Updated October 2026 · US guide

GDPR Versus CCPA: The 2026 Side-by-Side Comparison for US Businesses

Selling to Californians and Europeans from the same website? This guide compares the EU General Data Protection Regulation and the California Consumer Privacy Act (as amended by the CPRA) point by point — scope, thresholds, consent, cookies, rights, deadlines, fines and the 2026–2027 rule changes — then gives you one checklist that satisfies both.

Opt-in vs opt-outGDPR needs a lawful basis first; CCPA lets you collect but must honor opt-outs
€20M / 4%Top GDPR fine tier (whichever is higher)
$2,663 / $7,988CCPA fine per violation / per intentional violation (2025–26 figures)
$26.625MCCPA revenue threshold; GDPR has no revenue threshold
Get a free GDPR + CCPA marketing check
Jump to the comparison table

GDPR Versus CCPA: The Short Answer

GDPR versus CCPA in one line: the GDPR is an EU regulation that covers almost any organization handling EU residents’ personal data and requires a lawful basis (often opt-in consent) before processing. The CCPA is a California law that covers larger for-profit businesses, lets them collect data by default and requires them to honor opt-outs of selling or sharing.

Key takeaways

• Scope: GDPR applies to any size of organization targeting or monitoring people in the EU/EEA. CCPA applies only to for-profit businesses doing business in California that cross one of three thresholds.
• Permission model: GDPR is permission-first (six lawful bases; consent for non-essential cookies under the ePrivacy rules). CCPA is notice-and-opt-out (tell people at collection, then stop selling/sharing when they say so, including via Global Privacy Control).
• Rights overlap about 70%: both give access, deletion, correction and portability rights. GDPR adds objection and restriction; CCPA adds opt-out of sale/sharing and “limit use of sensitive personal information.”
• Fines: GDPR fines run to €20 million or 4% of worldwide turnover. CCPA fines are per violation ($2,663 or $7,988), which multiplies fast across thousands of visitors.
• Complying with GDPR does not make you CCPA compliant (and vice versa). You need a “Do Not Sell or Share” link, GPC detection and CCPA-specific contract terms even if you already run a GDPR cookie banner.

Who this guide is for

US founders, marketers and agencies running ads, analytics, email and e-commerce for audiences in California and Europe — plus UK, Canadian and Australian businesses that sell into both markets. It is written by a digital marketing team that sets up consent banners, Google Consent Mode, GPC handling and data processing agreements for clients every week. It is not legal advice; see the note at the end.

In this guide

1. GDPR vs CCPA comparison table
2. What is the GDPR?
3. What is the CCPA (and CPRA)?
4. Which law applies to you? (free check)
5. 7 similarities
6. 14 key differences explained
7. GDPR vs CCPA for digital marketing
8. What changed in 2026–2027
9. Fines and real enforcement cases
10. One checklist for both laws
11. GDPR vs CCPA vs UK, Canada, Australia, India
12. Working with an offshore agency
13. Packages and pricing
14. Myths, mistakes and glossary
15. FAQs

GDPR vs CCPA Comparison Table (2026)

Use this as your one-screen cheat sheet. Each row is explained in detail further down the page.

Topic	GDPR (EU)	CCPA / CPRA (California)
Full name / type	General Data Protection Regulation, Regulation (EU) 2016/679 — directly applicable in all EU/EEA states	California Consumer Privacy Act, Cal. Civ. Code §1798.100 et seq., as amended by the CPRA (Prop. 24)
In force	Adopted 27 April 2016; applies from 25 May 2018	Effective 1 Jan 2020; CPRA amendments effective 1 Jan 2023
Who it protects	Any individual (“data subject”) in the EU/EEA, regardless of citizenship	California residents (“consumers”), including employees and B2B contacts since 2023
Who must comply	Any controller or processor established in the EU, or outside the EU if it offers goods/services to, or monitors, people in the EU. No size threshold. Non-profits and public bodies included.	For-profit businesses doing business in California that (a) earn >$26,625,000 annual gross revenue, or (b) buy, sell or share personal info of 100,000+ CA consumers/households, or (c) get 50%+ of revenue from selling/sharing personal info
Personal data definition	Any information relating to an identified or identifiable natural person	Information that identifies, relates to or could reasonably be linked with a consumer or household; includes inferences
Sensitive data	“Special categories” (Art. 9) — processing prohibited unless an exception applies	“Sensitive personal information” — consumers may limit its use; notice required
Legal basis to process	Required: one of six lawful bases (consent, contract, legal obligation, vital interests, public task, legitimate interests)	Not required; collection allowed with notice at collection and purpose limitation
Cookies & tracking	Prior opt-in consent for non-essential cookies (ePrivacy Directive / national laws)	No prior consent; must offer opt-out of selling/sharing and honor Global Privacy Control
Core individual rights	Access, rectification, erasure, restriction, portability, objection, rights on automated decisions, withdraw consent	Know/access, delete, correct, portability, opt out of sale/sharing, limit use of SPI, non-retaliation; ADMT rights from 2027
Response deadline	1 month (+2 months for complex requests)	45 calendar days (+45); opt-outs within 15 business days
Children	Parental consent under 16 (states may lower to 13) for online services offered on consent	Opt-in needed to sell/share data of under-16s (parent for under-13s)
Privacy officer	Data Protection Officer mandatory in some cases; EU representative for most non-EU controllers	No DPO requirement; must designate request methods and train staff
Accountability docs	Records of processing (Art. 30), DPIAs for high-risk processing	Risk assessments (from 2026), annual cybersecurity audits (phased 2028–2030)
Vendor contracts	Data Processing Agreement under Art. 28	Service provider / contractor contract under §1798.100(d) and regs §7051
International transfers	Restricted: adequacy (e.g., EU–US Data Privacy Framework), SCCs or BCRs	No transfer restrictions
Breach notification	Regulator within 72 hours; individuals without undue delay if high risk	Separate breach law (Civ. Code §1798.82) — notify affected residents; AG if 500+
Regulator	National data protection authorities, coordinated by the EDPB	California Privacy Protection Agency (CalPrivacy) and the California Attorney General
Maximum fines	€20M or 4% of worldwide annual turnover (lower tier €10M / 2%)	$2,663 per violation; $7,988 per intentional violation or involving minors (adjusted for 2025–26)
Private lawsuits	Yes — compensation for material or non-material damage (Art. 82)	Only for certain data breaches: $107–$799 per consumer per incident, or actual damages
Cure period	None	None automatic since 2023 (regulator discretion)

