Home › Compare laws side by side › CCPA/CPRA vs EU GDPR

CCPA/CPRA vs EU GDPR

California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA) (California, United States) compared with Regulation (EU) 2016/679 (General Data Protection Regulation) (European Union (EEA)) on the same topics. Every value comes from the law pages, which link to the official sources.

Topic	CCPA/CPRA California, United States 10/14 facts confirmed by two sources	EU GDPR European Union (EEA) ✓ Confirmed by two sources
Status	In force (CCPA since 1 Jan 2020; CPRA amendments operative 1 Jan 2023). New CPPA regulations on ADMT, risk assessments and cybersecurity audits effective 1 Jan 2026 with phased deadlines.✓	In force since 25 May 2018. Digital Omnibus amendments proposed Nov 2025, not adopted as of Oct 2026.✓
Who it applies to	For-profit businesses doing business in California that collect California residents' personal information and meet a threshold, wherever the business is located. Nonprofits and government agencies are generally not covered.✓	Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.✓
Size thresholds	Any one of: annual gross revenue over $26,625,000 (CPI-adjusted from $25M on 1 Jan 2025; adjusted every odd-numbered year); buys, sells or shares personal info of 100,000+ California consumers or households; or 50%+ of annual revenue from selling or sharing personal info.✓	None — applies regardless of size. Limited record-keeping relief for organisations under 250 staff (Art 30(5)), lost if processing is risky, not occasional, or includes special-category or criminal data.✓
Regulator	California Privacy Protection Agency (CPPA, branded 'CalPrivacy') and the California Attorney General✓	National data protection authorities (DPAs), coordinated by the European Data Protection Board (EDPB)✓
Breach or incident reporting	Civil Code 1798.82 applies to any business doing business in California that holds computerised personal information, whether or not it meets the CCPA thresholds. As amended by SB 446 (from 1 Jan 2026): notify affected residents within 30 calendar days of discovering or being told of a breach (delay allowed for law-enforcement needs or to determine scope); if more than 500 residents must be notified, send the Attorney General a sample notice within 15 calendar days of notifying consumers.✓	Notify the competent supervisory authority without undue delay and within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to individuals (Art 33). If you have an EU main establishment, that is your lead authority; if you have no EU establishment (even with an EU representative), notify the authority of every member state where affected people live (EDPB Guidelines 9/2022, para 73). Tell affected individuals without undue delay if the risk is high (Art 34).✓
Deadline to answer personal data requests	Requests to know, delete or correct: 45 calendar days, extendable once by 45 days (90 total) with notice. Opt-out of sale/sharing: as soon as feasible and no later than 15 business days.✓	1 month from receipt; extendable by 2 further months for complex requests if the person is told within the first month. Free of charge unless manifestly unfounded or excessive.✓
Data protection officer	No statutory DPO requirement. The 2026 regulations require cybersecurity audit results to be reported to executive management and risk assessments to be attested by a responsible executive.	DPO mandatory for public bodies, and where core activities involve large-scale regular and systematic monitoring, or large-scale processing of special-category or criminal-offence data.✓
Local representative	No local or in-state representative requirement.	Non-EU controllers/processors caught by Art 3(2) must appoint an EU representative in writing, unless processing is occasional, low-risk and excludes large-scale sensitive data, or they are a public body.✓
Sending data abroad	No restrictions on transfers outside California or the US; disclosures to service providers, contractors and third parties must be covered by contracts containing CCPA-required terms.	Transfers outside the EEA need an adequacy decision (e.g. UK, Switzerland, EU-US Data Privacy Framework), or safeguards such as Standard Contractual Clauses or Binding Corporate Rules, or a narrow Art 49 derogation.✓
Cookies and consent	Opt-out model: businesses that sell or share personal info (including for cross-context behavioral ads via cookies) must offer a 'Do Not Sell or Share' option and honor Global Privacy Control as a valid opt-out request. Opt-in consent is required to sell/share data of consumers under 16.✓	Cookie/tracker consent is governed by the ePrivacy Directive Art 5(3); where consent is the GDPR legal basis it must be freely given, specific, informed, unambiguous and as easy to withdraw as to give.✓
Maximum penalty	Administrative fines/civil penalties up to $2,663 per violation, or $7,988 per intentional violation or violation involving consumers under 16 (from 1 Jan 2025). Data-breach private actions: $107-$799 per consumer per incident or actual damages.✓	Up to EUR 20 million or 4% of total worldwide annual turnover, whichever is higher (lower tier: EUR 10 million or 2%).✓

= confirmed by two independent sources, at least one official.

Facts marked “Being verified” are still being confirmed and are not given as answers.

Who each law applies to

CCPA/CPRA: For-profit businesses doing business in California that collect California residents' personal information and meet a threshold, wherever the business is located. Nonprofits and government agencies are generally not covered.
EU GDPR: Any organisation processing personal data in the context of an EU establishment, plus non-EU organisations that offer goods/services to people in the EU or monitor their behaviour there.

What you must do under CCPA/CPRA

Post a privacy policy and give a notice at collection listing categories, purposes and retention periods.
Answer requests to know, delete and correct within 45 days; process opt-outs within 15 business days.
Provide a 'Do Not Sell or Share' link and honor Global Privacy Control signals.
Run and document risk assessments for significant-risk processing; pre-2026 processing must be assessed by 31 Dec 2027.
If using ADMT for significant decisions, give pre-use notice, opt-out and access rights by 1 Jan 2027.
If in scope, certify an independent cybersecurity audit to the CPPA (first due 1 Apr 2028-2030 by revenue tier).

Full CCPA/CPRA page, sources and checklist

What you must do under EU GDPR

Identify a lawful basis for every processing purpose and record it.
Publish a clear privacy notice covering purposes, recipients, retention and rights.
Keep a record of processing activities and sign Art 28 contracts with processors.
Run a DPIA before high-risk processing such as large-scale profiling or sensitive data.
Report qualifying breaches within 72 hours (lead authority, or every relevant DPA if you have no EU establishment) and log all breaches.
Answer access, erasure and other rights requests within one month.

Full EU GDPR page, sources and checklist

Partner

Termly

Create and maintain a privacy policy, cookie banner and request forms.

Create your privacy policy with Termly

Partner link: we may earn a commission if you buy, at no extra cost to you. It never affects our legal content. Affiliate disclosure

Information only, not legal advice. Laws change; confirm with the regulator or a qualified lawyer before relying on this page. Spotted an error? Email contact@glancedeskjurisdiction.com.