GDPR vs CCPA: Understanding Your Privacy Rights in 2026

Data privacy laws have reshaped how businesses collect, store, and share personal information. Two of the most influential regulations in the world are the General Data Protection Regulation (GDPR) in the European Union and the California Consumer Privacy Act (CCPA) in the United States. While both aim to give individuals more control over their personal data, they take notably different approaches to achieve that goal.

This guide breaks down the key differences between GDPR and CCPA, explains the rights you have under each law, and helps you understand which protections apply to you as a consumer or business.

What Is GDPR?

The General Data Protection Regulation (GDPR) is a comprehensive data privacy law that took effect in the European Union on May 25, 2018. It applies to any organization that processes the personal data of individuals residing in the EU, regardless of where that organization is located.

GDPR is widely considered the global gold standard for privacy legislation. It introduced sweeping rights for individuals, strict obligations for data controllers and processors, and penalties that can reach up to €20 million or 4% of a company's global annual revenue, whichever is higher.

Core Principles of GDPR

GDPR is built on seven foundational principles that govern how personal data must be handled:

Lawfulness, fairness, and transparency — Data must be processed legally and openly.
Purpose limitation — Data should only be collected for specific, legitimate purposes.
Data minimization — Only collect what is necessary.
Accuracy — Keep personal data accurate and up to date.
Storage limitation — Don't keep data longer than needed.
Integrity and confidentiality — Secure data against unauthorized access.
Accountability — Organizations must demonstrate compliance.

What Is CCPA?

The California Consumer Privacy Act (CCPA) is a state-level privacy law that took effect on January 1, 2020. It applies to for-profit businesses that collect personal information from California residents and meet certain thresholds related to revenue, data volume, or revenue from selling data.

The CCPA was later strengthened by the California Privacy Rights Act (CPRA), which took full effect in January 2023. The CPRA added new rights, created the California Privacy Protection Agency (CPPA), and introduced the concept of "sensitive personal information."

Who Must Comply With CCPA?

A business must comply with CCPA if it does business in California and meets at least one of these criteria:

Annual gross revenue exceeding $25 million
Buys, sells, or shares the personal information of 100,000 or more California consumers or households annually
Derives 50% or more of its annual revenue from selling or sharing California consumers' personal information

GDPR vs CCPA: Side-by-Side Comparison

The clearest way to understand the differences between these two laws is to compare them directly across the dimensions that matter most to consumers and businesses.

Feature	GDPR	CCPA (as amended by CPRA)
Jurisdiction	European Union (and EEA)	State of California, USA
Who is protected	All data subjects in the EU	California residents only
Who must comply	Any organization processing EU data	Businesses meeting revenue/data thresholds
Legal basis for processing	Requires one of six lawful bases (consent, contract, etc.)	No explicit legal basis required; opt-out model
Consent model	Opt-in (explicit consent required)	Opt-out (consumers can refuse sale/sharing)
Right to delete	Yes (Right to Erasure)	Yes, with exceptions
Right to access	Yes	Yes
Right to portability	Yes	Yes
Maximum penalty	€20 million or 4% of global revenue	$7,500 per intentional violation
Private right of action	Limited	Yes, for certain data breaches
Data Protection Officer required	Yes, in many cases	Not required

Scope and Territorial Reach

One of the biggest differences between GDPR and CCPA is their scope. GDPR applies to any organization anywhere in the world that processes personal data of EU residents. If a small e-commerce shop in Brazil sells to French customers, GDPR applies.

CCPA, by contrast, applies only to for-profit businesses that meet specific thresholds and do business in California. Nonprofits, government entities, and small businesses that don't meet the thresholds are generally exempt. This makes GDPR's reach much broader globally.

Definition of Personal Data

Both laws define personal information broadly, but there are notable differences in scope and categorization.

Under GDPR

Personal data means any information relating to an identified or identifiable natural person. This includes names, identification numbers, location data, online identifiers, and factors specific to physical, physiological, genetic, mental, economic, cultural, or social identity.

GDPR also recognizes "special categories" of data that require extra protection, including racial or ethnic origin, political opinions, religious beliefs, genetic data, biometric data, and health information.

Under CCPA

CCPA defines personal information as data that identifies, relates to, or could reasonably be linked with a particular consumer or household. It includes identifiers, commercial information, biometric data, internet activity, geolocation, and inferences drawn from other personal information.

The CPRA added "sensitive personal information" as a new category, which includes Social Security numbers, precise geolocation, racial or ethnic origin, religious beliefs, and the contents of personal communications.

Consumer Rights Compared

Both laws grant consumers significant control over their personal data, but the specifics differ.

Rights Under GDPR

Right to be informed about data collection and use
Right of access to personal data
Right to rectification of inaccurate data
Right to erasure ("right to be forgotten")
Right to restrict processing
Right to data portability
Right to object to processing
Rights related to automated decision-making and profiling

Rights Under CCPA/CPRA

Right to know what personal information is collected
Right to delete personal information
Right to opt out of the sale or sharing of personal information
Right to correct inaccurate information (added by CPRA)
Right to limit use of sensitive personal information (added by CPRA)
Right to non-discrimination for exercising rights
Right to data portability

Consent: Opt-In vs Opt-Out

This is arguably the most philosophically significant difference. GDPR follows an opt-in model, meaning businesses must obtain clear, affirmative consent before processing personal data in most cases. Pre-checked boxes, implied consent, and silence don't count.

