What is the difference between CCPA and GDPR?

CCPA/CPRA and GDPR share common goals but differ significantly in scope, legal mechanism, and enforcement.

Scope: GDPR applies to any organization worldwide processing personal data of EU residents, with limited exceptions. CCPA applies only to for-profit businesses meeting at least one of three thresholds: annual gross revenue over $25 million, buying or selling personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling personal information.

Consent model: GDPR requires a documented legal basis (consent, contract, legitimate interest, legal obligation, vital interests, or public task) for every processing activity. CCPA operates on an opt-out model - organizations may collect and use personal information unless consumers exercise their right to opt out of sale or sharing. CPRA added opt-in consent requirements for minors and for Sensitive Personal Information.

Rights: Both provide rights to access, deletion, and correction. CPRA added a right to correct inaccurate information. GDPR also provides rights to data portability and to object to automated processing.

Penalties: GDPR penalties can reach 20 million euros or 4% of global annual turnover, whichever is higher. CCPA civil penalties are $2,500 per unintentional violation and $7,500 per intentional violation.

For organizations subject to both laws, compliance programs should be designed to meet GDPR's stricter requirements where they overlap, which typically brings CCPA compliance along with it.