GDPR and the California Consumer Privacy Act both give you control over your personal data, but they are built on different ideas. GDPR is a European Union regulation that requires a legal reason before anyone handles your data, and it protects people physically in the EU. The CCPA, as amended by the CPRA, is a California statute that lets companies collect data but gives California residents rights to see, delete, correct and stop the sale of it. That GDPR vs CCPA gap is the one that matters most in practice.

This post covers the EU regulation and California’s law, with a short note on the other US states. The facts below were checked on October 10, 2026, against the regulation text and California agency pages.

The short comparison

Question GDPR (EU) CCPA/CPRA (California)
Basic model Processing is banned unless a legal basis applies (consent, contract, legitimate interest and others) Collection is allowed; consumers can opt out of sale or sharing and limit sensitive data use
Who is protected People in the EU, per the territorial rules in Article 3 California residents
Who must comply Any organization of any size handling personal data, except household use For-profit businesses that cross a revenue or data-volume threshold
Top administrative fines Up to EUR 20 million or 4% of worldwide turnover Up to $2,663 per violation, $7,988 if intentional or involving under-16s
Lawsuits by individuals Broad right to compensation (Article 82) Narrow: only certain data breaches

Who is covered, on each side

GDPR follows the person, not the passport. Article 3 applies the regulation to organizations established in the EU, and also to outside companies that offer goods or services to people in the EU or monitor their behavior there. Article 3 says the offer can be paid or free. A US blog with a European audience and tracking scripts can therefore fall inside it. One exemption is worth knowing: Article 2(2)(c) excludes a person handling data for purely personal or household reasons.

The CCPA works the other way around. It regulates for-profit businesses that do business in California and meet at least one threshold, per the California Attorney General’s CCPA page. The thresholds are annual gross revenue above a set figure, handling the data of 100,000 or more California consumers or households, or earning half or more of revenue from selling personal information. The revenue figure on the Attorney General’s page is $25 million, but the California Privacy Protection Agency adjusted it for inflation to $26,625,000 effective January 1, 2025. Small local businesses mostly fall outside it. Nonprofits and government bodies generally do too.

What rights you actually get

The overlap is real. Under GDPR, Chapter 3 gives you access (Article 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), and protection against purely automated decisions (22), according to the chapter index. California lists similar tools: the right to know what is collected, delete, correct, opt out of sale or sharing, and limit use of sensitive data, plus freedom from retaliation for using them.

Differences show up in the details.

  • Opt-in versus opt-out. GDPR needs a lawful basis up front. Article 6 lists six: consent, contract, legal obligation, vital interests, public interest, and legitimate interests. Consent is only one of them, which is why not every GDPR cookie or data request hinges on a checkbox. California mostly lets the business proceed until you say stop.
  • Global signals. The California Attorney General says opting out can be done through a global privacy control, the browser-level signal, so you do not have to click through every site.
  • Automated decisions. Article 22 gives GDPR a distinct right concerning decisions made by automated means, including profiling. I did not review California’s rules on automated decision-making for this post, so compare them directly if that is your concern.
  • Sensitive data. Both treat health, biometrics and similar categories more strictly, though they define the categories differently.

How to use these rights in practice

Start by finding the company’s privacy notice and the contact point for requests, which is often a web form or a dedicated email address. Say which right you are using, name the law, and keep a copy of what you sent.

Under GDPR, the clock is set by Article 12: the controller must act without undue delay and within one month. It can extend that by two further months where necessary, but only if it tells you within the first month and gives reasons. A refusal must also come within the month, with the reasons and a note that you can complain to a supervisory authority or go to court.

In California, the Attorney General explains that you can file a complaint with it or, for violations on or after July 1, 2023, with the California Privacy Protection Agency. Neither office represents you personally. A complaint is a tip to a regulator, not a lawsuit.

A few habits help in both systems. Send requests in writing, so there is a record. Ask for one thing at a time when a company is slow to answer. Check whether an exception applies before assuming the company is stalling, since deletion rights in both laws carry exceptions, such as records a business must keep by law.

Penalties and who enforces them

GDPR has two tiers. Article 83 caps lower-tier violations at EUR 10 million or 2% of worldwide annual turnover, whichever is higher. Violations of core principles, consent conditions, individual rights and international transfer rules go up to EUR 20 million or 4%. National supervisory authorities in each member state do the enforcing, and you can complain to the one where you live.

In California, the Attorney General and the California Privacy Protection Agency enforce. After the 2025 inflation adjustment, the posted ceilings are $2,663 per violation and $7,988 for intentional violations or those involving consumers under 16. Those numbers look small beside GDPR, but they are counted per violation, so a pattern affecting many users multiplies quickly.

Can you sue?

This is where the two diverge most. GDPR Article 82 says anyone who suffers material or non-material damage from an infringement can seek compensation from the controller or processor. The text does not define either kind of damage, which leaves it to courts, and the details have been argued across member states.

The CCPA has no general right to sue. The private right of action is limited to data breaches in which unencrypted, unredacted personal information was stolen because the business failed to maintain reasonable security. The Attorney General’s page describes actual damages or statutory damages, with a written notice and a 30-day cure period first. The statutory range is $107 to $799 per consumer per incident after the 2025 adjustment, according to the CPPA. For the federal side of breach suits, see our companion guide on whether you can sue over a data breach.

What about the rest of the United States?

There is still no single federal consumer privacy statute. States have filled the gap. A privacy-law tracker I opened, which was updated in August 2026, counted 20 comprehensive state laws in force and one more, Oklahoma’s, set for January 1, 2027. I could not confirm that count against an official list, so treat it as approximate. The same tracker showed Indiana, Kentucky and Rhode Island laws taking effect on January 1, 2026.

Most of these laws resemble California’s opt-out model more than GDPR, but they differ on thresholds, sensitive-data rules and whether you can sue (generally you cannot). If you live outside California, check your own state attorney general’s website to see whether a law applies to you.

Is GDPR about to change?

The European Commission put forward a “Digital Omnibus” package on November 19, 2025, meant to simplify several digital laws, per the Commission’s library page. It is a proposal. I could not confirm that any GDPR amendment has been adopted, so the rules described here are the current text. Anyone relying on the details for business purposes should check the status again.

Related questions

Does GDPR protect me if I am a US citizen?

Only when the processing falls under Article 3, for example when you are in the EU and a company offers you services or monitors your behavior there. Citizenship is not the test; location and targeting are.

Does the CCPA protect people who are only visiting California?

It protects California residents, so a short-term visitor generally does not count. Residency is the test, not where the business sits.

Which law is stricter?

GDPR is stricter on the basics: it requires a lawful reason before data is used and carries larger fines. California is stronger than many states in giving residents enforceable opt-out tools and a global-signal mechanism.

Do I have to pay to use these rights?

California says its right-to-know requests are free twice a year. Under GDPR Article 12, responses are free of charge unless a request is manifestly unfounded or excessive, in which case the controller may charge a reasonable fee or refuse.

This is general information, not legal advice.

Sources