How to read this table

Where a cell says “required,” failing to do it is itself a violation. Where the CCPA column says “opt-out,” the default is that you may collect and use data — until the person tells you to stop, directly or through a browser signal. That single design difference drives almost every practical gap between the two laws.

What Is the GDPR?

The General Data Protection Regulation (GDPR) is the European Union’s main data protection law. It sets rules for how organizations collect, use, store and share personal data of people in the EU and the wider European Economic Area (Iceland, Liechtenstein and Norway). Because it is a regulation, it applies directly in every member state without national copies, though countries add details such as the age of digital consent.

GDPR timeline at a glance

• 27 April 2016 — adopted (many competitor pages wrongly call this the start date).
• 25 May 2018 — applies and becomes enforceable.
• July 2023 — EU–US Data Privacy Framework adequacy decision eases EU-to-US transfers for certified US companies.
• November 2025 — European Commission proposes the “Digital Omnibus,” including targeted GDPR and cookie-rule changes.
• 2026 — Omnibus still under negotiation between the Council and Parliament; no GDPR obligations have changed yet.

The seven GDPR principles

Lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. The last one is the key operational difference from the CCPA: you must be able to prove compliance with records, policies and assessments.

Who enforces the GDPR?

Each EU country has a supervisory authority (for example, Ireland’s Data Protection Commission, France’s CNIL, Germany’s state authorities). For companies with an EU main establishment, a “lead authority” handles cross-border cases, with the European Data Protection Board settling disputes.

What about the UK?

After Brexit the UK kept a near-copy called the UK GDPR, alongside the Data Protection Act 2018, now amended by the Data (Use and Access) Act 2025. It is enforced by the ICO, with fines up to £17.5 million or 4% of turnover. If you sell to the UK and the EU, you may need both an EU and a UK representative.

What Is the CCPA (and How Does the CPRA Fit In)?

The California Consumer Privacy Act (CCPA) gives California residents rights over personal information that businesses collect about them. Voters expanded it through Proposition 24, the California Privacy Rights Act (CPRA), in November 2020. The CPRA did not replace the CCPA; it amended it. Today, “CCPA” means the law as amended, and the CPRA name mostly appears in legal history.

Does the CCPA apply to my business? The 2026 thresholds

You are a covered “business” if you are a for-profit entity that does business in California, decides why and how personal information is processed, and meets any one of these:

• Annual gross revenue above $26,625,000 in the prior calendar year (inflation-adjusted figure in force for 2025–2026; the next adjustment is due January 2027).
• Annually buys, sells or shares the personal information of 100,000 or more California consumers or households.
• Derives 50% or more of annual revenue from selling or sharing personal information.

You do not need an office in California. An online store in Texas or a SaaS company in London that crosses a threshold and sells to Californians is covered.

Who enforces the CCPA?

Two regulators: the California Privacy Protection Agency (now branded CalPrivacy), which writes the regulations and runs audits, and the California Attorney General. Both can bring enforcement actions. Consumers can sue directly only after certain data breaches.

Is there a federal US equivalent to the GDPR?

No. The US still has no comprehensive federal privacy law. Instead, about 20 states have passed CCPA-style laws (Virginia, Colorado, Connecticut, Texas, Oregon and others). Most follow the opt-out model, but some, like Colorado, Connecticut and Texas, also require consent before processing sensitive data.

Which Law Applies to Your Business? Free 30-Second Check

Answer five questions. Nothing is stored or sent anywhere; the result appears on this page.

1. Do you have an office, staff or legal entity in the EU/EEA?

YesNo

2. Do you offer goods/services to people in the EU (EU languages, euro pricing, EU shipping) or track EU visitors with analytics or ad pixels?

