GDPR is a lawful-basis-driven framework where you need a legal justification for every processing activity; CCPA/CPRA is a notice-and-opt-out framework where you process data with proper disclosure and consumers can opt out of sale/sharing. Most tech companies with EU and US users need to comply with both.
Key takeaways
- GDPR requires a lawful basis for processing (consent is one of six options, not the default). CCPA operates on notice-and-opt-out.
- GDPR requires opt-in cookie consent before non-essential cookies fire. CCPA requires a “Do Not Sell or Share” link for businesses that sell or share personal information (including certain targeted advertising).
- GDPR fines: up to €20M or 4% of global turnover. CCPA: up to $7,988 per intentional violation, plus private right of action for data breaches.
- Most companies that comply with GDPR find CCPA relatively easy to add on top.
- Engage Compliance covers both regimes on one account, so a US company entering the EU does not need a second provider.
Quick comparison table
| Criterion | GDPR | CCPA/CPRA |
|---|---|---|
| Applies to | Companies processing EU/EEA individuals’ data | Businesses in California meeting revenue/data thresholds |
| Legal framework | Lawful basis required for each processing purpose | Notice-and-opt-out model |
| Cookie consent | Opt-in required before non-essential cookies | ”Do Not Sell or Share” link for businesses that sell/share PI |
| DPO requirement | Required in specific circumstances | Not required (must designate privacy contact) |
| Maximum penalties | €20M or 4% of global turnover | $7,988 per intentional violation + private right of action |
| Scope of “personal data” | Any data identifying or capable of identifying a person | Data linkable to a consumer or household |
| Right to delete | Yes, with exceptions (one month to comply) | Yes, with exceptions (45 days to comply) |
| Cross-border transfers | Requires transfer mechanisms (SCCs, adequacy, DPF) | No specific transfer restrictions |
When each law applies
GDPR applies if: You offer goods or services to people in the EU/EEA, or you monitor the behavior of people in the EU/EEA. It doesn’t matter where your company is based.
CCPA/CPRA applies if: You do business in California AND meet one of three thresholds: annual gross revenue over $26.6 million (inflation-adjusted), buy/sell/share personal information of 100K+ consumers or households, or derive 50%+ of revenue from selling/sharing personal information.
Key differences explained
Legal basis for processing: GDPR requires a defined lawful basis for each processing purpose (consent, contract, legitimate interest, legal obligation, vital interests, or public task). Consent is required in some contexts but is one of six options, not the default. CCPA operates on a notice-and-opt-out model: you process data with proper notice, and consumers have the right to opt out of sale/sharing and request deletion.
Consent and cookies: Under GDPR and the ePrivacy Directive, non-essential cookies require opt-in consent before they fire. Under CCPA, the primary requirement is a “Do Not Sell or Share My Personal Information” link and opt-out mechanism for businesses that sell or share personal information, which can include certain targeted advertising via cookies. Cookie consent requirements vary by US state.
Scope of “personal data”: GDPR covers any data that identifies or can identify a person. CCPA covers data that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked” to a consumer or household. CCPA explicitly includes household-level data.
Right to delete: Both include it. GDPR allows exceptions (legal obligations, public interest). CCPA also allows exceptions (complete transactions, security, legal compliance).
Penalties: GDPR: up to €20M or 4% of global annual turnover. CCPA: up to $2,663 per violation, up to $7,988 per intentional violation (as adjusted from January 1, 2025), plus private right of action for data breaches.
DPO requirement: GDPR requires a DPO in certain circumstances (see Do I Need a DPO?). CCPA does not require a DPO but companies must designate a contact for privacy inquiries.
Other US state privacy laws
US State Privacy Laws as of 2026
Twenty US states had comprehensive privacy laws in effect as of January 2026. Three new laws took effect on January 1, 2026: Indiana, Kentucky, and Rhode Island. All three largely mirror the Virginia template with rights of access, correction, deletion, portability, and opt-out of sale, targeted advertising, and profiling.
July 1, 2026 brought amendments to Connecticut, Arkansas, and Utah. Since August 1, 2026, registered California data brokers must process consumer deletion requests through DROP, the state’s centralized deletion platform, checking it at least every 45 days. The expanded registration disclosures were separate and were due when brokers registered by January 31, 2026.
