The GDPR is an EU regulation that requires a legal basis before you process personal data. The CCPA is a California law that gives residents rights to know, delete, correct and opt out of the sale or sharing of their data. You may be subject to both, and a shared set of data practices handles most of the overlap.
Who does each law apply to?
The EDPB says GDPR applies if you are based in an EEA country, or if you are based elsewhere and offer goods or services (even free ones) to people in the EEA, among other cases. Size is not the test.
California's Attorney General says the CCPA applies to for-profit businesses that do business in California and meet any one of three tests: gross annual revenue over 25 million dollars; buying, selling or sharing the personal information of 100,000 or more California residents or households; or earning 50 percent or more of annual revenue from selling California residents' personal information. Thresholds can be adjusted, so check the current figures.
How do the core ideas compare?
GDPR starts from a rule: you need a lawful basis, such as consent or legitimate interests, and must follow the Article 5 principles of purpose limitation, data minimisation and storage limitation. CCPA starts from transparency and control: tell people what you collect, honor their requests, and let them stop sale or sharing.
Rights overlap heavily. Both give access and deletion. CCPA, as amended, adds correction and the right to limit use of sensitive personal information. GDPR adds objection and restriction of processing, portability and rules on automated decisions.
How do enforcement and penalties differ?
Under GDPR Article 83, the most serious infringements can bring fines up to 20 million euros or 4 percent of worldwide annual turnover, whichever is higher. In California, the Attorney General or the California Privacy Protection Agency enforces most violations; private lawsuits are limited to certain data breaches, per the AG's FAQ.
A constructed example
A US software company with a free tier gets signups from Berlin and Sacramento. For Berlin users it needs a lawful basis for analytics, so it asks for consent before loading trackers. For Sacramento users it must disclose the tracking in its privacy notice and honor an opt out of sharing, including a browser signal such as the Global Privacy Control, which the AG page mentions. One cookie banner that does both reduces mistakes, but the logic behind each region differs.
Where do they overlap in engineering terms?
Both need a data inventory, a way to find and delete a person's data across systems, vendor contracts, security measures and breach handling. Build these once.
How to apply this
- Map where personal data lives, including logs and AI tools.
- Decide which laws apply by user location and your thresholds.
- Write one notice that covers each law's required items.
- Build a request workflow that handles know, delete and correct for everyone.
- Add region logic for consent (GDPR) and opt out of sale or sharing (CCPA).
- Check vendor agreements.
- Confirm anything high stakes with counsel.
Safeguard's compliance automation can help organize evidence and tasks around privacy controls, but it does not provide legal advice or make you compliant.
Quick check
If I comply with GDPR, am I done with CCPA?
Not automatically. Opt out of sale or sharing, specific notices and the sensitive data limit need their own handling.
Does CCPA require consent before collecting data?
Generally it works through notice and opt out rather than prior consent, with exceptions. Check the rules for sensitive data and minors.
Sources
- EDPB SME guide, data protection basics
- GDPR Article 5
- GDPR Article 83
- California Attorney General, CCPA
Last reviewed: 18 October 2026.
