GDPR vs. California Privacy Law: Scope, Rights, and Penalties

The GDPR and California’s privacy law both protect personal data, but they take opposite approaches: the GDPR requires businesses to get permission before collecting personal data, while the California Consumer Privacy Act lets businesses collect data freely and gives consumers the right to opt out afterward. The GDPR also applies to any business of any size that handles EU residents’ data, while California’s law only kicks in once a business crosses certain revenue or data-volume thresholds. A single California company can easily owe compliance under both at once, and the obligations don’t line up neatly.

Opt-In vs. Opt-Out: The Core Difference

Everything else about these two frameworks flows from one structural choice. The GDPR requires a lawful basis before any personal data can be processed. Article 6 lists six acceptable grounds, including the data subject’s explicit consent, contractual necessity, and legitimate interest of the controller.¹ If none applies, the processing is unlawful from the start. In practice, many businesses must get affirmative opt-in consent before collecting data from anyone in the EU.

California takes the opposite approach. Under the CCPA, as amended by the CPRA, businesses can collect and use personal information without asking first, but consumers have the right to opt out of the sale or sharing of their data after the fact. Businesses must post a conspicuous link offering this opt-out, and they cannot penalize consumers who exercise it.² GDPR defaults to “no” until the individual says “yes.” California defaults to “yes” until the consumer says “no.”

Who Each Law Applies To

GDPR Reach

A California company doesn’t escape the GDPR by having no European offices. Article 3 pulls in non-EU businesses through two criteria. The “targeting” criterion covers anyone offering goods or services to people located in the EU, regardless of whether payment changes hands. Accepting euros, offering EU-language translations, or shipping to EU addresses all signal targeting. The “monitoring” criterion covers businesses that track the online behavior of individuals in the EU through cookies, analytics, or ad profiling.³

The GDPR also follows the person, not the passport. A California resident traveling in France or studying in Germany is a protected data subject while physically there.⁴ And there is no revenue or data-volume floor. A five-person California startup with European customers faces the same GDPR obligations as a Fortune 500 company.

CCPA/CPRA Thresholds

California’s law covers for-profit businesses that collect personal information from California residents and meet at least one of three thresholds. The figures are adjusted for inflation; those effective January 2025 run through 2026:⁵

Annual gross revenue exceeding $26,625,000 in the prior calendar year, measured against the entire business entity globally, not just California-sourced revenue.
Buying, selling, or sharing the personal information of 100,000 or more California consumers or households annually.
Deriving 50 percent or more of annual revenue from selling or sharing California consumers’ personal information.

Nonprofits generally fall outside the CCPA because the statute’s definition of “business” requires operating for the profit of shareholders or owners.⁶ A nonprofit that shares branding and consumer data with a for-profit parent or subsidiary that meets the thresholds can be pulled in. The GDPR applies to nonprofits and public bodies the same as any other organization.

The CCPA/CPRA also reaches personal information collected from employees working in California, including remote workers. California-based workforce data gets the same rights as consumer data.

What Counts as Personal Information

Both laws define their core term broadly. Under California Civil Code 1798.140, “personal information” covers anything that identifies, relates to, or could reasonably be linked to a specific consumer or household.⁶ That includes names and addresses, but also IP addresses, browsing history, geolocation, biometrics, employment information, and inferences a company draws to build a profile.

The GDPR uses “personal data” and defines it as any information relating to an identified or identifiable natural person. The two definitions overlap heavily. California’s inclusion of household-level data stands out: information tied to a household rather than a named individual still counts. The GDPR has no household concept.

Sensitive Categories

Both frameworks treat certain data as higher risk, but they regulate it differently. GDPR Article 9 labels these “special categories” and prohibits processing them unless a specific exception applies, such as explicit consent or a legal obligation. The protected categories include racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, health information, and data about sex life or sexual orientation.⁷

California uses the label “sensitive personal information” and gives consumers the right to direct a business to limit its use to what is necessary for the goods or services they requested, rather than banning processing outright.⁸ California’s list overlaps with the EU’s but also includes Social Security numbers, financial account credentials, precise geolocation, and the contents of mail, email, and text messages.² Same opt-in versus opt-out split, applied to sensitive data.

