CCPA vs GDPR, explained

Two laws, two regions, one general idea

Both laws answer the same basic question: what rights do people have over their own personal data once a business holds it? They answer it differently because they emerged from different legal traditions.

GDPR (General Data Protection Regulation, in force May 2018) is the EU's general-purpose privacy law. Article 3 sets its territorial scope. Processing in the context of an EU establishment can be covered even outside the EU. For a business without such an establishment, offering goods/services to or monitoring people in the EU can bring the relevant processing within scope.

CCPA (California Consumer Privacy Act, in force January 2020), expanded by CPRA (2023) and SB 362 (the Delete Act, 2024), is California's consumer-data law. It applies to most businesses doing business in California above certain thresholds, gives California residents a similar but narrower set of rights, and is enforced by the California Privacy Protection Agency (CPPA) with inflation-adjusted fines. The current maximum is $7,988 per intentional violation; the CPPA explains the thresholds effective January 1, 2025.

Side-by-side comparison

Which one is "stronger"?

It depends what you mean by stronger.

Compare scope before strength. GDPR regulates covered personal-data processing using several lawful bases. It does not require consent for every use. Neither a US resident's citizenship nor a company's EU office alone determines whether a particular request is covered.

California has a dedicated broker-request route. DROP gives eligible California residents a free ongoing request route for active data brokers, subject to matching and exemptions.

Use the applicable route for your request: a covered GDPR erasure request, a covered CCPA deletion request, or DROP for eligible California residents. Check the provider’s instructions and exceptions.

Which one applies to you

Quick decision tree for US residents:

• California resident, US data broker. Check that the business and request are covered. Eligible residents can also use DROP for active data brokers. See the California state page.
• Texas / Colorado / Virginia / Connecticut / Utah / etc. resident, US data broker. Check your state law’s scope, effective date and exceptions. Texas example; check our state pages for others.
• US resident in a state with no comprehensive privacy law, US data broker. You do not get CCPA rights merely because the broker operates in California. Use an applicable law or the broker's voluntary opt-out channel.
• US resident, EU-based business. Check whether the relevant processing is in the context of an EU establishment. An unrelated EU office or subsidiary is not enough by itself. If GDPR applies, erasure remains subject to Article 17's conditions and exceptions.
• EU resident, any business processing your data. Check Article 3's establishment or targeting/monitoring criteria. Residence alone does not bring every foreign business within scope. Use the relevant supervisory authority where GDPR applies.

Choose a request the law supports

Use the provider's official privacy channel. Supply the verification it reasonably requires for the request, after checking the recipient and purpose. A sale/sharing opt-out and a deletion request are different actions. Neither law guarantees removal of every public record or other company's copy.

CCPA deletion requests generally have a 45-day response period, with a permitted extension; this is not a universal broker-removal turnaround. DROP has its own processing and status schedule. Check the official instructions for your request.

The state-law patchwork

State privacy laws differ in their eligibility, effective dates and exemptions. (See our 50-state privacy law index for what applies where you live.) Different definitions, different thresholds, different cure periods, different fines. Compliance is harder and harder for brokers to track, and consumers in different states get materially different rights.

A federal US privacy law would solve the patchwork. There have been multiple attempted bills (the most-discussed in 2024-2025 being the American Privacy Rights Act). None have passed. The patchwork continues.

Frequently asked questions