CCPA vs. GDPR
The California Consumer Privacy Act in comparison
TL;DR
The CCPA and its successor, the CPRA, apply to companies that process the data of Californian consumers. Thresholds: USD 25 million in revenue or 100k+ Californian consumers.
What is CCPA vs. GDPR?
Differences:
- GDPR: all EU citizens, all processing operations. CCPA: California only, commercial activity only.
- GDPR: opt-in for marketing. CCPA: opt-out is sufficient.
- GDPR: fines of EUR 20 million / 4%. CCPA: a maximum of USD 7,500 per violation.
Practical example
An EU SaaS provider with US customers in CA must comply with the GDPR, the CCPA and, where applicable, further US state laws (CO, VA, CT, UT).
Frequently asked questions
Which applies to DACH companies?
The GDPR always. The CCPA where there are Californian end customers and the thresholds are met.
What do you recommend?
Use the GDPR as the benchmark and add CCPA-specific elements for each US customer case.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult an admitted lawyer.