CCPA vs GDPR: what each law asks your website to do

Are CCPA and GDPR the same kind of law?

No, though most teams treat them as regional versions of the same cookie banner. They swap the copy, flip a geo toggle, and ship. It’s an understandable instinct, but it’s wrong, because the two regimes start from opposite defaults and the rest of the design follows from that. GDPR asks permission before anything happens. CCPA assumes things are already happening and requires you to say so clearly and give people a working way out.

GDPR, read together with the ePrivacy Directive, is a prior opt-in regime. Non-essential storage and tracking have to wait until a user actively agrees. CCPA, as amended by CPRA, is an opt-out regime. It isn’t a consent law, and calling its interface a consent banner misdescribes what it requires. Californians get notice, a way to opt out, and a browser signal that has to be respected.

That difference affects everything after it: what loads on first paint, what the buttons say, what counts as proof afterward, and what a mistake looks like to a regulator. If you build one interface and apply it everywhere, you’ll get at least one jurisdiction wrong, and often both, in opposite directions and for opposite reasons.

What does California ask a site for?

California doesn’t require you to ask permission first. It requires you to tell people what you’re doing and to make opting out easy. Under the CCPA as amended, a business that sells or shares personal information owes visitors three concrete things, listed below, and none of them is a pop-up demanding agreement before the page renders.

The enforcement cases have been about mechanics. Sephora paid $1.2 million in 2022 for ignoring Global Privacy Control. Honda paid $632,500 in 2025 over opt-out flows that demanded more from users than opting in did. Healthline paid $1.55 million in 2025 for continuing to share after opt-out. Todd Snyder paid $345,178 in 2025 after a misconfigured banner left opt-out requests unprocessed.

California also isn’t the only state to think about anymore. As of 2026, nineteen or more comprehensive state privacy laws are in force, with Indiana, Kentucky and Rhode Island among the recent additions, and twelve states require businesses to honor universal opt-out signals like GPC. Maryland bans the sale of sensitive data outright. This is background and isn’t legal advice, so ask your counsel which of these reach your business.

• Notice at collection, given at or before the moment data is gathered
• A plain "Do Not Sell or Share My Personal Information" mechanism
• Global Privacy Control honored automatically, with no click from the visitor

What the EEA and UK require

In the EEA and the UK, the order is fixed. Nothing non-essential runs before consent, and that covers analytics, pixels, and the A/B testing script someone added last quarter. Reject must be as easy as accept. That equal-prominence expectation comes from regulator guidance and EDPB opinion, and it isn’t in the GDPR text itself. Withdrawing consent has to be as simple as granting it.

You also need proof. Article 7(1) requires you to be able to demonstrate that consent was given, so you need records of who consented, when, under which banner, and for which purposes. Separately, Google Consent Mode v2 has been required since March 2024 for Google advertising and measurement features covering EEA and UK users. It carries four signals: ad_storage, analytics_storage, ad_user_data and ad_personalization.

The UK now has its own rules: UK GDPR plus PECR, enforced by the ICO, and diverging further under the Data (Use and Access) Act 2025. That Act raises PECR penalties to UK GDPR levels, so you can no longer assume British cookie enforcement is the cheap one to get wrong. Treat all of this as orientation, and don’t take it as advice for your specific stack.

The accept-gate problem in California

Plenty of teams handle this by showing the strictest banner to everyone. That looks conservative, but it has its own risks. An accept-or-reject gate tells a California visitor that their answer controls what happens next. If your tags fire regardless, or the sale of personal information continues because the gate was never wired to that decision, the banner is promising something your backend doesn’t do.

That’s a deception problem, and the Todd Snyder matter looked much like it. The banner existed, but the requests went nowhere. A gate can also get in the way of what California requires. Notice at collection gets buried behind a modal, the do-not-sell-or-share link goes missing, and GPC gets treated as one input among many when it’s a signal that has to be honored. You can still use opt-in for US visitors, as long as those three things keep working.

The opposite mistake fails right away. A US-style notice with a discreet opt-out link, served in Berlin or Manchester, misses the first requirement, because things have already run. No wording turns after-the-fact notice into prior consent, and no geo edge case makes the order optional. None of this is legal advice, but the order isn’t what regulators argue about.

Running both jobs from one platform

What works is one system with two behaviors, chosen by country. In the EEA and UK, that means a gate with equal-weight buttons and granular purposes, and nothing firing before a choice. In the US, an opt-out setup means notice at collection, a visible do-not-sell-or-share path, and GPC respected without asking the visitor to interact with anything at all.

UserGuard is designed to work this way. The banner adapts by country, and inside the US every visitor gets the consent model you set, so choose the one your strictest state needs. UK visitors get prior consent by default, and we track the UK rules as they change. It’s also designed to honor GPC without asking and to emit the four Consent Mode v2 signals. Consent events are tied to site, banner version, region and timestamp, and export to CSV, which is what you need for a demonstrate-consent conversation. UserGuard is newly launched, so all of this describes how the product is designed, and we don’t have a long track record yet.

The scanner applies an evidence gate, so something is called a cookie only when there’s a Set-Cookie header, an HTTP-only record, or a document.cookie value. Everything else is kept and labeled as context, which keeps guesses out of your inventory. UserGuard isn’t a Google-certified CMP and isn’t IAB TCF validated. TCF is on the roadmap, and that’s as far as it’s gone.

It costs $10 per site per month with automatic volume discounts (current rates), and every tier has every feature. GPC and geo-targeting are never paywalled, because we don’t think the pieces regulators care about most should sit behind an upgrade. The accessibility widget is included per site, with WCAG 2.1 AA as the working benchmark, though no widget makes a site ADA compliant.

Go deeper: CCPA + US state laws · GDPR + ePrivacy