Privacy
GDPR vs CCPA: What Founders Actually Need to Know About the Difference
They're not the same law with different names. Here's where they actually diverge — and what that means for a single policy covering both.
2026-09-11 · 6 min read · Adam Jabbar
Founders often treat GDPR and CCPA/CPRA as roughly interchangeable — "privacy compliance" as one undifferentiated task. They're built on different premises, and the differences matter for what your privacy policy and internal processes actually need to do.
The core philosophical difference
GDPR (EU) and UK GDPR are opt-in by default: you generally need a valid legal basis — often consent — before you process personal data at all. CCPA, and its expanded successor CPRA (California), is closer to opt-out: businesses can generally collect and use data, but consumers get specific rights to know, delete, correct, and opt out of sale or sharing.
This single difference cascades into most of the practical distinctions below.
Where they diverge in practice
| Area | GDPR / UK GDPR | CCPA / CPRA |
|---|---|---|
| Default posture | Opt-in — need a legal basis to process | Opt-out — can process, but must honor opt-out rights |
| Who it protects | Any individual in the EU/UK, regardless of citizenship | California residents specifically |
| Cookie consent | Prior consent required for non-essential cookies | No prior consent requirement, but must honor a "Do Not Sell/Share" opt-out |
| Who it applies to | Any company processing EU/UK residents' data, no revenue threshold | Revenue and data-volume thresholds apply — many small companies fall outside CCPA/CPRA's scope entirely |
| Core individual rights | Access, rectification, erasure, portability, objection, restriction | Know, delete, correct, opt out of sale/sharing, limit use of sensitive data |
| Enforcement | Data protection authorities, fines up to 4% of global turnover | California Privacy Protection Agency and state AG, statutory penalties per violation |
Does CCPA/CPRA even apply to you?
Unlike GDPR, CCPA/CPRA has thresholds — roughly, it applies to for-profit businesses doing business in California that either exceed a set annual gross revenue, or buy/sell/share personal data of a set number of California consumers or households annually, or derive a set share of revenue from selling personal data. Read the current thresholds carefully before assuming either way — many early-stage startups fall under them, but growth can change that quickly.
What one policy covering both actually needs
Most companies run a single privacy policy with jurisdiction-specific sections rather than maintaining separate documents:
- A general section describing what you collect and why, applicable everywhere
- A GDPR/UK GDPR section covering legal basis, international transfer mechanism, and EU/UK-specific rights
- A California/US state section covering the "right to know," "right to delete," sale/sharing disclosures, and how to submit a request
- A clear, working mechanism for both — a "Do Not Sell or Share My Personal Information" link if CCPA/CPRA applies, and a functioning consent mechanism for cookies if GDPR applies
Frequently asked questions
Do I need to comply with both if I only have a few customers in each region?
Location of your customers, not your company, generally triggers applicability under GDPR. CCPA/CPRA additionally has revenue/volume thresholds, so a handful of California customers alone likely won't trigger it — but check the current thresholds rather than assuming.
Is consent required for cookies under CCPA?
No — CCPA/CPRA takes an opt-out approach for the sale/sharing of data rather than requiring prior consent, which is a meaningfully different mechanism from GDPR's cookie consent requirement.
Which one is stricter?
Neither is uniformly stricter — GDPR is broader in scope (any EU/UK resident, no threshold) and stricter on its opt-in default; CCPA/CPRA is narrower in scope but has grown sharper enforcement and more specific consumer rights over recent updates.
This article is general information about how these documents and obligations usually work. It is not legal advice on your specific situation, and reading it does not create a lawyer-client relationship. Laws referenced here change — verify current requirements before relying on this for a live decision.