GDPR, CCPA and CalOPPA: How to Comply with All Three

Understanding GDPR, CCPA and CalOPPA

Establish coverage before choosing controls. Merely receiving a European visitor does not automatically establish GDPR targeting, and collecting California data does not automatically make every company a CCPA business. Conversely, failing CCPA’s revenue threshold does not establish an exemption from GDPR or CalOPPA.

The three main CCPA qualification routes

• Revenue: annual gross revenues in the preceding calendar year in excess of $26,625,000, using the current adjusted threshold.
• Volume: alone or in combination, annually buying, selling or sharing PI of 100,000 or more consumers or households. This is not simply counting every record collected.
• Revenue share: deriving 50% or more of annual revenues from selling or sharing consumers’ PI.

The California Attorney General’s CCPA guidance explains the rights and scope. Direct coverage generally excludes nonprofits, but service-provider contracts and other privacy duties can still matter. Assess exemptions by their exact scope: a health or financial activity exemption is not automatically a whole-organisation exemption.

For GDPR-specific operational detail, use our GDPR compliance guide. Keep coverage decisions in writing, including assumptions about audiences, business activity and exemptions.

Why compliance matters: verified figures and charts

Privacy controls affect daily operations: whether an advertising event may fire, whether a vendor may reuse information and whether a team can answer a request on time. Wrong thresholds can produce a false exemption, while the wrong request clock can create avoidable delay. These charts therefore focus on numbers directly supported by official rules.

The CPPA’s monetary adjustment notice sets the revenue threshold at $26,625,000, replacing $25 million from January 1, 2025. Its CCPA regulations effective January 1, 2026 distinguish calendar-day response periods from business-day confirmation and choice-control periods.

Side-by-side comparison of the three laws

Use the table as a scoping tool, then assess each purpose and relationship. A business can be a GDPR processor for one service, a controller for staff records and a California service provider for a customer’s data. Similar terminology does not establish identical roles or permissions.

For example, an online shop may rely on contract to fulfil an EU order, require consent for non-exempt EU advertising trackers, and honour a covered California shopper’s sale/sharing opt-out. Its CalOPPA policy must accurately describe the information and relevant third-party collection. One checkbox cannot perform all those functions.

Core requirements for compliance

Build a common inventory, policy framework and control system, then add obligations specific to each regime. Treat notices, lawful processing, choices, contracts and fulfilment as connected tasks with an owner and evidence.

Privacy policies and collection notices

Make policies readable, accessible and easy to find across desktop, mobile and collection flows. Layer brief contextual notices with full details; a footer link alone does not fulfil every collection-point duty. Our privacy policy contents guide helps structure the document.

Lawful purposes, minimisation and retention

GDPR requires a valid Article 6 basis for each purpose. Consent, contract, legal obligation, vital interests, public task and legitimate interests have different conditions; explicit consent is not universally required. Special-category information needs an Article 9 condition in addition to an Article 6 basis. Document necessity and purpose-specific retention, and apply privacy by design and default.

California also limits collection, use, retention and sharing to reasonably necessary and proportionate purposes consistent with the collection context or another disclosed compatible purpose. Assess incompatible new uses and any required consent. A broad “improve our services” clause is not unlimited permission to reuse information.

Consent, sale/sharing opt-outs and signals

For EU/EEA cookies or device access, assess national ePrivacy rules as well as GDPR: non-exempt tracking generally requires valid consent before activation. Keep purposes clear, avoid preselected optional categories and make withdrawal as easy as consent. GDPR consent does not require a handwritten or signed statement in every case, but must meet its legal standard.

Under CCPA, a sale can involve money or other valuable consideration. “Sharing” covers cross-context behavioural advertising, whether or not money changes hands. Inventory ad pixels, audience uploads, SDKs and server-side disclosures. Implement required “Do Not Sell or Share My Personal Information” controls, or a permitted alternative that meets all relevant conditions, and honour qualifying opt-out preference signals such as Global Privacy Control (GPC).

For known consumers under 16, sale/sharing requires affirmative authorisation: a parent or guardian for under-13s and the consumer for ages 13–15. GDPR’s consent-age rule for information society services is a separate test, with a default of 16 and Member State reductions permitted to 13. Assess other children’s privacy laws independently.

Use cookie consent best practices to test the controls, and include SDK and in-app flows in your mobile app privacy review. Rejecting optional cookies and opting out of sale/sharing must cause the relevant downstream behaviour to stop.

Individual rights and response deadlines

Create a request workflow that recognises the applicable law, request type and identity requirements. Do not force California sale/sharing opt-outs through the identity verification used for access to sensitive records. Provide accessible methods, support authorised agents under the applicable rules and record decisions on exceptions.

Deletion is not unconditional under either comprehensive law. Retain only the information justified by an applicable exception, explain the decision and restrict unrelated reuse. Inform relevant processors, service providers and recipients as required. Keep protected suppression records where necessary so a deleted marketing profile is not recreated by the next upload.

