall entirely outside CCPA/CPRA scope. The GDPR, by contrast, covers virtually all organizations that handle personal data (including nonprofits, public bodies, and small businesses) with narrow exceptions only for purely personal or household activities.

Definitions: Personal Data vs Personal Information

GDPR: Broad Individual-Focused Definition

The GDPR defines "personal data" as any information relating to an identified or identifiable natural person. This deliberately broad definition covers names, identification numbers, location data, online identifiers (IP addresses, cookie IDs), and factors specific to a person's physical, physiological, genetic, mental, economic, cultural, or social identity. Aggregated and anonymized data that cannot be re-identified falls outside the definition; pseudonymized data generally does not.

Article 9 creates an elevated "special categories" tier for data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for identification purposes, health data, and data concerning sex life or sexual orientation. Processing special-category data requires explicit consent or another specific legal ground.

CCPA/CPRA: Consumer and Household Scope

The CCPA defines "personal information" as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to a particular consumer or household. Notable differences from the GDPR definition: the CCPA explicitly covers household-level data, and it excludes publicly available information that a business has a reasonable basis to believe the consumer has voluntarily exposed to the general public.

The CPRA amendments added a "sensitive personal information" category that partially mirrors GDPR special categories. CPRA sensitive PI covers Social Security numbers, financial account details, precise geolocation, racial or ethnic origin, religious beliefs, contents of communications, genetic data, biometric data processed for identification, health information, and data concerning sex life or sexual orientation. Neural data was added to the statutory definition itself by SB 1223 (Stats. 2024, ch. 887), effective January 1, 2025 (Cal. Civ. Code 1798.140(ae)), and the CPPA's 2025 regulations add personal information of consumers the business knows are under 16 years old.

The Consent Model: Opt-In vs Opt-Out

This is the sharpest philosophical divide between the two frameworks.

GDPR: Permission-Based Opt-In

The GDPR operates on a permission-based model. Organizations cannot process personal data without first establishing one of six lawful bases under Article 6: consent, contract performance, legal obligation, vital interests, public task, or legitimate interests. The lawful basis must be identified and documented before processing begins.

Where consent is the chosen basis, Article 7 demands it be freely given, specific, informed, and unambiguous. Pre-checked boxes, silence, and bundled consents are invalid. Where consent is relied on to process special-category data, it must be explicit (Art. 9(2)(a)): an affirmative statement rather than any conduct that merely implies agreement.

CCPA/CPRA: Activity-Based Opt-Out

The CCPA follows an opt-out model for most processing. Businesses may collect and use personal information without prior consent but must: (1) disclose their data practices in a privacy notice; (2) provide a "Do Not Sell or Share My Personal Information" link; and (3) honor consumer opt-out requests. The CPRA added the right to limit use of sensitive personal information, which functions as a targeted opt-out.

Two notable opt-in exceptions exist: businesses must obtain opt-in consent before selling or sharing the personal information of consumers they know to be under 16 years old (with parental or guardian consent required for those under 13), and opt-in consent is required to re-engage a consumer who has opted out for at least 12 months.

Consumer and Data Subject Rights Compared

Both laws grant individuals a suite of privacy rights. The GDPR's rights are broader and the grounds for exceptions are narrower.

The GDPR's Article 22 right against solely automated decisions is stronger in one respect: it applies by default and requires affirmative justification to override it. The CCPA/CPRA right to opt out of ADMT is an opt-out right; businesses using ADMT may continue to do so until a consumer exercises the opt-out.

Sensitive Personal Information

Both frameworks create an elevated category of data that receives heightened protection, though they define it and regulate it differently.

Under the GDPR, processing "special categories" data is prohibited by default. To process it, organizations must identify both a lawful basis under Article 6 and a specific condition under Article 9: such as explicit consent, employment law obligations, vital interests where consent cannot be obtained, or legitimate activities of nonprofit bodies. Biometric data processed for the purpose of uniquely identifying individuals is a special category.

