GDPR vs CCPA: What Businesses Need To Know In 2026

A company with an office in Dublin and customers in California asks which rules apply. In gdpr vs ccpa, it faces both: GDPR requires a lawful basis for processing, while CCPA allows processing by default and gives Californians opt-outs.

This comparison sits inside our wider guide to data privacy laws explained. It corrects the most common misreadings of the two laws and ends with a rule for deciding which one governs a given data practice.

Why the laws are not mirror images

The most common mistake is treating the CCPA as an American copy of the GDPR. The two start from opposite positions. Under the GDPR, processing personal data is illegal unless it can be justified under one of six lawful bases. Under the CCPA, the general rule is that processing is allowed, and the law gives consumers ways to object, such as opting out of a sale.

That starting point shapes everything downstream. A GDPR programme begins with justification and records. A CCPA programme begins with disclosure and honouring objections. The table sets the two side by side on the points that most affect operations.

Topic	GDPR	CCPA	Planning use
Who is in scope	Entities established in the EU, for all their processing activities	Controllers that do business in California, regardless of where the controller is located, but only for California residents’ data	Map GDPR exposure by where you are established; map CCPA exposure by where your customers live
Default rule	Processing is illegal unless one of six lawful bases applies	Processing is allowed by default; consumers can opt out of sale	Keep a lawful-basis register for GDPR and a working opt-out path for CCPA
Consent standard	Where consent is used, it must be freely given, specific, informed and unambiguous, with easy withdrawal	Opt-out model for sale or sharing	Do not reuse one banner design for both without checking the legal model behind it
Breach notice	To the regulator where feasible within 72 hours	Without unreasonable delay	Build the incident plan around the shorter, fixed GDPR clock
Maximum penalty	Serious infringements up to €20 million or 4% of global annual turnover, whichever is higher	Civil penalties up to $2,500 per violation, or $7,500 for intentional violations	Treat these as ceilings for risk ranking, not as expected outcomes
Enforcers	National data protection authorities, which can audit, restrict processing and impose fines	California Attorney General and California Privacy Protection Agency	Identify which regulator would receive a complaint for each dataset

Scope and default-rule rows are drawn from the IAPP’s GDPR matchup with the California Consumer Privacy Act, and consent, breach, penalty and enforcer rows from Accountable HQ’s comparison of GDPR and CCPA.

Scope: who must comply with each law

Compliance duties attach to different things in each law. The GDPR attaches to the organisation and to the people whose data is processed. The CCPA attaches to a business and to California residents. Three misunderstandings come up repeatedly.

• “Only giant companies fall under the CCPA.” One test is an annual gross revenue threshold of $25 million, but a business that derives at least 50% of annual revenue from selling consumers’ personal information is also covered. A small data-selling firm should therefore not assume it is exempt on size alone. Most CCPA obligations apply to “businesses”, which the IAPP describes as for-profit controllers.
• “The GDPR only covers EU residents’ data.” An entity established in the EU is subject to the GDPR for all of its processing activities, not only the part tied to EU customers. Separately, the GDPR protects all data subjects living in the EU, as long as the data can identify them. A controller is the entity that determines the purpose and means of processing, and that role is what the regulation’s duties follow.
• “The CPRA is a different law.” The California Privacy Rights Act amended the CCPA on 1 January 2023. The GDPR, by comparison, came into force in May 2018. Read the CCPA together with its CPRA amendments, and do not treat a pre-2023 CCPA summary as current.

CCPA coverage also depends on what counts as personal information. The definition includes IP addresses, cookies, beacons and pixel tags, so a marketing team’s tracking stack is within scope even if no one thinks of it as customer data. The thresholds and effective dates above are summarised by Global Relay’s CCPA and GDPR comparison.

Consent: opt-in versus opt-out

Does the CCPA require opt-in consent? Not as a general rule. The CCPA operates on an opt-out model for the sale or sharing of personal information. The CPRA added opt-in consent requirements for minors and for Sensitive Personal Information, so a business that handles those categories cannot rely on opt-out alone.