Track the deadline from the request’s actual receipt, not when a staff member later opens a ticket. Keep search scope, verification, response contents, exceptions and extension notices. GDPR requests are normally free; California request fees or refusals are subject to specific manifestly unfounded/excessive standards rather than general inconvenience.

Penalties and enforcement

Compare penalty mechanisms rather than placing unlike legal systems on one monetary scale. GDPR can use turnover-based ceilings, CCPA penalties accrue per violation and CalOPPA does not provide a standalone GDPR-style fine schedule. Corrective orders, litigation and business disruption can matter independently of an amount.

Do not describe CalOPPA as having a universal $2,500 fine of its own. Amounts available under a separate enforcement statute depend on that statute and the case. Its 30-day period after notice of failure to post a policy should not be confused with CCPA’s former general cure period, or with any GDPR notification clock.

CCPA’s limited private security-breach action has a separate statutory notice/cure framework for statutory damages; it does not revive an automatic cure entitlement for all enforcement. An incident program must also assess California’s separate breach-notification law. GDPR controllers notify the competent authority without undue delay and, where feasible, within 72 hours of awareness unless the breach is unlikely to create risk, and inform affected people without undue delay where high risk is likely, subject to exceptions.

Best practices for multi-law compliance

Use shared infrastructure with explicit legal mappings. This reduces duplicate work while retaining the rules that differ: GDPR bases and transfer safeguards, California sale/sharing classification and signals, and CalOPPA disclosures. Do not assume a control labelled “GDPR compliant” implements every California requirement.

For contracts, see our data processing agreement guide. A compliant-looking vendor label is not evidence that the recipient meets the legal conditions of a restricted service-provider relationship.

California regulatory dates to plan for

The 2026 CCPA regulations are effective law, but several new duties have later milestones. Assess applicability to each activity before allocating dates. A business subject to risk assessments is not automatically subject to every cybersecurity-audit or ADMT provision.

How the new duties differ

Risk assessments address specified processing that presents significant privacy risk and weigh benefits against risks with documented safeguards. Review covered sale/sharing, sensitive-information processing, significant-decision ADMT, specified extensive profiling and training activities. Assessments for new covered activities must precede initiation; the legacy transition does not authorise delaying new assessments. Review assessments at least every three years and update for material changes as soon as feasible, no later than 45 calendar days. Retain them while processing continues or for five years after assessment completion, whichever is later.

Cybersecurity audits have their own significant-security-risk tests. They include the 50%-or-more sale/sharing revenue route, or the qualifying gross-revenue route combined with processing PI of at least 250,000 consumers or households, or sensitive PI of at least 50,000 consumers, in the preceding calendar year. For covered businesses, first report deadlines depend on the relevant year’s revenue: more than $100m for the April 2028 cohort, $50m–$100m for April 2029, and below $50m for April 2030. The regulations specify the measurement years and audit periods; revenue alone does not establish audit coverage.

ADMT rules concern defined significant decisions, such as access to financial services, housing, education, employment or healthcare. A genuinely empowered human review can affect whether technology replaces or substantially replaces human decisionmaking. A nominal reviewer who simply accepts an output is not enough. Review definitions, permitted exceptions, notices and rights workflows; these rules are not a blanket ban on all analytics or every AI feature.

1. Step 1

   Scope

   Identify covered processing and audit/ADMT triggers.

2. Step 2

   Assess

   Document risks, benefits, safeguards and responsible owners.

3. Step 3

   Implement

   Make required notices, choices and review mechanisms work.

4. Step 4

   Evidence

   Retain assessment and audit records; prepare required submissions.

A GDPR DPIA may support a California risk assessment where it meets the applicable requirements, but keep a mapping of gaps, stakeholders, retention and submission duties. Reuse evidence thoughtfully rather than treating the two exercises as automatically interchangeable.

Implementation checklist

Turn each item into a task with a named owner, evidence location, completion date and change trigger. Prioritise active unlawful disclosures, ineffective opt-outs and exposed information, then close documentation and governance gaps. This is a working checklist rather than a guarantee of compliance for every business.

Common compliance mistakes to avoid

Look for gaps between the policy, the legal test and the technology that handles information. These are practical review scenarios for a multi-region website or app.

Test real journeys: an EU first visit before consent, a California visitor with GPC enabled, an opt-out made while logged in and a correction request involving a vendor-held record. Record what the systems actually transmit and retain, fix failures and repeat the affected checks.

Frequently asked questions

Your next steps for multi-law compliance

Begin with coverage and data mapping, then connect each purpose to the correct legal requirements. Build an accurate policy, put notices at collection points, implement consent and California choices, and make rights workflows and vendor restrictions operate across the entire data lifecycle.

Our Privacy Policy Generator can help create a draft. Review it against your real practices and the applicable regional requirements, then verify the controls it describes. Keep the checklist and supporting evidence current as the business changes.