YesNo

3. Are you a for-profit business that sells to or collects data from California residents?

YesNo

4. Was last year’s worldwide gross revenue above $26,625,000?

YesNo

5. Do you buy, sell or share (for cross-context ads) data on 100,000+ Californians a year, or earn 50%+ of revenue from selling/sharing data?

YesNo / not sure
Show my result

Tip: a Meta Pixel or Google Ads remarketing tag on a site with ~300 California visitors a day can reach 100,000 consumers a year, and sending that data to ad platforms is usually “sharing” under the CCPA.

Common scenarios: who needs to comply with what?

Business	GDPR?	CCPA?	Why
US Shopify store, $8M revenue, ships to EU, runs Meta + Google retargeting	Yes	Likely yes	Targets EU buyers; retargeting usually means “sharing” data on 100k+ CA visitors
US B2B SaaS, $40M revenue, US customers only, no EU marketing	Usually no	Yes	Crosses the revenue threshold; employee and B2B contact data are covered
UK startup selling an app to Europe and the US, $3M revenue	Yes (and UK GDPR)	Only if it hits the 100k or 50% tests	Revenue is below the CCPA line
Australian e-commerce brand shipping to California, $30M revenue	Only if it targets the EU	Yes	Revenue over $26.625M and does business in CA
India-based marketing agency serving US and EU clients	As a processor, yes	As a service provider, under contract	Bound by clients’ DPAs and CCPA contract terms; see the offshore section
US non-profit with EU donors	Yes	No	CCPA only covers for-profit businesses

7 Ways GDPR and CCPA Are Similar

1. Extraterritorial reach

Both apply to companies outside their home region if they target or collect data from protected residents.

2. Broad definition of personal data

Cookie IDs, IP addresses, device IDs and inferences count as personal data under both.

3. Transparency

Both require a clear privacy notice explaining what you collect, why, who receives it and how long you keep it.

4. Access, deletion and correction rights

People can see, delete and fix their data under both laws, and get it in a portable format.

5. Data minimization and purpose limits

The CPRA added GDPR-style limits: collect only what is reasonably necessary for disclosed purposes.

6. Vendor contracts

Both require written contracts restricting how vendors use your customers’ data.

7. Reasonable security

Both expect security measures appropriate to the risk, and both punish breaches caused by weak controls.

14 Key Differences Between GDPR and CCPA, Explained

1. Territorial scope: “in the EU” vs “doing business in California”

GDPR Article 3 covers EU-established organizations and non-EU organizations that offer goods or services to, or monitor the behavior of, people in the EU. The CCPA asks a commercial question instead: are you a for-profit business doing business in California and over a threshold?

2. Size thresholds: none vs three tests

A five-person GDPR-covered agency has the same core duties as a multinational (with some record-keeping relief under 250 employees). Most small US businesses fall outside the CCPA unless their ad tracking pushes them past the 100,000-consumer test.

3. What counts as personal data

Both definitions are broad, but the CCPA explicitly includes households and inferences drawn to build a profile.

Publicly available and de-identified data

The CCPA excludes lawfully available public records and properly de-identified data. The GDPR still covers public data (you need a lawful basis to scrape it) and only exempts truly anonymous data; pseudonymized data remains personal data.

4. Lawful basis vs notice-and-opt-out

This is the biggest difference. Under the GDPR you may process data only if one of six lawful bases applies. Under the CCPA you may process data for disclosed, reasonably necessary purposes without a legal basis, but people can opt out of sale and sharing.

The six GDPR lawful bases

Consent, contract, legal obligation, vital interests, public task and legitimate interests.

Legitimate interests for marketing

Direct marketing to existing customers can rely on legitimate interests after a balancing test, but cookies and electronic marketing to new prospects usually need consent under the ePrivacy rules (in the UK, PECR).

5. Consent and cookies

EU law requires opt-in consent before storing or reading non-essential cookies, with “Reject all” as easy as “Accept all.” The CCPA does not require cookie consent, but if cookies send data to ad platforms you must offer an opt-out and treat Global Privacy Control as a valid opt-out request.

6. Sensitive data

GDPR special categories (health, biometrics, religion, sexual orientation and more) are prohibited unless an Article 9 exception applies, usually explicit consent. The CCPA’s sensitive personal information list also includes precise geolocation, account log-ins and government IDs, and gives a “limit the use” right rather than a ban.

7. Individual rights side by side

Right	GDPR	CCPA
Access / know	Yes	Yes (12-month lookback, longer for data since 2022)
Delete / erasure	Yes, with exceptions	Yes, with exceptions
Correct / rectify	Yes	Yes (since 2023)
Portability	Yes	Yes (part of right to know)
Object to processing	Yes, absolute for direct marketing	No general right
Restrict processing	Yes	No
Opt out of sale/sharing	Covered by objection/consent withdrawal	Yes, including via GPC
Limit use of sensitive data	Covered by Art. 9	Yes
Automated decision-making	Art. 22 right not to be subject to solely automated significant decisions	Pre-use notice, opt-out and access rights from 1 Jan 2027
Non-retaliation	Implied (consent must be free)	Explicit; loyalty programs need a financial incentive notice

8. Response deadlines

GDPR: one month, extendable by two months for complex requests. CCPA: confirm receipt within 10 business days, respond within 45 calendar days (extendable by 45), and act on opt-outs within 15 business days.