Under the CCPA/CPRA, consumers have the right to direct a business to limit use and disclosure of sensitive PI to the purpose for which it was collected or other specifically permitted uses. Businesses must provide a "Limit the Use of My Sensitive Personal Information" link (which may be combined with the "Do Not Sell or Share" link). Neural data is part of the statutory definition (Cal. Civ. Code 1798.140(ae)), and the CPPA's 2025 regulations expressly include personal information of consumers the business knows are under 16.

Enforcement and Penalties

GDPR Enforcement

The GDPR is enforced by independent Data Protection Authorities (DPAs) in each EU/EEA member state. Article 83 establishes a two-tier penalty structure:

• Lower tier (up to EUR 10 million or 2% of global annual turnover): violations of data controller and processor obligations, certification rules, and monitoring body rules.
• Upper tier (up to EUR 20 million or 4% of global annual turnover): violations of core data processing principles, consent conditions, data subject rights, and international transfer rules.

Total cumulative GDPR fines had surpassed EUR 5.8 billion by early 2025. Notable recent enforcement actions include the Irish Data Protection Commission's EUR 1.2 billion fine against Meta in May 2023 for unlawful data transfers to the United States (the largest single GDPR fine on record) and a EUR 310 million fine against LinkedIn in October 2024 for unlawful processing for behavioral advertising.

CCPA/CPRA Enforcement

The California Attorney General has enforced the CCPA since its July 1, 2020 enforcement start date and still does, through civil actions (Cal. Civ. Code 1798.199.90). The California Privacy Protection Agency (CPPA, now branded CalPrivacy) gained administrative enforcement power for violations from July 1, 2023, and the two share enforcement; the agency must stay its own action or investigation if the Attorney General asks (1798.199.90(c)).

Penalties under the CCPA/CPRA:

• Up to $2,663 per violation (the $2,500 statutory figure as adjusted for inflation from January 1, 2025)
• Up to $7,988 per intentional violation, or per violation involving the personal information of minors (the $7,500 statutory figure as adjusted; in CPPA actions, consumers the business knows are under 16)
• The CPPA adjusts penalty amounts in January of odd-numbered years to reflect CPI changes (Cal. Civ. Code 1798.199.95(d))

Enforcement has accelerated considerably. Notable actions include:

• General Motors: $12.75 million in civil penalties in a May 2026 settlement announced by the Attorney General (subject to court approval) over the sale of drivers' location and driving data to data brokers, which the Attorney General called the largest CCPA penalty in California history to date and the first data minimization case
• PlayOn Sports: $1.10 million (CalPrivacy Board decision, March 2026), the first decision to address privacy violations involving students and California schools
• Ford Motor Company: $375,703 (March 2026) for requiring consumers to verify their email address before they could opt out
• Tractor Supply Company: $1.35 million for CCPA violations (September 2025), the largest CPPA fine at the time
• American Honda Motor Co.: $632,500 for CCPA violations, the second-highest fine in the law's history at the time
• Todd Snyder, Inc.: $345,178 for improperly administering its privacy portal, including requiring consumers to verify identity before exercising their opt-out rights

The Private Right of Action

Both laws provide some individual litigation rights, but the scope differs substantially.

GDPR Article 82

GDPR Article 82 grants any person who has suffered material or non-material damage as a result of a GDPR infringement the right to receive compensation from the controller or processor. In practice, the availability and scope of class actions for GDPR damages varies considerably by member state; EU law does not impose a unified class-action mechanism.

CCPA Section 1798.150

The CCPA's private right of action is narrower than the GDPR's general compensation right. Under California Civil Code 1798.150, consumers may sue only for qualifying data breaches involving unencrypted or unredacted personal information (or email addresses combined with passwords or security questions) that results from the business's failure to implement reasonable security. Statutory damages range from $107 to $799 per consumer per incident (the $100 to $750 statutory range as adjusted for inflation from January 1, 2025), or actual damages if higher. Before suing for statutory damages, a consumer must give the business 30 days' written notice and a chance to cure (1798.150(b)).

