CCPA vs. GDPR: Key Differences Every Business Needs to Know

Most companies with an online presence now answer to more than one privacy law, and the two that get compared most often are California's CCPA and Europe's GDPR. They overlap in spirit and diverge sharply in mechanics. Drop a GDPR-style consent banner in front of a California visitor and you have not solved your problem. Assume the CCPA is "GDPR lite" and your vendor contracts and breach plan will have holes.

Here is where the two laws actually part ways, and what that means for the notices, contracts and workflows you maintain.

Two laws, two philosophies

The GDPR starts from a premise: personal data belongs to the person it describes, and a business needs a lawful reason to touch it. Consent is only one of six available bases, alongside contract, legal obligation, legitimate interests and a couple of narrower options. That "justify it first" model drives everything downstream — records of processing, data protection impact assessments, the designated data protection officer.

The CCPA was built as a disclosure-and-opt-out regime. Businesses may generally process personal information without asking permission, but they must disclose what they collect and why, and let consumers refuse the sale or sharing of it. The CPRA amendments pushed California closer to the European model by adding a correction right, data minimisation language and a category called sensitive personal information — without importing the lawful-basis framework.

Scope: who actually has to comply

GDPR reaches extraterritorially with no revenue floor. If you are established in the EU or EEA, or you offer goods and services to people there or monitor their behaviour, you are covered. A five-person software company in Ohio selling to customers in Germany is a controller under GDPR, and there is no small-business exemption.

The CCPA sets thresholds. It generally applies to for-profit businesses that do business in California and meet at least one of these tests:

• Annual gross revenue above $25 million, adjusted periodically for inflation
• Buying, selling or sharing the personal information of 100,000 or more California consumers or households per year
• Earning 50% or more of annual revenue from selling or sharing personal information

Two details trip people up. The CCPA protects California residents only, and since the CPRA took effect it covers employees and business contacts as well as customers. The GDPR protects people in the EU regardless of citizenship — relevant if one of your engineers works remotely from Portugal.

Rights: similar names, different machinery

Both laws hand individuals rights over their data, but the timing and limits differ.

• Access. GDPR requires a response without undue delay and within one month, extendable by two for complex requests. The CCPA gives 45 days, with one 45-day extension allowed.
• Deletion. Both provide it, but neither is absolute. GDPR erasure is balanced against other lawful grounds; CCPA deletion carries exceptions such as completing a transaction, detecting fraud or meeting a legal obligation.
• Opt out of sale or sharing. Unique to California, usually satisfied with a "Do Not Sell or Share My Personal Information" link plus honouring opt-out preference signals such as Global Privacy Control.
• Sensitive data. California lets consumers limit the use of sensitive personal information. GDPR treats comparable categories — health, biometrics, ethnicity, religion, sexual orientation — as special-category data that generally needs explicit consent or another narrow condition.
• Non-discrimination. The CCPA expressly bars retaliation against consumers who exercise their rights. GDPR has no exact twin; it falls under the general fairness principle.

The GDPR also grants rights the CCPA does not: restriction of processing, objection, and protections around automated decision-making and profiling.

Consent, contracts and the paperwork

Under GDPR you document a lawful basis before processing begins. Consent must be freely given, specific, informed and unambiguous, and as easy to withdraw as to give. Expect records of processing activities, a data protection officer if your processing is large-scale or sensitive, DPIAs for high-risk work, written processor agreements, and breach notification to the supervisory authority within 72 hours where feasible.

California has no equivalent 72-hour rule aimed at a privacy regulator, but the state's separate breach notification law still requires telling affected residents promptly. What you do need: a notice at or before collection, a layered privacy policy, service provider contracts with specific required terms, and a workable way to verify requests. No DPO. No mandatory impact assessment, though the CPPA's risk-assessment regulations are pushing certain processing in that direction.

Penalties and who comes knocking

GDPR fines arrive in tiers: up to €10 million or 2% of global annual turnover for administrative failures, and up to €20 million or 4% of worldwide annual turnover — whichever is higher — for breaches of core principles or data subject rights. National supervisory authorities issue them, and cross-border cases usually route through a lead authority.

CCPA penalties are calculated per violation, with higher amounts for intentional violations and for the data of consumers under 16. Enforcement comes from the California Attorney General and the California Privacy Protection Agency. The CPRA removed the automatic 30-day cure period, so a warning letter followed by a month of quiet fixing is no longer something to count on. California also created a limited private right of action for certain data breaches, letting consumers seek statutory damages per incident — a risk GDPR-covered businesses do not always anticipate.

A practical starting point

1. Map your data. List what you collect, why, where it lives, how long you keep it and which vendors touch it. Every other step depends on this.
2. Decide which laws apply based on where your customers and staff are, not where your servers sit.
3. Fix the front door. Two notices, not one: a full privacy policy and a short notice at collection. If you use a cookie banner, make rejecting as easy as accepting.
4. Honour signals. Support Global Privacy Control and keep an opt-out path that does not require an account.
5. Tighten contracts. Update processor and service provider terms so vendor obligations match what each law requires.
6. Build a request workflow. One intake form, defined verification steps, deadlines logged in a tracker someone owns.
7. Rehearse a breach. Know who calls whom, who drafts the notice, and how you reach regulators and customers within hours.

Compliance here is a maintenance habit rather than a one-off project. Laws change, your data flows change, and a policy that was accurate last year can quietly drift out of date. This overview is general guidance, not legal advice — for your specific obligations, work with a qualified privacy lawyer or data protection professional.

Photo: jessica45 / Pixabay