9. Children’s data

GDPR Article 8 requires parental consent for information-society services offered to children under 16 (EU states may set 13–15). The CCPA requires opt-in before selling or sharing data of consumers under 16, from a parent if under 13, and fines for violations involving minors are at the higher $7,988 level.

10. DPOs, representatives and accountability paperwork

The GDPR requires records of processing, Data Protection Impact Assessments for high-risk processing, a Data Protection Officer in some cases and, for most non-EU companies, an appointed EU representative. The CCPA has no DPO or representative rule, but since 1 January 2026 requires documented risk assessments for higher-risk processing and, from 2028, annual cybersecurity audits for larger businesses.

11. Vendor contracts: DPA vs service-provider agreement

An Article 28 Data Processing Agreement and a CCPA service-provider contract overlap but are not interchangeable. The CCPA contract must, among other things, prohibit selling or sharing the data, prohibit combining it with other clients’ data (with narrow exceptions) and give you the right to stop unauthorized use. Most vendors now offer a combined addendum.

12. International data transfers

The GDPR restricts transfers outside the EEA unless the destination is “adequate” (the US qualifies only for companies certified under the Data Privacy Framework) or safeguards like Standard Contractual Clauses are in place. The CCPA has no transfer rules, which is why sending data to an offshore team is simpler under the CCPA than under the GDPR.

13. Breach notification

The GDPR requires notifying the regulator within 72 hours of becoming aware of a reportable breach. California’s breach rules sit in a separate statute (Civil Code §1798.82): notify affected residents, and the Attorney General if more than 500 residents are affected. The CCPA adds the private right to sue over breaches caused by unreasonable security.

14. Enforcement, fines and lawsuits

GDPR fines are percentage-based and have reached €1.2 billion. CCPA fines are counted per violation, so a non-working opt-out on a high-traffic site can be counted per affected consumer. Consumers can also sue for $107–$799 per person after a qualifying breach, which is why US class actions often cost more than regulator fines.

Which law is stricter?

On paper, the GDPR. It covers more organizations, demands a legal basis for every use and allows bigger fines. In practice, California’s per-violation math, private breach lawsuits and active enforcement on opt-out mechanics make the CCPA expensive to get wrong, especially for ad-funded and e-commerce sites.

GDPR vs CCPA for Digital Marketing: What Changes on Your Website

Most “GDPR vs CCPA” pages stop at the legal text. Here is what the two laws mean for the tools your marketing team actually runs.

Tool / activity	GDPR (EU visitors)	CCPA (California visitors)
Google Analytics 4	Load only after analytics consent; use Consent Mode v2	Can load by default; disclose; respect GPC if data feeds Google ads
Meta Pixel / Conversions API	Marketing consent before firing, including server-side events	Treat as “sharing”; stop or use Limited Data Use on opt-out or GPC
Google Ads remarketing	Consent required; send ad_user_data and ad_personalization signals	Opt-out required; enable restricted data processing on opt-out
TikTok, LinkedIn Insight, X pixels	Consent required	Opt-out + GPC
Email newsletter	Consent (or soft opt-in for customers); unsubscribe in every email	Notice at collection; CAN-SPAM unsubscribe; no consent needed
Customer list uploads (Customer Match, Custom Audiences)	Lawful basis + transparency; DPA with platform	Usually “sharing”; exclude opted-out consumers
Lead forms	Explain purpose and lawful basis at the form	Notice at collection link at the form
SMS marketing	Prior consent (ePrivacy)	Prior express written consent under the federal TCPA
AI lead scoring / personalization	DPIA; Art. 22 if decisions are significant and fully automated	Risk assessment; ADMT rules from 2027 for significant decisions

One banner or two? Geo-targeted consent explained

Most consent platforms (CookieYes, Cookiebot, OneTrust, Complianz and others) can show an opt-in banner to EU/UK visitors and an opt-out notice with a “Your Privacy Choices” link to US visitors. That keeps US conversion rates high while staying compliant in Europe. The alternative, opt-in for everyone, is simpler to manage but typically cuts measurable US conversions.

How to honor Global Privacy Control

GPC is a browser signal (Sec-GPC: 1) sent by Firefox, Brave, DuckDuckGo and privacy extensions. Under the CCPA you must treat it as a valid opt-out of sale/sharing for that browser, and since 1 January 2026 your site must show whether the opt-out has been processed (for example, “Opt-out request honored”).

Server-side tagging is not a loophole

Moving pixels to a server container changes where data flows, not whether it is “shared.” The same consent (GDPR) and opt-out (CCPA) rules apply to server-side events.

Quick test you can run today

Open your site in Firefox with GPC enabled and your browser’s network tab open. If Meta, TikTok or Google Ads requests still fire with full user data, your CCPA setup needs work.

Google Consent Mode v2: needed for both?