The private right of action does not extend to violations of consumers' access, deletion, opt-out, or other CCPA rights outside the data breach context. Those violations are enforced exclusively by the CPPA or the Attorney General.

The CPPA's 2025 Regulations: ADMT, Risk Assessments, and Cybersecurity Audits

The CPPA Board adopted comprehensive regulations on July 24, 2025. The California Office of Administrative Law approved and filed them on September 22, 2025. These regulations represent the most significant expansion of California's privacy framework since the CPRA's effective date.

Automated Decision-Making Technology (ADMT)

The 2025 ADMT regulations implement consumer rights introduced by the CPRA. The final rules define ADMT as "any technology that processes personal information and uses computation to replace human decisionmaking or substantially replace human decisionmaking" (Cal. Code Regs., tit. 11, §7001(e)).

The regulations grant consumers two rights with respect to businesses using ADMT for significant decisions:

1. Right to opt out of the business's use of ADMT to make significant decisions affecting the consumer, meaning decisions that result in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services (§7001(ddd)).
2. Right of access to information about how ADMT is used, including the logic involved and the significance of the output.

Businesses that use ADMT for significant decisions must comply beginning January 1, 2027. The final rules exclude advertising to a consumer from the definition of a significant decision (§7001(ddd)(6)), so ADMT used only for ad targeting is outside the ADMT opt-out and access requirements.

This right is conceptually similar to, but structurally different from, the GDPR's Article 22 right: GDPR Article 22 prohibits solely automated decisions that produce legal or similarly significant effects unless one of three specific conditions is met; the CCPA/CPRA right is an opt-out that leaves ADMT operational until a consumer invokes it.

Risk Assessments

Businesses must conduct risk assessments before engaging in certain processing activities that present significant risk to consumers' privacy. Risk assessments function like traditional privacy impact assessments and must be documented, reviewed at least every three years, and updated within 45 days of a material change in the processing activity. Processing already under way when the rules took effect on January 1, 2026 must be assessed by December 31, 2027, and businesses must submit the risk assessment information listed in §7157(b), including an executive's attestation, for assessments conducted in 2026 and 2027 to the CPPA by April 1, 2028 (§7157(a)(1)); the full reports go to the CPPA or the Attorney General only on request (§7157(e)).

Cybersecurity Audits

Businesses that meet defined thresholds must conduct annual cybersecurity audits. Certification submissions to the CPPA are staggered:

• April 1, 2028: businesses exceeding $100 million in annual revenue
• April 1, 2029: businesses with $50 to $100 million in annual revenue
• April 1, 2030: businesses under $50 million in annual revenue

The cybersecurity audit requirement has no direct GDPR equivalent, though the GDPR requires appropriate technical and organizational measures under Articles 25 and 32.

The general effective date for all four rule areas is January 1, 2026, with the ADMT compliance obligation for significant decisions deferred to January 1, 2027.

International Data Transfers

The GDPR strictly regulates transfers of personal data outside the EEA. Organizations can transfer data only to countries with an EU adequacy decision, or through mechanisms such as Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or the EU-US Data Privacy Framework. For more on the EU's transfer regime, see our guide to EU data privacy laws.

The CCPA/CPRA places no restrictions on international data transfers. A California business may transfer personal information to any country. Transfers that constitute a "sale" or "sharing" remain subject to opt-out rights and, like any sale or sharing, require a risk assessment (§7150(b)(1)); the regulations contain no separate trigger for cross-border transfers.

Data Protection Officers and Compliance Infrastructure

The GDPR requires certain organizations to appoint a Data Protection Officer (DPO) under Article 37: public authorities, organizations whose core activities involve large-scale systematic monitoring of individuals, and organizations processing special-category data at scale. The DPO must report to senior management, be independent, and cannot be penalized for performing DPO duties.

