GDPR and CCPA Are Not the Same (Here’s Why That Matters)
GDPR requires opt-in consent before collecting data. CCPA allows collection by default with opt-out rights. Here’s where they align and where they fundamentally diverge.
A SaaS company based in Austin built their product for the US market. CCPA compliance was on the roadmap. Then a London-based enterprise customer wanted to sign a six-figure annual contract. But only if the product was GDPR-compliant.
The engineering team assumed GDPR was “basically CCPA but for Europe.” It is not. They spent the next three months rebuilding their consent system from opt-out to opt-in, adding data portability exports, implementing a right-to-erasure pipeline that cascaded across 12 services, and hiring a data protection officer.
Both GDPR and CCPA protect user privacy. But they do it in fundamentally different ways. If your app serves both markets, you need to understand where they align, where they diverge, and how to satisfy both without building two separate systems.
The fundamental difference: opt-in versus opt-out
Under GDPR, you cannot collect or process personal data until the user explicitly opts in. No pre-checked boxes. No implied consent. No “by using this site you agree” banners. The user must give a clear, affirmative signal. That consent must be granular (separate consent for analytics, marketing, third-party sharing).
Under CCPA, you can collect and use personal data by default. The user’s right is to opt out of data sales and sharing, not to prevent collection. You still need to disclose what you collect (notice at collection), but you do not need to ask permission first.
For your app: if you serve both markets, you need geography-aware consent logic. EU users see an opt-in consent banner that blocks data collection until they consent. California users see a “Do Not Sell or Share” option but their data is collected from the first pageview.
This difference cascades through your entire architecture. Opt-in requires a consent state before firing analytics, loading advertising pixels, or sharing data with third parties. Opt-out requires tracking whether users have explicitly requested to not participate in sales or sharing, but proceeds unless they do.
Who is actually covered
GDPR applies to any organization of any size that processes personal data of EU residents. A one-person startup and a Fortune 500 company face the same obligations.
CCPA only applies to for-profit businesses meeting at least one threshold: $25 million or more in annual revenue, 100,000 or more California consumers or households annually, or 50 percent or more of revenue from data sales.
Small businesses serving EU customers still need GDPR compliance. Small businesses with California customers may not trigger CCPA. But growing past the thresholds means sudden CCPA obligations. Plan ahead.
This matters because a startup might be GDPR-compliant and have no CCPA obligation at all, or might trip into CCPA compliance obligations midway through growth without expecting it.
How enforcement actually works
GDPR is enforced by national data protection authorities (DPAs) in each EU member state. Fines can reach 4 percent of global annual revenue. The largest fine to date was 1.2 billion euros against Meta. DPAs collectively receive over 100,000 complaints annually.
CCPA is enforced by the California Attorney General and the California Privacy Protection Agency (CPPA). Per-violation fines are smaller ($2,500 to $7,500). But CCPA’s private right of action allows consumers to sue directly for data breaches involving non-encrypted personal information: $100 to $750 per consumer per incident.
This private right of action in CCPA matters more than it looks. A data breach affecting 100,000 California consumers at $750 per consumer is $75 million in class action exposure. Several multi-million dollar settlements have already been reached. In some scenarios, CCPA’s breach liability exceeds GDPR’s fine structure.
European regulators have imposed over 7.1 billion euros in total GDPR fines since 2018. On the US side, the California AG has settled seven CCPA enforcement actions, including a $2.75 million settlement with Disney. Both regimes are actively enforced.
What data is actually protected
GDPR protects data that identifies a “natural person,” meaning a specific individual.
Get RaftLabs’s stories in your inbox
Join Medium for free to get updates from this writer.
CCPA protects data that identifies a “consumer or household.” Household-level data (information about a shared address, a family’s purchasing patterns, or internet activity from a shared device) is personal information under CCPA even if it does not identify a specific person within the household.
For your app: if you aggregate data at the household level (common in e-commerce, real estate, and advertising), that data has CCPA protections that GDPR does not cover.
The 70 percent overlap and the 30 percent that bites you
Building for both laws is not twice as hard as building for one. The overlap is real. Both laws require access rights, deletion rights, data inventory management, and security controls. But the 30 percent that differs is where teams get stuck.
Different consent models mean different architectural choices. Different verification standards for deletion requests mean different fulfillment workflows. Different definitions of what counts as a “sale” mean you need to track data flows differently.
The practical approach: build for GDPR first, then layer CCPA-specific requirements on top. GDPR is stricter, so meeting GDPR requirements covers approximately 70 percent of CCPA requirements automatically.
Start with consent management (GDPR’s opt-in covers CCPA’s disclosure requirements). Build data subject rights handling (access, deletion, correction, portability). Create data inventory and mapping. Implement security controls. Set up data processing agreements.
Then add CCPA-specific requirements on top: an opt-out mechanism (“Do Not Sell or Share My Personal Information”), Global Privacy Control signal detection, geography-aware consent logic, CCPA-specific disclosures, sensitive data limitation, verified consumer requests, and non-discrimination.
The edge cases
Users who travel: an EU resident visiting California is covered by both laws. A California resident visiting Europe is covered by both laws. Your system needs to handle users whose geographic context changes.
Users with VPNs: you cannot perfectly determine user location. Do not try to be clever. If a user claims GDPR or CCPA rights, honor them regardless of detected location.
Business customers: GDPR applies to all data subjects. CCPA (after recent amendments) now covers employee data and B2B contact data. Your compliance framework needs to cover internal data, not just customer-facing data.
The technical architecture
A consent management system stores per-user consent state with jurisdiction awareness. EU users need opt-in required. California users get opt-out available. Others get applicable law.
A data subject rights portal handles unified request handling for access, deletion, correction, portability. Route to appropriate response workflow based on jurisdiction.
Your data inventory maps all personal data by type, purpose, storage location, and third-party recipients. This serves both GDPR record-keeping requirements and CCPA disclosure requirements.
Your privacy policy needs to be single with jurisdiction-specific sections. California consumers see CCPA disclosures. EU users see GDPR-specific information.
Server-side logic blocks data transmission to third parties based on consent state (GDPR) or opt-out state (CCPA). Audit logging records consent grants, withdrawals, data access, deletion requests, and opt-out events for both regulatory frameworks.
The real cost
Building for two privacy laws is closer to 1.3 times the effort of building for one, not twice the effort, because of that 70 percent overlap. The startup cost for dual compliance includes consent management platform setup ($500 to $5,000 for OneTrust, Cookiebot, or Osano), privacy policy updates ($2,000 to $8,000), consent flow development ($5,000 to $15,000), data deletion pipeline engineering ($8,000 to $20,000), and ongoing compliance monitoring ($1,000 to $3,000 monthly).
Teams that plan for dual compliance from the start spend that investment once. Teams that build for one law and then retrofit the other spend it twice.
Originally published at https://www.raftlabs.com/blog/gdpr-vs-ccpa
