CCPA vs GDPR: two different jobs, not two banners

Opposite defaults, not regional dialects

Most teams treat CCPA and GDPR as regional dialects of the same cookie banner. Swap the copy, flip a geo toggle, ship. That instinct is understandable and wrong. The two regimes start from opposite defaults, and the default is the whole design. One asks permission before anything happens. The other assumes things are happening and demands you say so, plainly, and provide a working exit.

GDPR, read together with the ePrivacy Directive, is a prior opt-in regime. Non-essential storage and tracking wait until a user actively agrees. CCPA, as amended by CPRA, is an opt-out regime. It is not a consent law, and calling its interface a consent banner mangles what it actually requires. Californians get notice, a route out, and a browser signal that has to be respected.

That difference cascades. It changes what loads on first paint, what the buttons say, what counts as proof afterward, and what a mistake looks like to a regulator. Build one interface, apply it everywhere, and you will get at least one jurisdiction wrong — often both, in opposite directions, for opposite reasons.

What California actually asks a site for

California does not require you to ask first. It requires you to be honest and to make leaving easy. Under the CCPA as amended, a business that sells or shares personal information owes visitors three concrete things, and none of them is a pop-up demanding agreement before the page renders.

The enforcement record is mechanical, not philosophical. Sephora paid $1.2 million in 2022 for ignoring Global Privacy Control. Honda paid $632,500 in 2025 over opt-out flows that demanded more from users than opting in did. Healthline paid $1.55 million in 2025 for continuing to share after opt-out. Todd Snyder paid $345,178 in 2025 after a misconfigured banner left opt-out requests unprocessed.

California is also no longer the whole story. As of 2026, nineteen or more comprehensive state privacy laws are in force, with Indiana, Kentucky and Rhode Island among the recent additions, and twelve states requiring businesses to honor universal opt-out signals like GPC. Maryland bans the sale of sensitive data outright. This is background rather than legal advice; your counsel decides which of these actually reach your business.

• Notice at collection, given at or before the moment data is gathered
• A plain "Do Not Sell or Share My Personal Information" mechanism
• Global Privacy Control honored automatically, with no click from the visitor

Prior consent, then proof, then the UK

In the EEA and the UK, the sequence is fixed. Nothing non-essential runs before consent, not analytics, not pixels, not the A/B testing script someone added last quarter. Reject must be as easy as accept; that equal-prominence expectation comes from regulator guidance and EDPB opinion rather than the GDPR text itself. Withdrawing consent has to be as simple as granting it.

Then there is proof. Article 7(1) requires you to be able to demonstrate that consent was given, which means records, not recollection: who, when, under which banner, for which purposes. Separately, Google Consent Mode v2 has been required since March 2024 for Google advertising and measurement features covering EEA and UK users, carrying four signals — ad_storage, analytics_storage, ad_user_data and ad_personalization.

The UK now runs on its own track: UK GDPR plus PECR, enforced by the ICO, diverging further under the Data (Use and Access) Act 2025. That Act raises PECR penalties to UK GDPR levels, which quietly removes the old comfort that British cookie enforcement was the cheap one to get wrong. Treat all of this as orientation rather than advice for your specific stack.

The accept-gate problem in California

Plenty of teams solve this by pointing the strictest banner at everyone. It looks conservative. It is not neutral. An accept-or-reject gate tells a California visitor that their answer controls what happens next. If your tags fire regardless, or the sale of personal information continues because the gate was never wired to that decision, the interface is making a promise the backend does not keep.

That is a deception problem wearing a privacy costume, and it is the shape of the Todd Snyder matter: the banner existed, the requests went nowhere. A gate can also swallow the things California actually mandates. Notice at collection gets buried behind a modal, the do-not-sell-or-share link goes missing, and GPC gets treated as one input among many rather than a signal that has to be honored.

The mirror-image mistake is less interesting because it fails immediately. A US-style notice with a discreet opt-out link, served in Berlin or Manchester, misses the first requirement: things already ran. No wording converts after-the-fact notice into prior consent, and no geo edge case makes the sequence optional. None of this is legal advice, but the ordering is not the part regulators argue about.

Running both jobs from one platform

The workable answer is two behaviors from one system, chosen by region. In the EEA and UK: a real gate, equal-weight buttons, granular purposes, nothing firing before a choice. In the US: notice at collection, a visible do-not-sell-or-share path, and GPC respected silently, without asking the visitor to interact with anything at all.

UserGuard is built around that split. It is designed to serve region-appropriate behavior, honor GPC without asking, and emit the four Consent Mode v2 signals. Consent events are tied to site, banner version, region and timestamp, and export to CSV, which is what a demonstrate-consent conversation actually needs. UserGuard is newly launched, so that describes how the product is designed rather than a long track record.

The scanner applies an evidence gate: something is called a cookie only when there is a Set-Cookie header, an HTTP-only record, or a document.cookie value. Everything else is kept and labeled as context, so your inventory is not padded with guesses. UserGuard is not a Google-certified CMP and is not IAB TCF validated; TCF is on the roadmap, nothing more.

Pricing is $10 per site per month with automatic volume discounts (current rates), and every feature is on every tier. GPC and geo-targeting are never paywalled; the pieces regulators care about most should not sit behind an upgrade. The accessibility widget is included per site, with WCAG 2.1 AA as the working benchmark, though no widget makes a site ADA compliant.

Go deeper: CCPA + US state laws · GDPR + ePrivacy