The CCPA/CPRA requires no equivalent role. Businesses must respond to consumer requests within defined timeframes (45 days, with one 45-day extension), maintain records of requests for at least 24 months, and maintain reasonable security practices, but there is no mandated internal privacy governance structure.

Both laws require record-keeping. The GDPR's Article 30 requires detailed Records of Processing Activities (RoPAs). The CCPA/CPRA requires records of consumer requests and how they were handled.

Data Breach Notification

Under the GDPR, organizations must notify their supervisory authority within 72 hours of becoming aware of a personal data breach that poses a risk to individuals' rights and freedoms. If the breach poses a high risk, the organization must also notify affected individuals directly. Our GDPR overview covers the breach notification requirements in detail.

The CCPA/CPRA does not contain its own breach notification rule. California relies on its separate breach notification statute (Cal. Civ. Code 1798.82), which since January 1, 2026 requires notice to affected residents within 30 calendar days of discovery or notification of the breach, subject to delays for the legitimate needs of law enforcement or to determine the scope of the breach and restore the system's integrity. A business that notifies more than 500 California residents of a single breach must also submit a sample copy of the notice to the Attorney General within 15 calendar days of notifying consumers. The CCPA's private right of action under Section 1798.150 is specifically tied to breaches of unencrypted or unredacted personal information.

The Broader US Privacy Landscape

The CCPA/CPRA did not arrive in isolation, and it has not remained unique for long. By common counts, roughly 20 US states had enacted comprehensive consumer privacy laws by early 2026 (see our US data privacy laws hub for the state-by-state picture). Indiana, Kentucky, and Rhode Island laws took effect January 1, 2026.

None of the other state laws match the CCPA/CPRA in rigor, the breadth of consumer rights, or the presence of a dedicated enforcement agency. For businesses operating nationally, a CCPA/CPRA-compliant program provides a solid foundation for multi-state compliance, typically with adjustments for each state's specific definitions, thresholds, and opt-out mechanisms.

There is no federal comprehensive privacy law in the United States as of the date of this review.

How Businesses Subject to Both Should Approach Compliance

Organizations serving both EU/EEA and California markets often build a unified privacy program anchored in GDPR compliance. Because the GDPR is the stricter framework in most areas, GDPR compliance typically satisfies most CCPA/CPRA baseline requirements. The reverse is not true.

Key CCPA/CPRA-specific obligations that remain even for GDPR-compliant organizations:

• "Do Not Sell or Share My Personal Information" link on the homepage and privacy policy (no GDPR equivalent)
• "Limit the Use of My Sensitive Personal Information" link (or a combined link)
• Financial incentive disclosures: businesses offering rewards or price differences tied to data collection must explain the value basis
• ADMT opt-out and access notices (effective January 1, 2027 for significant decisions)
• Risk assessments for certain high-risk processing activities (effective January 1, 2026)
• Annual cybersecurity audits if revenue and data processing thresholds are met
• Service provider contracts using CCPA-specific terminology in addition to GDPR processor agreement language

For the GDPR side of a dual-compliance program, see our EU data privacy laws overview and our guide to what the GDPR requires.

Recent Developments

September 2025: The CPPA finalized ADMT, cybersecurity audit, risk assessment, and CCPA-update regulations. General effective date: January 1, 2026. ADMT compliance for significant decisions deferred to January 1, 2027.

September 2026: Governor Newsom signed SB 923, which from January 1, 2027 extends the right to delete to personal information a business obtained from third parties and requires online-only businesses to offer an online way to submit requests.

May 2026: The Attorney General announced a $12.75 million CCPA settlement with General Motors over the sale of drivers' location and driving data, subject to court approval.

March 2026: CalPrivacy fined PlayOn Sports ($1.10 million) and Ford Motor Company ($375,703).

