GDPR vs CCPA: Key Differences Every Website Owner Should Know

If you run a website that serves users in both the EU and California, you need to comply with both GDPR and CCPA. While they share similarities, there are important differences.

Scope and Applicability

Aspect	GDPR	CCPA
Region	European Union / EEA	California, USA
Effective	May 25, 2018	January 1, 2020
Applies to	Any organization processing EU residents’ data	For-profit businesses meeting revenue/volume thresholds
Territorial scope	Where the data subject is located	Where the business operates

User Rights Comparison

GDPR Rights:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure (“right to be forgotten”)
• Right to restrict processing
• Right to data portability
• Right to object

CCPA Rights:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale of personal information
• Right to non-discrimination for exercising rights

Penalties

• GDPR: Up to €20 million or 4% of annual global turnover (whichever is higher)
• CCPA: Up to $7,500 per intentional violation (civil penalties)

Key Takeaway

Both regulations require clear disclosure of data practices. A well-written privacy policy that covers both GDPR and CCPA requirements is the foundation of compliance.

Generate a GDPR + CCPA compliant privacy policy →