Individual Rights and Response Deadlines

Both laws grant individuals a set of rights over their personal data, with similar substance but different mechanics.

Access

California consumers can request that a business disclose the specific pieces of personal information it has collected about them, including sources, purpose, and any third parties the data was shared with. This can be done up to twice per year at no cost.² GDPR data subjects have a parallel right to confirmation of whether their data is being processed and, if so, a copy along with processing purposes, categories, and recipients.⁹

Deletion

Both laws allow erasure requests, but the GDPR version is broader. Article 17 requires deletion when data is no longer necessary for its original purpose, when consent is withdrawn, when the individual objects, or when the data was collected unlawfully. It also includes a “right to be forgotten” element: if a business made the data public, it must take reasonable steps to notify other controllers to delete copies and links.¹⁰ California’s deletion right covers data collected from the consumer and requires the business to direct service providers and contractors to delete it, but it has no public-notification obligation.

Opt-Out, Correction, and Objection

California consumers can opt out of the sale or sharing of their personal information, and businesses must honor this through a clear website mechanism. The CPRA added a right to correct inaccurate data. The GDPR includes a right to rectification and a broader right to object to processing based on legitimate interests or direct marketing. Neither law lets a business retaliate against someone who exercises these rights through price discrimination or reduced service.

Response Clocks

California businesses have 45 calendar days to respond, extendable by another 45 if they notify the consumer and explain why. The GDPR gives controllers one month, extendable by two additional months for complex or high-volume requests.

Breach Notification

This is where the timelines diverge most sharply. Under the GDPR, a data controller must notify its supervisory authority within 72 hours of becoming aware of a breach that poses a risk to individuals’ rights. Late notifications require an explanation. When the breach is likely to result in a high risk to individuals, the controller must also notify affected data subjects directly without undue delay.¹¹

California recently tightened its rules. SB 446, signed into law in October 2025, requires businesses to notify affected California residents within 30 calendar days of discovering a breach. If the breach affects more than 500 California residents, the business must also submit a sample copy of the notification to the California Attorney General within 15 calendar days of notifying consumers.¹² Notification may be delayed if law enforcement determines it would interfere with a criminal investigation.

California also gives individual consumers a private right of action when a breach results from a business’s failure to maintain reasonable security practices. Statutory damages range from $100 to $750 per consumer per incident, or actual damages, whichever is greater. Before filing suit for statutory damages, the consumer must give the business 30 days’ written notice and an opportunity to cure.¹³ The GDPR does not include a comparable per-incident statutory damages provision, though affected individuals can seek compensation through national courts.

Penalties and Enforcement

The penalty structures reflect the scale differences between the two laws. GDPR fines operate on two tiers. Violations of processing principles, consent requirements, or data subject rights can draw fines of up to €20 million or 4 percent of global annual turnover, whichever is higher. Violations of controller, processor, or certification body obligations cap at €10 million or 2 percent of global turnover.¹⁴

California’s administrative penalties are smaller per violation but can accumulate across large consumer populations. The California Privacy Protection Agency can impose fines of up to $2,663 per unintentional violation and up to $7,988 per intentional violation or for violations involving the data of minors under 16.¹⁵ These amounts were adjusted for inflation in 2025 and run through 2026.⁵ For a business mishandling data belonging to millions of consumers, per-violation fines can produce exposure in the hundreds of millions.

The GDPR is enforced by national supervisory authorities across EU member states, with coordination through the European Data Protection Board for cross-border cases. In California, the Privacy Protection Agency has been actively targeting specific industries, including a round of enforcement actions announced against data brokers in early 2026.¹⁶

Cross-Border Data Transfers

Moving personal data from the EU to the United States triggers GDPR restrictions that California law doesn’t impose in reverse. The GDPR treats the U.S. as a country that doesn’t provide an adequate level of data protection on its own, so businesses need a recognized legal mechanism to receive EU personal data.