Google requires Consent Mode v2 signals for EEA and UK traffic if you use its ad and measurement products there. It is not required for US traffic, but using its “denied” states when a Californian opts out is a clean way to honor the CCPA across Google tags.

What Changed in 2026–2027 for GDPR and CCPA

GDPR in 2026: the Digital Omnibus (proposed, not yet law)

In November 2025 the European Commission proposed the Digital Omnibus, which would clarify the definition of personal data, simplify some cookie consent rules, raise the breach-notification threshold and add rules for AI training. As of October 2026, the Council has agreed a compromise text but the package is still being negotiated with the European Parliament, and any changes would apply only after a transition period. Until then, current GDPR and ePrivacy rules apply in full.

EU–US data transfers

The EU–US Data Privacy Framework remains in force after surviving its first court challenge in 2025, although further appeals are possible. Keep Standard Contractual Clauses as a fallback in your contracts.

CCPA in 2026–2027: new regulations now in force

Date	Change	Who it affects
1 Jan 2026	Updated regulations: opt-out status must be displayed for GPC users; symmetry in choice; closing a banner is not consent	All covered businesses
1 Jan 2026	Risk assessments required for new higher-risk processing (e.g., selling/sharing, sensitive data, ADMT)	Businesses doing higher-risk processing
1 Jan 2026	Delete Act: DROP platform opens for consumers to send one deletion request to all registered data brokers	Data brokers
1 Aug 2026	Data brokers must start processing DROP deletion requests	Data brokers
1 Jan 2027	Automated decision-making technology (ADMT) notice, opt-out and access rules	Businesses using ADMT for significant decisions
1 Jan 2027	AB 566 (Opt Me Out Act): browsers must offer a built-in opt-out preference signal	Browser makers; expect more GPC traffic
1 Apr 2028	First risk-assessment attestations due; cybersecurity audit certifications begin (revenue >$100M), then 2029 and 2030 for smaller businesses	Larger businesses first

Other US states to watch

About 20 states now have comprehensive privacy laws. Several (including Colorado, Connecticut, Oregon, Texas and Minnesota) require businesses to honor universal opt-out signals, and some have no revenue threshold at all. A setup that satisfies the CCPA usually covers most of them, but sensitive-data consent rules differ.

GDPR vs CCPA Fines and Real Enforcement Cases

Largest GDPR fines

Company	Fine	Year	Issue
Meta (Ireland DPC)	€1.2 billion	2023	Transfers of EU user data to the US
Amazon (Luxembourg CNPD)	€746 million	2021	Targeted advertising without valid consent
TikTok (Ireland DPC)	€530 million	2025	Transfers to China and transparency
LinkedIn (Ireland DPC)	€310 million	2024	Behavioral advertising lawful basis
Uber (Dutch AP)	€290 million	2024	Driver data transfers to the US

Notable CCPA enforcement

Company	Amount	Year	Issue
Sephora (Attorney General)	$1.2 million	2022	Sold data via tracking without opt-out; ignored GPC
Honda (CalPrivacy)	$632,500	2025	Asked for too much data to process opt-outs; asymmetric choices
Healthline (Attorney General)	$1.55 million	2025	Failed to honor opt-outs; shared health-related article data
Tractor Supply (CalPrivacy)	$1.35 million	2025	No notice to job applicants; opt-out and GPC failures

Lessons for marketers

• Most CCPA cases are about ad tracking and opt-outs that do not work, not data breaches.
• Most large GDPR fines are about lawful basis for advertising and international transfers.
• Regulators test sites themselves, using GPC-enabled browsers and network logs. Assume yours will be tested.

How to Comply With Both GDPR and CCPA: A 12-Step Checklist

Build once, configure twice. This is the order we use when setting up client stacks.

Step 1: Map your data and audiences

List what you collect, where it goes (every pixel, CRM, email tool) and which countries your visitors come from. You cannot comply with either law without this.

Step 2: Confirm which laws apply

Use the check above, then confirm with counsel. Note UK GDPR and other US states too.

Step 3: Pick your consent strategy

Opt-in for EU/UK visitors; opt-out with GPC for US visitors (or opt-in everywhere if you prefer one model).

Step 4: Install a geo-aware consent platform

Configure categories, block tags until consent in the EU/UK and map opt-outs to tag behavior in the US.

Step 5: Wire Google Consent Mode v2 and platform restrictions

Send consent states to Google tags; enable Meta Limited Data Use and Google restricted data processing for opted-out Californians.

Step 6: Honor GPC and show opt-out status

Detect Sec-GPC, suppress sharing and display that the opt-out was processed.

Step 7: Rewrite your privacy notice

One notice can serve both laws if it has a GDPR section (lawful bases, retention, transfers, rights) and a CCPA section (categories, sale/sharing disclosure, 12-month data, rights, request methods).

Step 8: Add the required links

“Do Not Sell or Share My Personal Information” and, if relevant, “Limit the Use of My Sensitive Personal Information” (or the single “Your Privacy Choices” link with the official icon).

Step 9: Build one request workflow

A form plus an email address (and a toll-free number if you are not online-only), identity verification, and a log that tracks GDPR (1 month) and CCPA (45 days / 15 business days) clocks.

