CCPA vs. GDPR: The Differences That Actually Matter

Companies often treat privacy compliance as a single, universal muscle. The assumption is that if you build enough rigor to satisfy one major framework, you are covered for the rest.

When it comes to the California Consumer Privacy Act (CCPA) and the EU’s General Data Protection Regulation (GDPR), that assumption is a liability.

They share philosophical DNA. Both give individuals rights over their personal data, and both impose strict obligations on the organizations that process it. But the mechanics of how they operate are fundamentally opposed. Complying with one is not complying with the other.

If your company serves both US and EU customers, you need to understand the GDPR vs CCPA differences that dictate how your software must actually function. Let’s walk through the distinctions that matter.

Difference #1: The Conceptual Foundation

This is the root of almost every practical divergence between the two laws.

This conceptual gap, between data as a fundamental human right and data as a consumer asset, produces the operational friction between the two frameworks.

Difference #2: Who’s Covered

GDPR: No size threshold

GDPR applies to organizations established in the EU, and to organizations outside the EU that offer goods or services to, or monitor the behavior of, people in the EEA.

There is no minimum size threshold. A two-person startup offering a product to EEA residents and processing their email addresses is fully subject to GDPR.

CCPA: Three thresholds

The CCPA (as amended by the CPRA, effective January 2023) applies to for-profit businesses that meet at least one of these criteria:

1. Annual gross revenues above $25 million (the primary CCPA revenue threshold, adjusted periodically for inflation).
2. Buying, selling, or sharing the personal information of 100,000 or more consumers or households annually.
3. Deriving 50% or more of annual revenue from selling or sharing consumers’ personal information.

Why this matters

Many smaller SaaS companies fall comfortably below the CCPA thresholds, but are still fully subject to GDPR if they serve European users.

Do not skip the compliance work just because California gives you a pass. Europe will not.

Difference #3: Legal Basis (The Biggest Practical Divide)

GDPR: Justify every processing activity

GDPR requires a documented legal basis for every single processing activity. If you cannot map your data collection to one of the six lawful bases, you cannot process the data.

These GDPR legal basis requirements are not just paperwork. They drive significant product and process design work.

CCPA: No equivalent requirement

The CCPA has no legal basis requirement. You can process California consumers’ personal information for most purposes without their consent, provided you disclose what you are doing and honor opt-out requests for selling and sharing.

What that means in practice

For B2B SaaS companies that do not sell personal information, CCPA compliance is largely an exercise in disclosure and rights fulfillment. Under GDPR, consent management, lawful basis documentation, and Records of Processing Activities are substantial, ongoing operational burdens.

Difference #4: Opt-In vs. Opt-Out Architecture

GDPR: Opt-in by default

Under GDPR, where you rely on consent, it must be obtained before processing as a clear opt-in. For special categories of data, explicit consent is required unless a specific exception applies.

CCPA: Opt-out by default

Consumers have the right to opt out of the sale or sharing of their personal information, but processing is entirely permitted until they do. Sensitive personal information gets more restrictive treatment, allowing consumers to limit its use and disclosure.

The practical trap

This is the classic divide of opt in vs opt out privacy. A marketing technology stack built for CCPA, complete with robust opt-out mechanisms and a “Do Not Sell or Share My Personal Information” link, is not automatically GDPR compliant.

In the EU, marketing analytics and tracking technologies often require prior opt-in consent, and profiling needs a solid lawful basis. The technical implementation of the two frameworks requires entirely different plumbing.

Difference #5: Individual Rights

Both laws grant individuals rights over their data, but the scope and the clock differ.

GDPR rights

• Access
• Rectification
• Erasure
• Data portability
• Restriction of processing
• Objection
• Rights related to automated decision-making

GDPR’s right to erasure is strong and applies across a broad range of circumstances.

CCPA/CPRA rights

• Know (access)
• Delete
• Correct
• Opt out of sale or sharing
• Limit use of sensitive personal information
• Non-discrimination for exercising rights

CCPA’s deletion right carries more exceptions than GDPR’s right to erasure, particularly for data retained for specific business purposes.

Response timelines

Difference #6: Employee Data

GDPR: No employment exception

GDPR applies fully to employee data. Processing it requires a lawful basis, typically contract or legal obligation for core HR processing, with additional requirements for more sensitive processing.

CCPA: Now covered too

The CPRA extended CCPA’s reach to employee data. Employees, job applicants, and independent contractors are now covered consumers. That means:

• Their data must be included in your privacy notice.
• They can exercise CCPA rights, including access and deletion, subject to certain exceptions.

What’s New in California

California’s privacy rules are not static. New CCPA regulations approved in September 2025 added significant obligations for certain businesses, including:

• Privacy risk assessments for processing that presents significant risk to consumers.
• Cybersecurity audits, with certifications due on a phased schedule by revenue tier.
• Automated decision-making technology (ADMT) requirements, including notice, opt-out, and access rights for significant decisions.

Interestingly, these rules narrow the gap with GDPR, which has long required impact assessments and strict protections around automated decisions.

What Dual Compliance Looks Like

Managing both frameworks means building a privacy program that applies the more restrictive requirement wherever they overlap, and adds framework-specific requirements wherever they diverge.

Build these once, to the higher standard

Legal basis documentation: GDPR’s requirement is vastly more demanding than anything in the CCPA. Document legal bases for all processing activities globally, and you satisfy both.

Rights request operations: A single Data Subject Access Request (DSAR) process can handle both GDPR access requests and CCPA “know” requests. There is no need to maintain two separate operational workflows.

Build these separately

CCPA opt-out infrastructure: This is specific to US law, with no direct GDPR equivalent. Build the “Do Not Sell or Share” mechanism separately for California consumers.

Your privacy notice: one or two?

One notice can cover both jurisdictions if it is structured carefully, using jurisdiction-specific sections for California and EEA consumers. However, maintaining two separate notices is also acceptable, and often cleaner in practice.

Same philosophy, different rulebooks. Build for both, and you are ready for either.

Ready to Simplify Compliance?

If you want a cleaner way to run this playbook, explore how Regodit helps you operationalize GRC without slowing your roadmap. Schedule a call or a short demo, and see how the evidence builds itself while your team ships.