2025 CPPA enforcement: The agency settled with American Honda ($632,500), Tractor Supply Company ($1.35 million), and Todd Snyder ($345,178), among others.

October 2024: Ireland's DPC fined LinkedIn EUR 310 million for unlawful processing for behavioral advertising. Cumulative GDPR fines surpassed EUR 5.8 billion by early 2025.

January 2025: The CPPA's CPI adjustment took effect: revenue threshold $26,625,000, fines and civil penalties of $2,663 per violation and $7,988 per intentional violation, and breach damages of $107 to $799 per consumer per incident. SB 1223 added neural data to the statutory sensitive PI definition.

January 1, 2026: Indiana, Kentucky, and Rhode Island comprehensive privacy laws took effect.

Frequently Asked Questions

Does the CCPA/CPRA apply to businesses outside California?

Yes. The CCPA/CPRA applies to any for-profit business that collects personal information from California residents and meets at least one of the three thresholds (annual gross revenue over $26,625,000, the $25 million statutory figure as adjusted for inflation; buying, selling, or sharing the personal information of 100,000+ consumers or households a year; or 50%+ of revenue from selling or sharing data) regardless of where the business is located. A company with no physical presence in California but with California customers and a qualifying website can be covered.

Can a business be subject to both GDPR and CCPA/CPRA?

Yes. Any business that processes personal data of EU/EEA individuals and collects personal information from California residents meeting CCPA thresholds must comply with both laws. Many multinational companies build unified privacy programs anchored in GDPR requirements, then layer CCPA/CPRA-specific obligations on top.

Which law has stricter penalties?

The GDPR has far higher maximum penalties: EUR 20 million or 4% of global annual revenue, whichever is higher. CCPA/CPRA penalties cap at $7,988 per intentional violation (the $7,500 statutory figure as adjusted for inflation from January 1, 2025). However, class-action litigation under the CCPA's private right of action can produce substantial aggregate damages, and enforcement has produced seven- and eight-figure settlements, including the Attorney General's $12.75 million General Motors settlement announced in May 2026.

Does GDPR require opt-in consent for all data processing?

No. Consent is one of six lawful bases under GDPR Article 6. Businesses can also rely on contract performance, legal obligation, vital interests, public task, or legitimate interests. However, where consent is the chosen basis it must be freely given, specific, informed, and unambiguous. For special-category data, explicit consent is required unless another Article 9 condition applies.

What is the CPPA's ADMT regulation and when does it take effect?

The CPPA finalized automated decision-making technology (ADMT) regulations on September 22, 2025, with a general effective date of January 1, 2026. Businesses using ADMT to make significant decisions about consumers (decisions on financial or lending services, housing, education, employment or independent contracting, and healthcare services) must comply with consumer opt-out and access rights beginning January 1, 2027. Advertising to a consumer is excluded from the definition of a significant decision, so ADMT used only for ad targeting is outside these ADMT rules.

What is the biggest practical difference between GDPR and CCPA/CPRA compliance?

The consent model. GDPR requires a documented lawful basis before data processing begins, which often means obtaining opt-in consent upfront. The CCPA/CPRA allows data collection by default but requires businesses to honor opt-out requests, post a 'Do Not Sell or Share My Personal Information' link, and (under the 2025 regulations) provide ADMT opt-out and access notices. This fundamental difference shapes website design, cookie banners, privacy notices, and internal data governance.

Does GDPR compliance satisfy CCPA/CPRA requirements?

Mostly, but not entirely. A GDPR-compliant program satisfies most CCPA/CPRA baseline requirements because GDPR is generally the stricter framework. However, several CCPA/CPRA-specific obligations have no GDPR equivalent: the 'Do Not Sell or Share' link, financial incentive disclosures, the ADMT opt-out right, risk assessment and cybersecurity audit requirements under the 2025 regulations, and CCPA-specific service provider contract language.