Step 10: Paper your vendors

Sign GDPR Art. 28 DPAs and CCPA service-provider terms with every processor; add SCCs for transfers outside the EEA.

Step 11: Document assessments

Records of processing and DPIAs for the GDPR; CCPA risk assessments for selling/sharing, sensitive data and ADMT.

Step 12: Retest every quarter

New tags creep in. Re-scan cookies, retest GPC and update notices whenever you add a tool.

Official resources

• EU GDPR text: EUR-Lex, Regulation (EU) 2016/679
• European Data Protection Board guidelines (edpb.europa.eu)
• California Privacy Protection Agency (cppa.ca.gov) and CCPA regulations
• California Attorney General CCPA page (oag.ca.gov/privacy/ccpa)
• UK ICO guide to the UK GDPR (ico.org.uk)

GDPR vs CCPA vs Other Privacy Laws (UK, Canada, Australia, India)

If you market across Tier 1 countries, the GDPR-vs-CCPA split is only half the picture.

Law	Model	Cookie consent?	Max penalty	Regulator
EU GDPR	Lawful basis / opt-in	Yes (ePrivacy)	€20M or 4% turnover	National DPAs, EDPB
UK GDPR + DPA 2018 (amended by DUAA 2025)	Lawful basis / opt-in	Yes (PECR), with new exemptions for some analytics	£17.5M or 4% turnover	ICO
CCPA (California)	Notice + opt-out	No; opt-out + GPC	$7,988 per intentional violation	CalPrivacy, AG
PIPEDA (Canada) / Quebec Law 25	Consent (express or implied)	Quebec: opt-in for tracking	C$100K (PIPEDA); up to C$25M or 4% (Quebec)	OPC, CAI
Privacy Act 1988 & APPs (Australia)	Notice + reasonable expectations; consent for sensitive data	No specific rule; transparency required	A$50M, 3x benefit or 30% adjusted turnover	OAIC
DPDP Act 2023 (India)	Consent-led with legitimate uses	Consent for non-essential processing	₹250 crore per breach	Data Protection Board of India

GDPR does not equal CCPA, and neither covers the others

A GDPR-grade setup gets you most of the way for the UK, Canada and Australia. A CCPA-grade setup gets you most of the way for other US states. Running both, geo-targeted, covers nearly every market our clients sell into.

UK and Australian spelling note

This page uses US spelling. UK and Australian readers will see the same terms as “organisation,” “minimisation,” “pseudonymisation,” “behaviour” and “licence.” Search engines treat these as equivalents, so you do not need separate pages just for spelling.

Can an Offshore Marketing Agency Handle GDPR and CCPA Data Safely?

Yes, if the contracts and controls are right. Digital Masters 360 is a Hyderabad, India-based digital marketing agency serving clients in the US, UK, Canada, Australia and Europe fully online. Here is exactly how we handle your customers’ data.

Is it legal to outsource marketing that touches EU or California data to India?

CCPA: yes. There are no transfer restrictions; you need a service-provider contract that limits our use of the data. GDPR / UK GDPR: yes, with safeguards. India does not have an EU adequacy decision, so transfers rely on Standard Contractual Clauses (or the UK IDTA/Addendum) plus a transfer risk assessment. We sign both as standard.

How we handle your data

• GDPR Art. 28 DPA + CCPA service-provider terms + SCCs/IDTA in one addendum, signed before access.
• Access only to the platforms needed, through your own accounts with named-user, role-based permissions and two-factor authentication.
• No downloading of customer lists to personal devices; exports only when a task requires it, deleted after use.
• Breach notice to you within 24 hours of discovery so you can meet the GDPR 72-hour clock.
• India’s DPDP Act 2023 also binds us as a processor, adding a domestic legal layer.

Offboarding

Within two business days of contract end we hand back assets, remove our users from your accounts and confirm deletion of any working files in writing.

Tip for any agency relationship

Grant agencies access through your own Business Manager, Google Ads MCC link and GA4 property permissions, never shared logins. Revoking access then takes one click.

What it costs vs a local agency

Service (monthly unless noted)	Typical US agency	Typical UK agency	Digital Masters 360
Privacy-safe marketing audit (GDPR + CCPA tracking review, one-off)	$2,500–$6,000	£2,000–£4,500	$990 / £745 / €855 / A$1,490
SEO + content retainer	$2,500–$7,500	£1,500–£5,000	from $649 / £489 / €559 / A$990
Paid ads management with consent setup	$1,500–$5,000 + % spend	£1,000–£4,000	from $1,249 / £939 / €1,079 / A$1,890
White-label consent + tracking setup per client site	$800–$2,000	£600–£1,500	from $499 / £375 / €429 / A$750

Local ranges are indicative market ranges. Our prices exclude ad spend and third-party tool fees. Invoices are issued in your currency.

