GDPR vs CCPA/CPRA: the differences that matter for small businesses

By the Privacyboard teamPublished 26 October 2026Updated 4 November 20269 min read

Short answer

The GDPR is an opt-in law: you need a legal basis, such as consent, before you process personal data. California's CCPA/CPRA is mostly an opt-out law: you may collect data if you give notice, but you must stop selling or sharing it when asked. The GDPR replies in one month, the CCPA in 45 days, and the fine maximums differ widely.

The GDPR and the California Consumer Privacy Act (CCPA, as amended by the CPRA) both give people rights over their data, but they start from opposite places. The GDPR says you may not process personal data without a legal basis. The CCPA says you may collect data if you tell people, and must stop selling or sharing it when they say no. This guide compares the two on the points a small business cares about, as of 4 November 2026.

The GDPR is an opt-in law. Before you process personal data you need one of six legal bases listed in Article 6: consent, a contract, a legal obligation, vital interests, a public-interest task or legitimate interests. Consent, when you rely on it, must be given by a clear action and can be withdrawn as easily as it was given (Article 7(3)).

The CCPA/CPRA is mostly an opt-out law. It does not ask you for a legal basis for ordinary collection. It asks you to give notice, to honour requests, and to let people stop the sale or sharing of their data, and to limit your use of sensitive data. Opt-in consent matters in California in narrower cases, such as consumers under 16.

In plain terms: under the GDPR the default is "no, unless you have a reason". Under the CCPA the default is "yes, until the person says stop". That shapes everything else, including how a cookie banner is built.

Topic	GDPR (EU)	CCPA/CPRA (California)
Who is protected	People in the EU	Residents of California
Who must comply	Any controller or processor established in the EU, or outside it if it offers goods or services to people in the EU or monitors their behaviour (Article 3). No size threshold, and nonprofits are covered	For-profit businesses doing business in California that meet one threshold: over USD 26,625,000 yearly revenue (2025 adjusted figure), 100,000 or more consumers or households, or 50% or more of revenue from selling or sharing data
Core model	Opt-in: a legal basis is needed for processing	Opt-out: notice, plus a right to stop sale or sharing
Consent	Freely given, specific, informed, unambiguous; withdrawable	Required for some cases (for example consumers under 16); consent obtained through dark patterns is not valid
Main rights	Access, rectification, erasure, restriction, portability, objection, no solely automated decisions (Articles 15 to 22)	Know, delete, correct, opt out of sale or sharing, limit use of sensitive data, no retaliation
Reply deadline	One month, plus up to two more months for complex requests (Article 12(3))	45 days, plus one extension of 45 days. Opt-outs within 15 business days
Sensitive data	Special categories are prohibited unless an exception applies, such as explicit consent (Article 9)	Right to limit use of sensitive personal information, through a "Limit" link
Opt-out links	Not required; cookie consent is needed instead	"Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information" links, or a combined link, unless you honour opt-out signals frictionlessly
Maximum fines	Up to EUR 20 million or 4% of worldwide annual turnover for the most serious breaches; EUR 10 million or 2% for others	USD 2,663 per violation, USD 7,988 if intentional or involving consumers under 16 (2025 figures)
Enforcement	National data protection authorities	The California Attorney General and the California Privacy Protection Agency
Private lawsuits	Right to compensation for damage (Article 82)	Only for certain data breaches, USD 107 to 799 per consumer per incident

The sections below explain the rows that cause most confusion.

#Who has to follow each law?

The GDPR has no size threshold. A one-person company that offers goods or services to people in the EU, or tracks their behaviour there, is in scope. Recital 13 does soften one duty for organisations with fewer than 250 employees: the record of processing activities.

The CCPA applies only to for-profit businesses that do business in California and meet one of three tests, according to the California Attorney General: gross annual revenue over a set amount, handling data of 100,000 or more California residents or households, or earning at least 50% of revenue from selling or sharing California residents' data. The revenue figure was USD 25 million in the statute and was adjusted to USD 26,625,000 on 1 January 2025 by the California Privacy Protection Agency. These amounts are re-adjusted every odd-numbered year, so a new figure is due on 1 January 2027.

For many small businesses the revenue test is not the one that bites. The 100,000 test is more likely: the statute counts businesses that buy, sell or share the data of 100,000 or more consumers or households, so a busy website that shares visitor data with advertising partners can reach it. Counting honestly matters here.

Under the GDPR and the ePrivacy Directive, non-essential cookies are blocked until the visitor says yes. Our cookie consent guide covers it.

Under the CCPA, tools that sell or share data can run, but a visitor must be able to opt out. There are two ways to offer that:

Links. Place a "Do Not Sell or Share My Personal Information" link on your homepage, plus a "Limit the Use of My Sensitive Personal Information" link if you use sensitive data (or a single combined link).
Opt-out preference signals. Honour a browser signal such as Global Privacy Control without friction, and you do not need the links. California's regulation lets you skip the links only if you honour signals without friction, which means no fee, no change to the visitor's experience and no pop-up in response to the signal. A business that does post the links must still honour the signal. Our GPC guide explains how.

After a person opts out, the statute says you must wait at least 12 months before asking them to opt back in.

#What rights do people have, and how fast must you reply?

Both laws give access and deletion rights, and both ban punishing people for using them. The GDPR adds restriction, objection and rights about automated decisions, and the CCPA adds the right to opt out of sale or sharing and to limit sensitive data.