The GDPR is the reverse for consent-based processing. It requires consumers to opt in to data collection, with consent obtained before the data is given. The GDPR’s consent has to be freely given, specific, informed and unambiguous, with easy withdrawal. A pre-ticked box or a buried notice does not meet that standard.

A second misunderstanding is that every GDPR activity needs consent. Consent is only one of the six lawful bases, so a business can sometimes justify processing another way. If you do rely on consent, keep records of it, because the quality standard is the part regulators examine. Consent questions also arise outside privacy statutes, for instance when teams ask is it legal to record a phone call, and that answer sits under different rules from the ones compared here.

Fines and enforcement

The maximum fines are built on different logic. GDPR serious infringements can reach €20 million or 4% of global annual turnover, whichever is higher. That ties the ceiling to the size of the company. CCPA civil penalties can reach $2,500 per violation, or $7,500 for intentional violations. A ceiling is not a typical outcome, but a per-violation structure matters when one flawed practice affects many consumers.

Who enforces also differs. The GDPR’s regulators include the European Data Protection Board alongside individual country systems, and a national data protection authority can audit, restrict processing and impose fines. In California, enforcement is led by the California Attorney General and the California Privacy Protection Agency. For a multinational, that means a single practice can draw questions from more than one regulator, each with its own procedures.

Breach handling is the clearest operational split. The GDPR sets a regulator notice target of within 72 hours where feasible, while the CCPA standard is without unreasonable delay. A plan built to the GDPR timetable will normally satisfy the looser CCPA wording.

Working checklist for US and EU operations

A single programme can serve both laws if it is built around the data rather than around each statute. These actions apply whichever law ends up governing.

1. Map the data first. List what you collect, where it is stored and which team uses it, then tag each dataset by the residency of the people in it.
2. Assign roles. Decide, for each activity, whether you determine the purposes and means of processing, since that controller role is where GDPR duties concentrate.
3. Inventory tracking technology. Include cookies, beacons and pixel tags, because the CCPA treats them as personal information.
4. Record a lawful basis per activity. Keep the register current so that any GDPR-governed activity can be justified on request.
5. Wire consent and opt-out flows to the map. Opt-in routes belong where consent is the basis or sensitive data and minors are involved, and an opt-out route belongs wherever data is sold or shared.
6. Rehearse a breach. Run the incident plan against the stricter regulator clock so that regional teams do not improvise.

Because the checklist is data-led, one inventory answers both laws’ scope questions, and the next section turns that inventory into a ruling for each practice.

Decision rule: which law governs a data practice

Apply these tests to each data practice rather than to the company as a whole, since one business can be inside both laws for different datasets.

1. Check establishment. If the entity is established in the EU, the GDPR governs all of its processing activities.
2. Check the people. If the data subjects live in the EU and the data can identify them, GDPR protections attach to that data.
3. Check California reach. If you do business in California and meet a CCPA threshold, the CCPA governs California residents’ data, wherever your company is located.
4. Apply the stricter control where both laws apply. Use a lawful basis and, where relied on, high-quality consent for the GDPR, and add the opt-out for sale or sharing for the CCPA. Add opt-in for minors and Sensitive Personal Information.

This is a screening aid, and edge cases such as unusual thresholds or mixed datasets deserve legal review. Automated tools that profile or infer from personal data raise further questions, which we cover in AI And Privacy Concerns: What You Need To Know In 2026 – Technopolicy.

Frequently asked questions

Question	Answer
Did the CPRA replace the CCPA?	No. The CPRA amended the CCPA on 1 January 2023, so CCPA obligations are read together with the CPRA changes, including the added opt-in requirements for minors and Sensitive Personal Information.
Can one business be subject to both laws?	Yes. An EU-established entity is subject to the GDPR for all its processing, and the CCPA reaches controllers that do business in California regardless of where they are located. The CCPA covers only California residents’ data.
Do cookies and IP addresses count under the CCPA?	Yes. The CCPA’s concept of personal information includes IP addresses, cookies, beacons and pixel tags.
Which regulators sit behind each law?	For the GDPR, the European Data Protection Board and national data protection authorities. For the CCPA, the California Attorney General and the California Privacy Protection Agency.