The California Consumer Privacy Act (CCPA) took effect on January 1, 2020. The California Privacy Rights Act (CPRA) amended it, with its additional rights generally effective from January 1, 2023.
Some privacy experts have drawn comparisons between CCPA and the General Data Protection Regulation (GDPR) — the major EU privacy standard that companies have been working to comply with since it took effect in May of 2018.
The two pieces of legislation, however, aren’t exactly the same, and businesses that handle sensitive customer data should understand the differences between them. While they have similar goals, giving consumers stronger control over how their data is collected and used, the CCPA and GDPR have different requirements. Here is how CCPA is different from GDPR, and what businesses will need to know under the current California framework.
What is the CCPA?
CCPA is California privacy legislation that provides rights for residents and duties for covered businesses. CPRA amendments expanded that framework; assess the current rules rather than relying on the original 2020 requirements alone.
CCPA gives California residents specified rights to know, delete, correct, and opt out of sale or sharing, plus limits on certain sensitive personal information uses. Covered businesses bound by the CCPA must provide the applicable request mechanisms and must not discriminate for exercising protected rights, subject to statutory conditions.
The original Attorney General enforcement date was July 1, 2020. Current obligations include the CPRA amendments and applicable implementing regulations.
The following references describe the original 2020 rulemaking history; they are not a current compliance timetable. At that time, some enforcement details aren’t entirely clear. The article originally discussed draft regulations under review in April 2020. Businesses should use current official guidance for their present obligations.
During the 2020 COVID-19 outbreak, some businesses requested an enforcement delay. The Attorney General announced it would move forward as planned and enforce the law “upon finalizing the rules or [by] July 1, whichever comes first.” The AG also released a statement reminding consumers of their data privacy rights during that period. These announcements describe the original rollout, not the current enforcement position.
GDPR vs. CCPA
GDPR has applied since May 25, 2018. Its scope is determined by establishment and specified processing involving people in the EU, rather than citizenship alone. CCPA protects California residents under its own business and information scope.
Under GDPR, organizations must identify an applicable lawful basis for processing. Consent is one of six bases, alongside contract, legal obligation, vital interests, public task, and legitimate interests. CCPA uses a different framework of notices, rights, restrictions, and exceptions.
CCPA expressly covers personal information linked to a person or household. GDPR concerns identified or identifiable natural persons; household information may be personal data when it identifies a person. The exact definitions and exclusions must be assessed for the processing in question.
CCPA does not permit unrestricted data use merely because a person has not opted out. Covered businesses must meet applicable notices, rights, use restrictions, and other duties. GDPR limits the situations and requires an appropriate lawful basis. Consent is not mandatory for every processing activity, and both laws have conditions and exceptions that must be assessed separately.
CCPA deletion and GDPR erasure rights share an objective, but their conditions and exceptions differ. Legal retention duties and other valid exceptions can limit deletion; do not treat either right as unconditional.
If you want a more specific break-down of how GDPR and CCPA differ and overlap, the Future of Privacy Forum has authored a 27-page comparison of the two laws that covers almost every nuance and subtle difference.
Why Your Business Needs to Know the Difference
Because GDPR and CCPA differ in some aspects, complying with one doesn’t necessarily mean you’re in compliance with the other. Your business, if it holds on to customers’ data, will likely need to take steps to comply with CCPA, even if it’s already GDPR-compliant. Businesses operating in certain sectors will likely need to make the biggest changes to stay compliant and avoid the potential consequences.
Companies that provide cloud document management will need to create systems that allow users to exercise their CCPA rights. If yours collects user data, you should already be figuring out how to store it so you can correctly inform users what you have. And remember: Clients are allowed to delete that data, if necessary.
CCPA applies to covered for-profit businesses that do business in California and meet a statutory condition involving the applicable adjusted revenue threshold, the buying, selling, or sharing of information about 100,000 or more consumers or households, or deriving at least half of annual revenue from selling or sharing personal information. Check the current thresholds and exemptions. GDPR scope is not determined solely by business size or customer location.
What Businesses Should Know About GDPR and CCPA Compliance
Businesses within CCPA scope must implement the applicable California rights and duties. Organizations also within GDPR scope need to assess both frameworks; meeting one does not establish compliance with the other.
Assess each law’s territorial scope, information definitions, lawful processing conditions, notices, rights, and exceptions. Document the resulting controls and responsibilities rather than assuming that one consent or opt-out model covers both.
Strengthen Your Compliance Management with AODocs
AODocs is a content services platform designed to modernize the way businesses work, offering a low code environment to build content-rich applications, powerful automation and workflows, and business applications with comprehensive security and compliance capabilities.
Frequently asked questions
Does the CCPA only apply to California?
The CCPA protects California residents, but a covered business does not have to be based in California. Its application depends on doing business in California and meeting the law's applicable conditions, thresholds, and exemptions. An organization with both EU and California activities should assess GDPR and CCPA separately; compliance with one does not establish compliance with the other.
Does GDPR always require consent before personal data is processed?
No. GDPR provides six lawful bases for processing, including consent, contract necessity, legal obligation, vital interests, public task, and legitimate interests. The appropriate basis depends on the activity and its conditions. Consent is not a universal substitute for that assessment, and separate rules can apply to special-category data or communications.
Did CPRA replace CCPA with a separate law?
No. CPRA amended the CCPA and added protections that began on January 1, 2023, including rights to correct inaccurate information and limit certain uses of sensitive personal information. Refer to the CCPA as amended when reviewing current obligations, including applicable exemptions and the conditions for exercising each right.
Must every personal-data record be deleted when a person asks?
No. Privacy deletion rights have conditions and exceptions, including situations where records must be kept for legal obligations. Review the request against the applicable law and retention basis, restrict unnecessary use, and document the decision. A document-management process should distinguish records eligible for deletion from records still subject to a valid retention requirement.