On timing, the GDPR gives you one month, extendable by two months if the request is complex and you tell the person within the first month. California gives you 45 days, extendable once by 45 days (90 in total) with notice. A request to opt out of sale or sharing must be handled as soon as feasible and within 15 business days.

If you serve both markets, plan for the shortest deadline: answer within one month. Our guide to responding to access requests walks through the steps.

#How big are the fines, and who enforces them?

Under GDPR Article 83, fines can reach EUR 10 million or 2% of worldwide annual turnover for lower-tier breaches, and EUR 20 million or 4% for the most serious ones, whichever is higher for a company. Regulators weigh the nature and duration of the breach, intent, cooperation and the damage done. Real fines have ranged from a few thousand euros to over a billion; see GDPR fines in numbers.

Under the CCPA, penalties are counted per violation. The 2025 inflation-adjusted amounts are USD 2,663 per violation and USD 7,988 per intentional violation or violation involving consumers under 16. The next adjustment is due on 1 January 2027. The numbers look small, but they add up across violations. Examples from the California Attorney General's list: Healthline Media paid USD 1,550,000 (1 July 2025), Disney USD 2,750,000 (11 February 2026) and General Motors USD 12,750,000 (8 May 2026). The privacy agency's largest administrative fine at the time, USD 1,350,000 against Tractor Supply, was announced on 30 September 2025 and included failing to honour opt-out preference signals such as GPC.

On private lawsuits, the two laws differ sharply. The GDPR gives anyone who suffered material or non-material damage a right to compensation (Article 82). The CCPA allows a lawsuit only for a data breach of certain unencrypted data caused by a failure to keep it reasonably secure, with damages of USD 107 to 799 per consumer per incident, or actual damages if higher, after a 30-day cure notice.

#Is anything new coming in California?

The state's updated regulations took effect on 1 January 2026, with later start dates for some parts. Businesses that use automated decision-making technology for significant decisions must comply from 1 January 2027. Risk assessment attestations are due by 1 April 2028. Cybersecurity audit certifications start on 1 April 2028 for businesses above USD 100 million in revenue and phase in to 2030 for smaller ones. The governor also signed a law on 8 October 2025 that requires browsers to offer an opt-out preference signal from 1 January 2027.

#What this means for a small business

Selling only in the EU: the GDPR is your main law. You need a legal basis, a privacy policy, a way to answer requests and cookie consent.
Selling in the US only: check each state's thresholds before assuming a law applies, and remember that sharing visitor data through advertising tags counts towards California's 100,000 test.
Selling in both: build to the stricter standard. Ask for cookie consent in the EU, honour GPC in the US, and answer every request within one month.

A short checklist:

Count your California consumers and revenue against the three thresholds.
List whether you sell or share data, including through advertising and analytics tags.
Add the opt-out links, or honour GPC without friction.
Put a US notice in your privacy policy that covers categories collected, rights, and how to appeal.
Track both the one-month and 45-day clocks.

Privacyboard's request form shows the GDPR or US state-law rules for each request, with 45-day periods and the 15-business-day opt-out limit; see requests from people in the United States. It supports your process but does not decide whether a law applies to you. For other countries, read our overview of privacy laws around the world.

#FAQ

No. The GDPR requires a legal basis before processing, applies to every size of organisation and fines up to 4% of worldwide turnover. The CCPA applies only above set thresholds and works mainly through notice and opt-out rights.

#Does the CCPA apply to a small business?

Only if it does business in California and meets one threshold: over USD 26,625,000 in revenue, 100,000 or more consumers or households, or half of revenue from selling or sharing data. Many very small businesses fall below all three.

The CCPA gives 45 days (plus 45), which is longer than the GDPR's one month (plus two months in total for complex cases). Opt-outs under the CCPA are shorter, at 15 business days.

Not necessarily. You need a working way to opt out of sale and sharing, which can be links or a frictionless honouring of opt-out signals such as GPC. A banner is needed for the GDPR and ePrivacy rules.

#Can people sue under the CCPA?

Only for certain data breaches, for USD 107 to 799 per consumer per incident or actual damages. For everything else, only the California Attorney General or the privacy agency can enforce.

Per violation, yes: USD 2,663 or USD 7,988 against EUR 20 million or 4% of turnover. Settlements add up, though: General Motors paid USD 12,750,000 in May 2026.

#Sources

Privacyboard is a guidance tool, not legal advice. This article explains general rules in plain language and was accurate on the date above; laws and guidance change. For an unusual situation, ask a qualified professional. Spotted a mistake? Write to antoine@unmake.io.

GDPR vs CCPA/CPRA: the differences that matter for small businesses

#What is the main difference between the GDPR and the CCPA/CPRA?

#GDPR vs CCPA/CPRA side by side

#Who has to follow each law?

#How do consent and opt-out differ in practice?

#What rights do people have, and how fast must you reply?

#How big are the fines, and who enforces them?

#Is anything new coming in California?

#What this means for a small business

#FAQ

#Is the CCPA the same as the GDPR?

#Does the CCPA apply to a small business?

#Which deadline is longer, GDPR or CCPA?

#Do I need a cookie banner for the CCPA?

#Can people sue under the CCPA?

#Are CCPA fines smaller than GDPR fines?

#Sources

Keep reading