CCPA follows an opt-out model. Businesses can collect and even sell personal information by default, as long as they provide consumers with a clear way to opt out — typically through a "Do Not Sell or Share My Personal Information" link. For sensitive personal information, CPRA requires an additional "Limit the Use of My Sensitive Personal Information" option.

Enforcement and Penalties

The financial stakes under each law differ dramatically.

GDPR Penalties

GDPR has two tiers of fines. Lower-tier violations (such as record-keeping failures) can result in fines of up to €10 million or 2% of global annual revenue, whichever is higher. Higher-tier violations (such as violating core principles or consumer rights) can reach €20 million or 4% of global annual revenue.

Major fines have been levied against companies including Meta (€1.2 billion in 2023), Amazon (€746 million), and WhatsApp (€225 million).

CCPA Penalties

CCPA fines are more modest: up to $2,500 per unintentional violation and $7,500 per intentional violation or violation involving minors. However, these fines can add up quickly if millions of records are affected.

CCPA also includes a private right of action, allowing consumers to sue businesses directly for certain data breaches, with statutory damages between $100 and $750 per consumer per incident.

How This Affects Everyday Users

Whether you live in Europe, California, or elsewhere, these laws have changed how the internet works. You've likely noticed cookie banners, privacy policy updates, and "Do Not Sell" links appearing across websites in the last few years. These are direct results of GDPR and CCPA compliance.

Beyond compliance notices, these laws give you tangible power. You can request copies of your data, ask companies to delete your information, and opt out of certain types of tracking. Exercising these rights is often as simple as filling out a form on a company's privacy page.

Protecting Your Privacy Beyond Legal Rights

Privacy laws provide a legal baseline, but good personal practices add another layer of protection. Simple steps include using encrypted DNS services, private browsers, strong unique passwords, and privacy-conscious tools for everyday tasks. For instance, when sharing links, services like Lunyb offer URL shortening with analytics that respect user privacy — a thoughtful choice compared to shorteners that aggressively track clicks. You can read our honest Lunyb review or compare it against alternatives in our 2026 URL shortener buyer's guide.

Compliance Essentials for Businesses

If your business handles personal data from EU or California residents, here are the baseline compliance steps you should take:

Map your data flows — Know what personal data you collect, where it's stored, who has access, and why.
Update your privacy policy — Clearly disclose data practices, consumer rights, and contact information.
Implement consent mechanisms — Use proper opt-in flows for GDPR and opt-out links for CCPA.
Establish request handling procedures — Create workflows for responding to data access, deletion, and portability requests within required timeframes (one month for GDPR, 45 days for CCPA).
Secure your data — Use encryption, access controls, and regular security audits.
Train your staff — Ensure employees understand privacy obligations.
Appoint a Data Protection Officer if required under GDPR.
Document everything — Maintain records of processing activities and compliance efforts.

Which Law Offers Stronger Protection?

GDPR is generally considered more comprehensive and consumer-friendly. Its opt-in consent model, broader scope, stricter penalties, and extensive list of rights give individuals more control. GDPR also treats privacy as a fundamental human right, which shapes how courts and regulators interpret ambiguous situations.

CCPA, while weaker in some areas, is still a landmark law for the United States and has inspired similar legislation in other states like Virginia, Colorado, Connecticut, Utah, and Texas. The trend across the US is moving toward GDPR-like protections, though a federal privacy law has yet to materialize.

The Future of Privacy Regulation

Privacy regulation is expanding rapidly. More than a dozen US states have passed their own comprehensive privacy laws, and countries including Brazil (LGPD), China (PIPL), India (DPDPA), and Canada (updated PIPEDA) have introduced or updated major privacy frameworks.

For businesses, this means privacy compliance is no longer optional or geographically limited. For consumers, it means growing awareness and expanding rights worldwide. The direction is clear: individuals are gaining more control over their personal data, and businesses that embrace privacy-by-design will have a competitive advantage.

Frequently Asked Questions

Does GDPR apply to US companies?

Yes, GDPR applies to any company — regardless of location — that offers goods or services to EU residents or monitors their behavior. A US-based website with EU customers must comply with GDPR, even if it has no physical presence in Europe.

Can I request my data from any company under CCPA?

Only if you're a California resident and the company meets CCPA's business thresholds. However, many companies extend CCPA rights to all US consumers for simplicity, so it's worth asking even if you live elsewhere.

What happens if a company ignores my data request?

Under GDPR, you can file a complaint with your national data protection authority, which can investigate and impose fines. Under CCPA, you can report violations to the California Attorney General or the California Privacy Protection Agency. For certain data breaches, you may also have the right to sue directly.

How long do companies have to respond to privacy requests?

GDPR requires responses within one month, with possible extensions of two additional months for complex requests. CCPA requires businesses to respond within 45 days, with a possible 45-day extension if needed.

Do GDPR and CCPA apply to employee data?

GDPR fully covers employee data. Under CCPA, employee data was initially exempt but became fully covered as of January 1, 2023, following the CPRA amendments. Employees now have the same rights as consumers regarding their workplace personal information.