GDPR vs CCPA: Key Differences for Startup Founders

The GDPR asks you to justify every use of personal data before it starts. The CCPA, as amended by the CPRA, asks you to be transparent and to let Californians stop the sale or sharing of their data. Both protect individuals, but they work from different assumptions. If you sell to customers in both markets, you cannot run one policy and call it done.

This guide is written for cybersecurity and AI founders who sell across the Atlantic. It covers who each law applies to, how they differ in practice, what the penalties look like, and which engineering and documentation work pays off under both.

TL;DR

• Philosophy: the GDPR is a rights-based law that requires a legal basis before processing. The CCPA is a consumer-protection law built on notice, access and opt-out.
• Scope: the GDPR follows the person in the EU. The CCPA applies to for-profit businesses that cross a revenue, volume or data-sale threshold and handle California residents’ data.
• Money: GDPR fines reach up to €20 million or 4% of worldwide turnover. CCPA penalties are per violation, plus a private right of action for certain data breaches.
• For founders: build one data map and one evidence trail, then layer jurisdiction-specific consent and opt-out controls on top.

Table of Contents

• What each law is
• Who has to comply
• The core difference: legal basis versus opt-out
• Side-by-side comparison
• Enforcement and penalties
• What changed in 2026: automated decisions and risk assessments
• A practical plan if you sell in both markets
• Our perspective
• FAQ
• Sources

What each law is

The General Data Protection Regulation is Regulation (EU) 2016/679, published in the Official Journal of the European Union. It has applied since May 25, 2018, and it covers all personal data of people in the EU, regardless of sector.

The California Consumer Privacy Act took effect on January 1, 2020. Voters then approved the California Privacy Rights Act, which amended it and added a dedicated regulator. The California Privacy Protection Agency explains how the CCPA relates to Proposition 24, the CPRA. The California Attorney General also enforces it and describes the law as giving consumers more control over the personal information businesses collect about them.

A short note on names, since readers often ask:

• What is the GDPR equivalent in California? There is no exact match. The closest is the CCPA as amended by the CPRA, usually just called “the CCPA.”
• What is the GDPR called now? It is still the GDPR. Reform talk in Brussels has not changed the name of the regulation.
• GDPR vs CPRA: you are comparing the GDPR with the current version of the California law. The CPRA is not a separate regime sitting beside the CCPA.

Who has to comply

This is where founders most often get caught out, because the two laws trigger in different ways.

GDPR. There is no revenue or headcount threshold. The law applies if you are established in the EU, or if you offer goods or services to people in the EU or monitor their behavior. A two-person startup in Austin with a European customer on a free trial can be in scope.

CCPA. The law applies to for-profit businesses that meet at least one of three tests, per the CPPA’s FAQ: gross annual revenue above the inflation-adjusted threshold (currently $26.625 million), handling the personal information of 100,000 or more California residents or households, or earning 50% or more of annual revenue from selling or sharing personal information. Early-stage companies often fall below the revenue line and still hit the volume line, especially consumer-facing apps and endpoint tools.

Two consequences follow. A pre-revenue SaaS company can be fully subject to the GDPR and outside the CCPA. A mid-sized US company with no EU presence can be subject to the CCPA and the GDPR only if it targets EU residents.

The core difference: legal basis versus opt-out

The GDPR requires a lawful basis before you touch personal data. Article 6 lists the options: consent, contract, legal obligation, vital interests, public task and legitimate interests. If you cannot name one for a given processing purpose, you should not be doing it. Consent, when you rely on it, must be specific, informed and freely given.

The CCPA does not require a pre-existing legal basis. A business may collect and use personal information for disclosed purposes, provided it gives notice at or before collection and honors consumer rights, above all the right to opt out of sale or sharing. The practical question shifts from “do we have a basis?” to “did we tell people, and can they stop it?”

A common mistake is to import one model into the other market. A consent-first banner for every Californian visitor creates friction the law does not demand. An opt-out-only setup for European visitors can mean unlawful processing, which sits in the higher fine tier.

Side-by-side comparison

Rights of individuals

Both laws give people the right to access their data and have it deleted, and both now include correction. The GDPR adds the right to restrict processing and the right to object, and it gives portability a more formal footing. California adds the right to opt out of sale or sharing, and a right to limit the use of sensitive personal information.

Response times differ in a way that matters to your support queue. Under the GDPR, you generally answer a request within one month. Under the CCPA, the usual window is 45 days, with a possible extension. Build to the shorter clock and you meet both.

Definitions and scope of data

The GDPR protects “personal data” about an identified or identifiable person. The CCPA protects “personal information,” and its definition reaches household and device-level data too. For a security vendor that logs endpoint telemetry, IP addresses and device identifiers, both definitions will probably catch your logs.

The CCPA also contains a concept the GDPR does not: “selling” and “sharing.” Sharing covers cross-context behavioral advertising even when no money changes hands. If your product ships data to analytics or ad vendors, this is where California exposure usually sits.

Processors and contracts

Both regimes expect written contracts with vendors that handle personal data for you. The GDPR calls them processors and sets out required terms in Article 28. California uses “service providers” and “contractors” and requires specific contract terms for the same purpose. One well-drafted data processing addendum can cover both if you plan for the vocabulary differences up front.

Enforcement and penalties

Enforcement is where the two models look most different.

GDPR. National authorities enforce the law. As the European Data Protection Board explains, each EEA country has its own independent authority. For cross-border processing, a lead authority handles the case through the one-stop-shop, so a company established in the EU mostly deals with one regulator. Fines come in two tiers: up to €10 million or 2% of worldwide annual turnover for lesser infringements, and up to €20 million or 4% for serious ones such as unlawful processing or violating individuals’ rights, as set out in Article 83 of the regulation.

