Introduction
GDPR and CCPA are the two laws that shaped global privacy but they answer the same question in opposite ways. GDPR says “ask first.” CCPA says “track by default, but stop when asked.” If your website has visitors from both Europe and the United States (and nearly every site does), your consent banner needs to speak both languages. Here’s exactly how they differ, and what that means for your site in 2026.
The Fundamental Split: Opt-In vs Opt-Out
Everything else flows from this one philosophical difference:
- GDPR (opt-in): You may not process a European visitor’s personal data with non-essential cookies or trackers until they have given free, specific, informed, unambiguous consent through an affirmative action. Silence, pre-ticked boxes, and continued browsing do not count the Court of Justice confirmed this in the landmark Planet49 ruling, and the burden of proving consent sits with you.
- CCPA (opt-out): You may collect and process a Californian’s personal information by default, but they have the right to tell you to stop selling or sharing it — and once they do (via a link click or a browser-level GPC signal), you must comply immediately.
In practice
For a visitor from Berlin, your analytics and ad scripts must stay silent until they click Accept. For a visitor from Los Angeles, those scripts may run but a working “Do Not Sell or Share My Personal Information” path and automatic GPC recognition are mandatory.
Side-by-Side Comparison (2026)
| Aspect | GDPR (EU/EEA + UK GDPR) | CCPA/CPRA (California) |
| Who it protects | Any natural person in the EU/EEA, regardless of citizenship | California residents (consumers and households) |
| Who must comply | Any organization, anywhere, that offers goods/services to or monitors people in the EU no size threshold | For-profit businesses meeting one of three thresholds: revenue over $26,625,000 (2026 inflation-adjusted figure); 100,000+ CA consumers/households; or 50%+ revenue from selling/sharing data |
| Consent model | Prior opt-in for all non-essential cookies (via the ePrivacy Directive working alongside GDPR) | Opt-out of sale/sharing; opt-in only for minors under 16 and for some sensitive-data uses |
| Cookie banner | Required in practice: first-layer Accept and Reject with equal prominence, granular categories, easy withdrawal | A banner alone is not required — but the “Do Not Sell or Share” link, an opt-out page, and GPC recognition are |
| Browser signals | No binding signal yet (GPC conveys an objection but isn’t codified) | GPC must be treated as a legally valid opt-out request |
| Legal bases | Six lawful bases; consent is required for tracking regulators almost never accept “legitimate interest” for behavioral advertising | No legal-basis concept; obligations attach to selling, sharing, and sensitive-data use |
| Max penalties | €20M or 4% of global annual turnover, whichever is higher | $2,663 per violation, $7,988 per intentional violation or those involving minors counted per consumer, so totals scale fast |
| Regulator | National DPAs (CNIL, ICO, Garante, AEPD…) + the EDPB | California Privacy Protection Agency + Attorney General |
| Key consumer rights | Access, rectification, erasure, restriction, portability, objection | Know, delete, correct, opt out of sale/sharing, limit sensitive-data use, non-discrimination |
What “Selling” Means Under CCPA (It’s Broader Than You Think)
Most website owners insist “we don’t sell data” but under the CCPA as amended by the CPRA, sharing personal information for cross-context behavioral advertising counts even when no money changes hands. If your site runs the Meta Pixel, Google Ads remarketing, or virtually any third-party ad tag, you are almost certainly “sharing” under California’s definition, which triggers:
- The “Do Not Sell or Share My Personal Information” footer link (or the shorter “Your Privacy Choices” link with the standard icon),
- At least two methods for submitting opt-out requests,
- Automatic honoring of Global Privacy Control signals, and
- Since 1 January 2026 — a visible confirmation that the opt-out was processed (a toggle, badge, or “Opt-Out Request Honored” message).
What GDPR Demands That CCPA Doesn’t
- Prior blocking. Analytics and marketing scripts must not fire on page load. France’s CNIL fined Shein €150 million in September 2025 largely because advertising cookies were set before any user interaction.
- Symmetric design. Making “Accept” a bright button while “Reject” hides behind a settings link is a dark pattern that regulators now fine directly.
- Records of consent. You must be able to prove who consented, when, to what, and via which banner version.
- Withdrawal that works. If a user withdraws consent, trackers must actually stop cases against Shein and American Express both cited cookies still being read after withdrawal.
Don’t Forget: California Is Just One of 20 States
Virginia, Colorado, Connecticut, Texas, Oregon, and fifteen other states now run comparable opt-out laws, with Indiana, Kentucky, and Rhode Island effective January 2026 and Arkansas arriving July 2026. Most copy Virginia’s template rather than California’s, but around a dozen states now mandate GPC recognition. The practical takeaway: build your US logic around the strictest common denominator California and you cover most of the rest with minor adjustments.
Rule of thumb for banner behavior: EU/UK visitor → block everything, show opt-in banner, wait. US visitor → load with an opt-out notice, show the “Do Not Sell or Share” link, listen for GPC, and stop sharing the moment either fires. Everyone else → apply the local law (LGPD and POPIA are opt-in; PIPEDA is consent-based; most of Asia-Pacific is tightening fast).
Can One Banner Serve Both? Yes — If It’s Geo-Aware
You don’t need two websites. You need a consent platform that detects the visitor’s region and switches models automatically:
- Detect location (IP-based, at the edge, before any tag decision).
- Apply the correct default: all trackers denied for opt-in regions; permitted-with-rights for opt-out regions.
- Render the right UI: Accept/Reject/Preferences for the EU; a notice plus “Do Not Sell or Share” for the US.
- Propagate the state everywhere: to Google via Consent Mode v2, to the ad ecosystem via TCF 2.3 (EU) and GPP strings (US), and to your own tag manager.
- Log everything for both regimes GDPR proof-of-consent and CCPA opt-out records.
Frequently Asked Questions
If you merely have incidental EU traffic and don’t target Europeans (no EU shipping, EUR pricing, or EU-directed marketing), GDPR’s reach is debatable. But if you serve or monitor EU users deliberately, it applies regardless of your size or location GDPR has no revenue or headcount threshold.
Yes. Location is irrelevant any for-profit business “doing business in California” that meets one of the three thresholds is covered, whether it sits in Texas, Toronto, or Tokyo.
GDPR is stricter on consent and legal basis; California is increasingly strict on verification regulators inspect network traffic to confirm opt-outs actually suppress data flows, and fines since 2025 exceed $9 million. Treat both as enforcement-grade.
One policy can serve both if it contains the region-specific disclosures each law requires: GDPR’s lawful bases, retention, and data-subject rights; CCPA’s categories collected/sold/shared, the opt-out link, and consumer rights. A policy generator that layers jurisdictions saves significant effort.
