Because you operate U.S., GDPR applies only if you process EU data subjects’ info for goods, services, or monitoring, even without a physical presence. CCA triggers when you collect California residents’ PII and meet any of: $25 M revenue or 50 000 records. GDPR demands consent, lawful bases, and pseudonymisation. CCA requires a ‘Do Not Sell’ and deletion rights. Compliance overlaps, so align your privacy notices, data flows, and vendor contracts accordingly. Discover further details in the following guide.

Key Takeaways

• Jurisdiction: GDPR applies to any U.S. processing of EU data subjects, regardless of physical presence; CCPA applies only to California residents when revenue or data‑sale thresholds are met.
• Scope of Personal Data: GDPR limits personal data to identifiers that enable re‑identification (e.g., name, IP, biometric), while CCPA covers household IDs, aggregated device data, and treats households as units.
• Notice & Choice: GDPR requires explicit consent for sensitive data and easy withdrawal; CCPA mandates a visible Do‑Not‑Sell link, instant opt‑out, and a 12‑month re‑opt restriction.
• Data Transfer & Contracts: GDPR forbids cross‑border transfers without safeguards, requiring processors to follow controller instructions; CCPA obligates service providers to prohibit selling or secondary use of consumer data.
• Deletion, Retention & Enforcement: GDPR gives erasure rights with no internal‑use exception; CCPA permits deletion except for legal needs, imposing fines up to $7,500 per violation, while GDPR can reach €20 M.

Which Law Applies to Your Business?

Which law applies to your business? Evaluate both territorial and revenue thresholds to determine the applicable regulation. Under GDPR, a U.S. company falls under its scope if it processes EU data subjects’ information in connection with offering goods or services, or monitoring behavior—regardless of physical presence. CCPA, on the other hand, triggers when you collect California residents’ personal information and meet at least one of three triggers: annual gross revenue exceeding $25 million; buying, receiving, or selling personal information of 50,000+ consumers, households, or devices; or deriving 50% or more of revenue from selling personal information. Your business scope should hence include all customers and data flows in both jurisdictions. If you process data for California residents and EU subjects simultaneously, you may be subject to both laws. Conduct an Audit Criteria review of revenue, consumer count, and data‑processing activities to confirm compliance requirements, and keep records updated annually.

What Constitutes Personal Data Under CCPA & GDPR?

What does each law regard as personal data, and why does that distinction shape your compliance strategy? Under GDPR, personal data covers any identifier—name, IP, hashed email—if the person can be reasonably re‑identified; biometric data and sensitive categories receive heightened protection. The CCPA defines personal information more broadly, including household identifiers, commercial activity, and even aggregated device data that could be linked to a consumer. Because the CCPA treats households as a unit, you must assess shared device usage and apply privacy controls at the household level. Data Anonymisation mitigates risk under both regimes, but only when re‑identification is infeasible. Biometric Classification triggers stricter obligations in each GDPR’s special categories and in the CCPA’s explicit biometric clause. Consequently, your strategy must:

Personal data rules differ: GDPR focuses on re‑identifiability, CCPA covers households; thus strategies separate by identifier focus and biometric safeguards.

• Map identifiers precisely, distinguishing individuals from households.
• Apply pseudonymisation only where re‑identification is impracticable.
• Enforce biometric safeguards per the stricter regime to guarantee compliance.

Who Is Allowed to “Sell” or Process Data?

The distinction between who may “sell” data under the CCPA and who may “process” it under the GDPR revolves around quantitative thresholds, contractual obligations, and the parties’ legal roles.

As a U.S. company, you’ve got to check if you hit CCPA thresholds. If you do, you’ll owe opt‑out notices and must honour opt‑outs for downstream recipients, including those in cross‑border transfer. Service providers need contracts that forbid selling and limit secondary use; otherwise the sale triggers liability, exposing you to processor liability. Under GDPR, only controllers with a lawful basis may process; processors must follow documented instructions and get authorisation before sub‑processing. Ignoring these rules risks impact enforcement, fines, and reputational damage.

Consent, Notice, and Opt‑Out: A Side‑by‑Side Rights Map

Having clarified who may sell or process data, you now need to focus on how each regulation mandates consent, notice, and opt‑out. Under CCPA, you must provide a “Do Not Sell or Share My Personal Information” link and allow consumers to opt‑out of sales or sharing immediately, with a 12‑month restriction on re‑requesting consent. GDPR requires you to obtain explicit, unbundled consent for most processing, especially sensitive data, and to give users an easy way to withdraw. Notice requirements differ sharply: CCPA demands a brief notice at collection, while GDPR mandates layered, detailed privacy statements that cover lawful basis, retention, and transfers. You must also guarantee that your global signals are recognized universally, and that consent is tracked and auditable across all platforms.

• Clear opt‑out mechanisms and global signals like the Global Privacy Control.
• Separate, granular consent models for marketing and profiling.
• Prompt withdrawal processes that match the original consent setting.