CCPA. The California Privacy Protection Agency and the Attorney General enforce it. Statutory penalties are $2,500 per unintentional violation and $7,500 per intentional violation, or any violation involving a consumer under 16, adjusted for inflation. Because penalties count per violation, a flaw affecting many consumers multiplies fast. Consumers can sue directly only for certain data breaches, with statutory damages of $100 to $750 per consumer per incident or actual damages, whichever is greater.

So which is more expensive? The GDPR has the higher ceiling. The CCPA can still hurt, because per-violation math and breach class actions scale with your user count. Neither is a safe bet for a startup that treats compliance as a later problem.

There is also an operational difference. Inside the EU you can often work with one lead regulator. In the US, a California program does not give you anything for Virginia, Colorado or the other states with their own privacy statutes. That fragmentation is a real cost for foreign startups entering the American market.

What changed in 2026: automated decisions and risk assessments

For AI founders, the most important California development is not the CCPA’s original text. It is the regulations on automated decisionmaking technology (ADMT) and risk assessments. The California Privacy Protection Agency points to the 2026 effective date for these rules, and the Attorney General’s page notes expanded enforcement and phased deadlines. In practice, businesses using ADMT for significant decisions must be ready with pre-use notices and opt-out rights, and must run risk assessments for higher-risk processing.

The GDPR has long had Article 22 on decisions based solely on automated processing, and the EU AI Act adds product-level obligations on top. The direction is the same on both sides: you need to show how a system reached a decision, not only claim that it is fair.

That is a documentation problem as much as a legal one. If a regulator, enterprise customer or court asks why your model flagged a user, can you reconstruct it? We cover this in our piece on EU AI Act compliance and traceable evidence and in our explainer on decision receipts.

A practical plan if you sell in both markets

You do not need two compliance programs. You need one foundation and two front ends.

1. Map your data. List what you collect, where it is stored, who receives it and why. Both laws start here, and so will every enterprise security questionnaire.
2. Assign a basis for each purpose. For EU data, write down the GDPR basis per purpose. For California, confirm your notice at collection lists categories and purposes.
3. Split consent from opt-out in the interface. Use opt-in where the GDPR requires consent. Add a clear “Do Not Sell or Share” mechanism and honor opt-out preference signals for California.
4. Standardize request handling. One intake, one identity check, one deletion workflow. Set the internal deadline to the shorter clock.
5. Paper your vendors. One data processing addendum with GDPR and California terms, signed before data flows.
6. Log decisions and access. Keep tamper-evident records of automated decisions, data access and deletions. This helps with audits, breach response and sales.
7. Reassess on a calendar. California’s thresholds adjust for inflation, and the ADMT rules phase in over several years.

For the EU side in more depth, see our GDPR compliance plan for SaaS startups. If you are a foreign company heading to the US, our US compliance checklist for foreign cybersecurity startups covers the wider picture beyond California.

Our perspective

Most comparison pages treat GDPR and CCPA as a legal trivia contest. Founders live with them as a sales problem. A buyer in Frankfurt or San Francisco does not ask which statute is stricter. They ask whether they can trust your product with their data and whether you can prove what it did.

We built Cybertech Acceleration around digital forensics for that reason. In a crowded security and AI market, claims are cheap and evidence is rare. A startup that can show a verifiable record of how data was handled and how a decision was made answers a GDPR access request, a California audit and a procurement review with the same artifact.

Our advice is to design the evidence trail before you design the banner. Cookie wording is easy to change later. A product that cannot reconstruct its own behavior is much harder to fix once customers depend on it. And it is far easier to explain to an investor or a buyer when the technical story and the compliance story are one story.

— Thiago Vieira

FAQ

What are the main differences between GDPR and CCPA?

The GDPR requires a legal basis before any personal data processing and applies to anyone targeting or monitoring people in the EU. The CCPA centers on notice, access, deletion and opt-out, and applies to for-profit businesses that meet a revenue, volume or data-sale threshold. Penalties, regulators and consent models differ as well.

Does the CCPA apply to my startup if I am not based in California?

Possibly. Location does not decide it. If you are a for-profit business that meets one of the thresholds and handle personal information of California residents, the law can apply to you. A company with under $26.625 million in revenue can still qualify by handling data from 100,000 or more California residents or households.

If I comply with the GDPR, am I covered for the CCPA?

Not fully. Much of your groundwork carries over: data mapping, rights handling and vendor contracts. But California requires specific disclosures, a “Do Not Sell or Share” mechanism, and ADMT notices and opt-outs that a GDPR program will not automatically include. Treat the GDPR as a strong head start, not a finish line.

Which law has bigger fines?

The GDPR has the higher ceiling, at up to €20 million or 4% of worldwide annual turnover. The CCPA sets penalties per violation, so costs grow with the number of affected consumers, and certain data breaches also allow private lawsuits. For a small company, either can be serious.

Do these laws apply to AI products?

Yes. Both cover personal data used to train or run AI systems. The GDPR has Article 22 on solely automated decisions, and California’s ADMT rules add pre-use notice and opt-out for covered uses. If you build AI, document your data sources and decision logic from the start.

Sources

• Official Journal of the European Union
• California Privacy Protection Agency
• California Attorney General
• European Data Protection Board
• $2,500 per unintentional violation and $7,500 per intentional violation

Recommended

• GDPR for SaaS Startups: A Practical Compliance Plan