The primary mechanism for most California businesses is the EU-U.S. Data Privacy Framework, which took effect on July 10, 2023. U.S.-based organizations can self-certify through the Department of Commerce’s International Trade Administration, and once certified they can receive personal data from the EU without additional safeguards. Self-certification is voluntary, but compliance becomes legally binding and enforceable under U.S. law once an organization joins.¹⁷

Businesses that don’t participate in the Framework can still transfer EU data using Standard Contractual Clauses approved by the European Commission. These pre-approved contract templates bind the data importer to GDPR-equivalent protections.¹⁸

The CCPA doesn’t restrict outbound transfers of California consumer data to other countries. There is no adequacy determination or contractual mechanism required. A California business sharing consumer data with an overseas third party remains responsible for ensuring the recipient handles it in compliance with the CCPA.

Internal Compliance Infrastructure

Both frameworks impose internal obligations beyond responding to individual requests.

Risk Assessments

The GDPR requires Data Protection Impact Assessments for processing likely to result in high risk to individuals, particularly when using new technologies or processing special-category data at scale. California’s parallel requirement, which took effect in January 2026, mandates risk assessments for processing activities that present “significant risk” to consumer privacy. Triggers include selling or sharing personal information, processing sensitive personal information, and using automated decision-making technology for consequential decisions. GDPR assessments stay internal; California requires businesses to submit theirs to the Privacy Protection Agency on a scheduled basis.

Data Protection Officer

The GDPR requires a Data Protection Officer in three situations: when processing is carried out by a public authority, when core activities involve large-scale systematic monitoring of individuals, or when core activities involve large-scale processing of special-category data.¹⁹ The CCPA has no equivalent requirement. California businesses can structure their privacy teams however they choose, though larger organizations typically designate someone to run privacy operations as a practical matter.

Which Law Governs Your Business

A California business dealing exclusively with California or U.S. customers answers to the CCPA/CPRA. The GDPR becomes relevant the moment you have customers, users, or website visitors in the EU whose behavior you track or to whom you offer products or services. Many California tech companies, SaaS providers, and e-commerce businesses sit under both regimes at once.

For dual-compliance situations, the GDPR is almost always the stricter standard. A company that builds its data practices around opt-in consent, appoints a DPO, conducts impact assessments, and maintains a lawful basis for every processing activity will meet most CCPA requirements with modest additions: honoring the “Do Not Sell or Share” opt-out mechanism, responding to California-specific access requests within 45 days, and meeting California’s breach notification clock. Going the other direction is harder. A business built around the CCPA’s opt-out model has to fundamentally restructure its consent practices to comply with the GDPR.

1
General Data Protection Regulation (GDPR). Art. 6 GDPR Lawfulness of Processing
2
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
3
General Data Protection Regulation (GDPR). Art. 3 GDPR Territorial Scope
4
European Data Protection Board. Guidelines 3/2018 on the Territorial Scope of the GDPR
5
California Privacy Protection Agency. Updated Monetary Thresholds in CCPA
6
California Legislative Information. California Code 1798.140 – Definitions
7
General Data Protection Regulation (GDPR). Art. 9 GDPR Processing of Special Categories of Personal Data
8
California Privacy Protection Agency. California Consumer Privacy Act of 2018 – Section 1798.121
9
General Data Protection Regulation (GDPR). Art. 15 GDPR Right of Access by the Data Subject
10
General Data Protection Regulation (GDPR). Art. 17 GDPR Right to Erasure
11
European Data Protection Board. Guidelines 9/2022 on Personal Data Breach Notification Under GDPR
12
California Legislative Information. Senate Bill 446
13
California Legislative Information. California Civil Code 1798.150
14
General Data Protection Regulation (GDPR). Art. 83 GDPR General Conditions for Imposing Administrative Fines
15
California Legislative Information. California Civil Code 1798.155
16
California Privacy Protection Agency. News and Announcements
17
U.S. Department of Commerce. EU-U.S. Data Privacy Framework Program Overview
18
European Commission. Standard Contractual Clauses (SCC)
19
General Data Protection Regulation (GDPR). Art. 37 GDPR Designation of the Data Protection Officer