Delete, Retain, and Keep: How CCPA & GDPR Compare

Although both frameworks grant deletion rights, they differ markedly in scope and exception. You can delete a consumer’s personal information under the CCPA when you receive a verified request, but only if the data is not needed for completing a transaction, detecting a security incident, or meeting legal requirements. GDPR’s right to erasure is broader: you must erase data when it is no longer necessary, consent is withdrawn, or processing is unlawful, and you cannot retain it for public‑interest, scientific, or historical purposes. Both laws allow indefinite storage of truly anonymised data. Your deletion policies must hence address the CCPA’s “internal use” carve‑out—retention is permissible if it aligns with consumer expectations—whereas GDPR has no such exception and enforces strict storage‑limitation requirements. In building retention frameworks, you should document each purpose, align it with statutory limits, and regularly review whether data can be kept or should be deleted today.

What You Must Do: Notices, Request Paths, & Timelines

You must guarantee that your privacy notices meet the granular disclosure obligations of both CCPA and GDPR before collecting personal data. Your notices must list categories of personal information, sources, business purposes, and any third parties, and for GDPR include controller identity, legal basis, retention periods, and automated decision flags. Additionally, place a “Do Not Sell or Share My Personal Information” link on the homepage and a “Limit the Use of My Sensitive Personal Information” link.

• Request Channels: provide a toll‑free number and a website address (or email if online only) and guarantee accessibility for disabled users.
• Timeline Management: acknowledge within 10 business days, deliver substantive response within 45 calendar days (extendable to 90); note GDPR’s 30‑day rule and optional 3‑month extension for complex cases.
• Verification: use commercially reasonable two‑data‑point checks per CCPA, or proportionate GDPR methods, and deny only with explanation if verification fails today now.

Fines & Enforcement: The Real‑World Cost of Non‑Compliance

Because penalties can compound rapidly, you need to understand how each agency structures fines. Under the CCPA, the California Attorney General can levy up to $7,500 per intentional violation and $2,500 per unintentional violation, with no statutory cap on the total. Your fine exposure scales linearly with the number of consumers affected; a 10‑million‑record breach could trigger $750 million to $7.5 billion in statutory damages. Enforcement costs rise as the AG issues notices, files civil actions, and, in data‑breach cases, faces private claims of $100–$750 per consumer. In contrast, GDPR supervisory authorities can impose administrative fines of €20 million or 4 % of worldwide turnover, whichever is higher. Each infringement may be fined separately, but the cap limits aggregate penalties. Enforcement costs here include investigations, process bans, and remediation, while legal fees reflect the multiplicity of per‑infringement fines. You must budget for both regulatory audits and potential civil litigation expenses, exceedingly soon.

Frequently Asked Questions

Can a U.S. Business Avoid GDPR by Transferring Data to a Non‑Eu Country?

Transferring data to a non‑EU country won’t let you escape GDPR. Even with Data Relocation, a Jurisdiction Shift still subjects you to the regulation: you remain accountable for all GDPR principles, consent, erasure, and substantively equivalent protections. The supervisory authority can pursue fines, and courts may enforce data‑minimization obligations globally. Therefore, mere relocation does not shield you from enforcement within and beyond your data processing ecosystems, confirming continued compliance obligations.

Does CCPA Exempt Small Nonprofits That Process EU Citizens’ Data?

You might think the CCPA blanket exemption for nonprofits sounds like a loophole, but it isn’t. Nonprofit thresholds—$25 million revenue, 50k data sales—apply only to US consumers. EU citizens fall outside that scope. So, if your nonprofit processes EU data, CCPA stays silent, leaving GDPR to kick in. Therefore, the exemption doesn’t cover EU citizens, and you must comply with GDPR—unless your data stays U.S.-bound to avoid future fines audits today.

What Steps Mitigate GDPR Breach Penalties for a U.S. Company?

To reduce GDPR fines, you tighten audit stringency, ensuring thorough documentation of all security controls and breach investigations. You deploy a robust incident response plan that surfaces flaws within 24 hours, registers those actions publicly, and notifies the supervisory authority. You’re showing good faith by engaging your DPO, fixing vulnerabilities, and restoring data from secure backups. Voluntary cooperation and prompt corrective measures often cut penalties by half quickly, swiftly today.

Is the “Right to Be Forgotten” Enforceable in California?

No, California lacks a direct, enforceable right to be forgotten. Under CCPA/CPRA, your deletion requests fall under limited Legal Scope, and Enforcement Mechanisms grant the California Attorney General civil penalties, not a private right of action for erasure failures. The law does not mandate complete data removal beyond exceptions, so you can’t compel full deletion as GDPR does. Instead, you must comply with deletion obligations and respect strict Legal Scope.

Does CCPA Require Granular Consent Recording Like GDPR?

Measure twice, cut once. You’ll find that CCPA does not mandate granular logging the way GDPR does. Instead, it requires you to honor opt‑out requests and retain those records for 24 months, but it doesn’t demand detailed consent traceability for each processing purpose. Your record‑keeping can stay simpler, focusing on consumer requests rather than individual granular consent entries. Maintain compliance by documenting the opt‑out mechanism and verifying consumer acknowledgment.

Conclusion

Imagine your data strategy as a fortress, each gate guarded by the CCPA’s “right to know” and the GDPR’s “data minimisation” mandate. You must lock, look, and let a client look: collect only what you truly need, label it clearly, and honor every opt‑out with the speed of a redact. Fines loom like thunder; comply, lest your reputation crumble into liability, and maintain audit trails, updates, transparency, and accountability, so regulators see you modern sentinel.

James Bateson

Lawyer