Four more states passed comprehensive privacy laws during 2026, which takes the number enacted to twenty-four even though the number in force is still twenty. Louisiana and Oklahoma take effect on January 1, 2027, Alabama on May 1, 2027, and Vermont’s Data Privacy and Online Surveillance Act on January 1, 2028. All four follow the Virginia and Colorado template rather than California’s, all four are enforced by the state attorney general alone, and none of them creates a private right of action. If you are scoping a program now, treat them as dated commitments rather than as future news: the work they add is mostly notice content and honoring the same consumer rights in four more states, not a second compliance model.
California remains the most active enforcement state. The CCPA regulations on automated decision-making technology, cybersecurity audits and risk assessments took effect in January 2026, with compliance phased in from January 2027 (automated decision-making technology) to April 2028 and later (risk assessment submissions and audits). The California Delete Act delete platform launched, and the California Attorney General announced the largest CCPA settlement to date, $12.75 million against General Motors, in May 2026.
Universal Opt-Out mechanism recognition is now required in California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, New Jersey, New Hampshire, Oregon, and Texas.
The frameworks are broadly similar to CCPA with some variations. Key differences include opt-in vs opt-out defaults, private right of action availability, and specific sector carve-outs. We cover all of them. See our Privacy Compliance Glossary for individual law definitions.
How to comply with both
Most tech companies that comply with GDPR find CCPA relatively easy to add on top. The main additional requirements for CCPA:
- “Do Not Sell or Share My Personal Information” link on your website (required for covered businesses that sell or share personal information)
- Opt-out mechanism for sale/sharing of personal data
- Updated privacy notice with CCPA-specific disclosures
- Process for handling CCPA-specific consumer requests
- Financial incentive disclosures if you offer loyalty programs
We handle both from a single retainer. Most companies that comply with GDPR can add CCPA compliance in 1-2 weeks of additional work.
Companies in both regimes often need an EU representative as well, covered for US companies and for Canadian companies.
Sources and references
- Regulation (EU) 2016/679 (GDPR), official text, EUR-Lex
- California Consumer Privacy Act (CCPA), California Attorney General
- CCPA regulations, California Attorney General
- California Privacy Protection Agency: law and regulations, California Privacy Protection Agency
- Code of Virginia, Chapter 53: Consumer Data Protection Act, Virginia Law (Virginia Code Commission)
- Colorado Senate Bill 21-190 (Colorado Privacy Act), signed text, Colorado General Assembly
- Texas Data Privacy and Security Act, Texas Attorney General
- EDPB Guidelines 05/2020 on consent under Regulation 2016/679, European Data Protection Board
- EDPB Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive, European Data Protection Board
| Criterion | Engage Compliance | Competitor |
|---|---|---|
| Applies to | Companies processing EU/EEA individuals' data | Businesses in California meeting revenue/data thresholds |
| Legal framework | Lawful basis required for each processing purpose | Notice-and-opt-out model |
| Cookie consent | Opt-in required before non-essential cookies | "Do Not Sell or Share" link for businesses that sell/share PI |
| DPO requirement | Required in specific circumstances | Not required (must designate privacy contact) |
| Maximum penalties | €20M or 4% of global turnover | $7,988 per intentional violation + private right of action |
| Scope of "personal data" | Any data identifying or capable of identifying a person | Data linkable to a consumer or household |
| Right to delete | Yes, with exceptions (one month to comply) | Yes, with exceptions (45 days to comply) |
| Cross-border transfers | Requires transfer mechanisms (SCCs, adequacy, DPF) | No specific transfer restrictions |
Applies to
Engage Compliance
Companies processing EU/EEA individuals' data
Competitor
Businesses in California meeting revenue/data thresholds
Legal framework
Engage Compliance
Lawful basis required for each processing purpose
Competitor
Notice-and-opt-out model
Cookie consent
Engage Compliance
Opt-in required before non-essential cookies
Competitor
"Do Not Sell or Share" link for businesses that sell/share PI
DPO requirement
Engage Compliance
Required in specific circumstances
Competitor
Not required (must designate privacy contact)
Maximum penalties
Engage Compliance
€20M or 4% of global turnover
Competitor
$7,988 per intentional violation + private right of action
Scope of "personal data"
Engage Compliance
Any data identifying or capable of identifying a person
Competitor
Data linkable to a consumer or household
Right to delete
Engage Compliance
Yes, with exceptions (one month to comply)
Competitor
Yes, with exceptions (45 days to comply)
Cross-border transfers
Engage Compliance
Requires transfer mechanisms (SCCs, adequacy, DPF)
Competitor
No specific transfer restrictions