Time zones, communication and reporting

Your location	Our live-overlap window (your time)	How we work
US East (ET)	9:00 am – 1:00 pm	Dedicated overlap shift; Slack replies within 4 business hours
US Central / Mountain / Pacific	8:00 am – 12:00 pm CT / 7–11 am MT / 6–10 am PT	Async updates overnight; work ready when you start
UK / Ireland	9:00 am – 3:30 pm	Full-day overlap
Central Europe (CET)	10:00 am – 4:30 pm	Full-day overlap
Australia East (AEST)	1:00 pm – 6:00 pm	Afternoon overlap; morning updates waiting for you

Weekly Slack or Teams updates, a monthly Zoom or Google Meet review and a written report by the 5th business day of each month.

Contracts, NDAs, payments and onboarding

• Contracts: master services agreement with a data processing addendum; mutual NDA before any account access. Governing law can be your country’s on request.
• Payments: USD, GBP, EUR, CAD and AUD by bank transfer (Wise), PayPal or card. Monthly in advance; no long lock-in.
• Onboarding (14 days): kickoff call, access via your accounts, tracking and consent audit, 90-day plan, first report.

White-label partnership for US, UK and Australian agencies

Agencies use us as an unbranded back office for consent-banner setup, GA4/GTM consent wiring, GPC testing and privacy-safe ad tracking. You keep the client relationship; we work under your brand, your NDA and your DPA chain.

Privacy-Safe Marketing Packages

One-off

GDPR + CCPA Tracking Audit

$990

£745 · €855 · A$1,490

• Full tag and cookie scan (EU and California views)
• GPC and opt-out test with evidence
• Consent Mode v2 check
• Prioritized fix list

Book the audit
Most popular

Growth Marketing + Compliance

$1,249/mo

£939 · €1,079 · A$1,890

• Paid ads or SEO management
• Geo-targeted consent set up and maintained
• Quarterly privacy retest
• Monthly report and Zoom review

Start a project
Agencies

White-Label Setup

$499/site

£375 · €429 · A$750

• Unbranded consent + tag setup
• GPC handling and documentation
• Works under your DPA chain

Become a partner

What is included in every package

Signed NDA and data processing addendum, access through your accounts, a named project lead and written documentation of every change.

What we do not do

We are marketers, not lawyers. We implement what your privacy counsel signs off and we flag risks, but we do not draft legal opinions.

Common GDPR vs CCPA Myths and Mistakes

• “We are GDPR compliant, so we are CCPA compliant.” No. You still need the Do Not Sell or Share link, GPC handling, CCPA notices and service-provider terms.
• “CCPA only applies to companies in California.” No. It applies to businesses doing business in California, wherever they are based.
• “We don’t sell data, so we can skip the opt-out.” Sending pixel data to ad platforms for cross-context advertising is usually “sharing,” which needs the same opt-out.
• “The CPRA replaced the CCPA.” It amended it. One law, updated.
• “There is a GDPR or CCPA certification.” There is no official certificate for either. Badges from vendors are marketing.
• “An X button on the banner counts as consent.” Not under the GDPR, and California’s 2026 rules say closing a banner is not consent either.
• “B2B and employee data are exempt from the CCPA.” Those exemptions expired on 1 January 2023.

Glossary

Term	Meaning
Controller (GDPR) / Business (CCPA)	The organization that decides why and how data is processed
Processor (GDPR) / Service provider (CCPA)	A vendor processing data on the controller’s/business’s instructions
Data subject (GDPR) / Consumer (CCPA)	The person the data is about
Sale	Disclosing personal information for money or other valuable consideration
Sharing	Disclosing personal information for cross-context behavioral advertising
GPC	Global Privacy Control, a browser signal that requests an opt-out
DPA	Data Processing Agreement (Art. 28 GDPR); also Data Protection Authority
SCCs	Standard Contractual Clauses for transfers outside the EEA
DPIA	Data Protection Impact Assessment for high-risk processing
ADMT	Automated decision-making technology (CCPA regulations)

GDPR vs CCPA: Frequently Asked Questions

What is the main difference between GDPR and CCPA?

The GDPR requires a lawful basis, often opt-in consent, before you process personal data of people in the EU, and applies to organizations of any size. The CCPA lets covered businesses collect data with notice but requires them to honor opt-outs of selling and sharing, and applies only to for-profit businesses above set thresholds.

Is CCPA stricter than GDPR?

No. The GDPR is broader and stricter on paper: it covers more organizations, requires a legal basis for every use, restricts international transfers and allows fines up to 4% of global turnover. The CCPA can still be costly because fines are counted per violation and consumers can sue after certain breaches.

Does GDPR compliance make me CCPA compliant?

Not fully. A GDPR program covers much of the groundwork, but the CCPA adds specific items: a Do Not Sell or Share My Personal Information link, Global Privacy Control handling with a visible opt-out status, CCPA notice content, 45-day response timelines and service-provider contract terms.

Does the CCPA apply to businesses outside California?

Yes. It applies to for-profit businesses that do business in California and meet a threshold: more than $26,625,000 in annual revenue, buying, selling or sharing data of 100,000+ California consumers or households, or earning 50%+ of revenue from selling or sharing personal information.

Does the GDPR apply to US companies?

Yes, if a US company offers goods or services to people in the EU or monitors their behavior, for example with analytics or ad tracking aimed at EU visitors. Most such companies must also appoint an EU representative.

Do I need a cookie banner for CCPA?

Not a consent banner. The CCPA does not require opt-in for cookies, but you need notice at collection, an opt-out link for selling or sharing and automatic handling of Global Privacy Control. For EU and UK visitors you do need an opt-in cookie banner.

What are the GDPR and CCPA fines in 2026?

GDPR fines reach up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher. CCPA fines are $2,663 per violation and $7,988 per intentional violation or violation involving minors under 16, under the inflation adjustment in force for 2025 and 2026.

What is the difference between CCPA and CPRA?

The CPRA (Proposition 24) amended the CCPA from 1 January 2023. It added the right to correct, the right to limit use of sensitive personal information, the concept of sharing for cross-context ads, data minimization rules and the California Privacy Protection Agency.

How long do I have to respond to a request under GDPR vs CCPA?

GDPR: one month, extendable by two further months for complex requests. CCPA: confirm receipt within 10 business days and respond within 45 calendar days, extendable once by 45 days; opt-out requests must be honored within 15 business days.

Does the GDPR or CCPA require a Data Protection Officer?

The GDPR requires a DPO for public authorities and organizations whose core activities involve large-scale monitoring or large-scale sensitive data. The CCPA has no DPO requirement.

Is Google Analytics compliant with GDPR and CCPA?

It can be. For EU and UK visitors, load GA4 only after analytics consent and use Google Consent Mode v2. For California visitors, disclose it, and if GA4 data feeds Google advertising features, treat opt-outs and GPC as signals to restrict that use.

What is Global Privacy Control and which law requires it?

Global Privacy Control is a browser setting that sends an opt-out signal. The CCPA and several other US state laws require businesses to treat it as a valid request to opt out of selling or sharing. The GDPR does not mention it, but it can be relevant to objection rights.

Can California consumers sue under the CCPA?

Only for certain data breaches caused by a failure to maintain reasonable security. Statutory damages are $107 to $799 per consumer per incident, or actual damages if higher. Other violations are enforced by CalPrivacy and the Attorney General.

Does the CCPA cover employee and B2B data?

Yes. Since 1 January 2023, employee, job applicant and business-to-business contact data are fully covered by the CCPA, including rights requests and notices.

Is there an official GDPR or CCPA certification?

No. Neither law has an official certification for businesses. Badges from vendors are marketing claims; regulators judge compliance by your actual practices and documentation.

Do small businesses need to comply with GDPR and CCPA?

The GDPR applies to small businesses that target or monitor people in the EU, with limited record-keeping relief under 250 employees. The CCPA usually does not apply to small businesses unless they share data on 100,000+ Californians, which ad pixels can trigger.

How do GDPR and CCPA treat children's data?

The GDPR requires parental consent for online services offered to children under 16, or a lower age set by each EU country, down to 13. The CCPA requires opt-in consent before selling or sharing data of consumers under 16, from a parent for under-13s.

Can I use one privacy policy for both GDPR and CCPA?

Yes. Many businesses use one privacy notice with separate GDPR and California sections, covering lawful bases, retention and transfers for the GDPR, and categories, sale and sharing disclosures and request methods for the CCPA.

Is it safe to outsource marketing involving EU or US customer data to India?

Yes, with the right safeguards. Under the CCPA you need a service-provider contract. Under the GDPR and UK GDPR you need a data processing agreement plus Standard Contractual Clauses or the UK IDTA, because India has no EU adequacy decision.

Is the GDPR changing in 2026?

The EU's Digital Omnibus proposal would amend parts of the GDPR and cookie rules, but as of October 2026 it is still being negotiated and has not been adopted. Current GDPR obligations continue to apply in full.

Get a Free GDPR + CCPA Marketing Check

Send us your website URL. Within 3 business days we will test it from an EU and a California view, check whether your pixels respect consent and GPC, and send a plain-English summary of what to fix. No obligation, no sales pressure.

Email: chennareddy819@gmail.com
WhatsApp: +91 9505971747

Request my free check
Chat on WhatsApp
CR

Written by Chenna Reddy, Founder, Digital Masters 360

Chenna leads a Hyderabad-based digital marketing team that sets up consent management, Google Consent Mode, GPC handling and privacy-safe ad tracking for businesses in the US, UK, Canada, Australia and Europe. Last updated: 7 October 2026. Next review: January 2027 (CCPA inflation adjustment).

Disclaimer: This guide is general information about GDPR and CCPA requirements for marketing teams, not legal advice. Laws and regulations change; confirm your obligations with a qualified privacy attorney.

Sources: Regulation (EU) 2016/679 (EUR-Lex); California Civil Code §1798.100–1798.199.100; CCPA regulations (Cal. Code Regs. tit. 11, §7000 et seq.) and 2025 rulemaking approved for 1 January 2026; California Privacy Protection Agency and Attorney General enforcement announcements; EDPB–EDPS Joint Opinion 2/2026 on the Digital Omnibus; Council of the EU documents on the Digital Omnibus (2026); UK ICO guidance; OAIC guidance.