GDPR vs CCPA Cookie Consent Requirements Explained

If you've ever tried to build one cookie banner that satisfies both European and Californian regulators, you've probably run into the same wall: the two laws don't just have different rules, they run on opposite defaults. GDPR assumes cookies are off until a visitor says yes. CCPA (as amended by the CPRA) assumes cookies are on until a visitor says no.

That single difference cascades into almost everything else, banner copy, button design, what counts as a valid consent record, even what "consent" means as a legal concept. This guide walks through where the two laws agree, where they genuinely conflict, and what that means for a site that has to comply with both at once.

The core difference: opt-in vs opt-out

GDPR (the EU's General Data Protection Regulation) treats consent as a gate. Under Article 6 and the ePrivacy Directive that specifically governs cookies, a site cannot set non-essential cookies, analytics, advertising, personalization trackers, until a visitor has given clear, affirmative consent. No pre-ticked boxes, no cookies firing on page load "just in case," no consent implied by continued browsing. The visitor has to take a positive action, and that action has to happen before the cookie is set, not after.

CCPA, and its 2023 update the CPRA, works the other way. California does not require a business to ask permission before collecting personal information or using tracking cookies. Instead, it gives consumers a right to opt out, specifically, a right to opt out of the "sale" or "sharing" of their personal information. A business's obligation is to make that opt-out easy to find and honor it once exercised, not to pause data collection until someone opts in.

This is the single fact that determines almost every other design decision in this guide. A GDPR-compliant banner has to block cookies by default and wait for a yes. A CCPA-compliant site can run its cookies from the first page load, as long as a clear "Do Not Sell or Share My Personal Information" link (or equivalent opt-out mechanism) is available and functional.

Who each law actually covers

GDPR applies based on whose data you're processing, not where your business is. If you have visitors in the EU or European Economic Area and you're tracking them with cookies or collecting their personal data, GDPR can apply to you even if your company has no physical presence in Europe. There's no revenue threshold or user-count minimum, one EU visitor whose data you process is, in principle, enough to bring you into scope.

CCPA/CPRA works differently: it applies based on business size and California connection, not simply "do you have a California visitor." Under the CPRA, a business generally falls under the law if it does business in California and meets at least one of these thresholds: annual gross revenue over $25 million, buys/sells/shares the personal information of 100,000 or more California consumers or households, or derives 50% or more of annual revenue from selling or sharing personal information. Small sites with modest traffic can fall outside CCPA's scope entirely, something that essentially never happens under GDPR's much lower bar.

The practical upshot: a small blog with EU readers can find itself needing GDPR-style consent while comfortably sitting below every CCPA threshold. A large, purely US-focused e-commerce brand can be squarely inside CCPA's scope while never touching GDPR at all. Businesses serving both audiences, which describes most sites with any real traffic, usually need to plan for both.

Cookie banner requirements, side by side

A few of those rows deserve more context than a table cell allows.

Pre-ticked boxes. GDPR guidance from European regulators (and the CJEU's Planet49 ruling) has been consistent: a checkbox that's already ticked doesn't count as consent, because consent has to be an affirmative, unambiguous action. CCPA doesn't have an equivalent concept, since it isn't asking for permission in the first place, so "pre-ticked" isn't a meaningful violation category there.

Global Privacy Control. This is one of the more concrete, mechanical differences. The CPRA and its regulations require covered businesses to treat the GPC browser signal, a setting a visitor can turn on once in their browser or extension, as a valid, universal opt-out request. If GPC is on and your site is in scope, you're expected to honor it as if the visitor had clicked your opt-out link manually, without asking them to do anything else. GDPR doesn't name GPC specifically, though nothing stops a EU-focused site from choosing to respect it as a courtesy.

Penalties. GDPR's fines are famously large in the abstract (up to 20 million euros or 4% of a company's total global annual revenue, whichever is higher), but in practice enforcement against small businesses over cookie banners specifically has usually meant warnings and correction orders rather than maximum fines. CCPA/CPRA penalties are smaller per violation but apply per consumer, per incident, which can add up quickly for a business handling data at scale, and enforcement has been increasingly active since the California Privacy Protection Agency became fully operational.

The nuance neither side of this comparison should skip

Two areas of both laws are genuinely disputed or evolving, and it would be inaccurate to present them as settled.

The first is what counts as a "sale" or "sharing" under CCPA/CPRA. The statute's definition is broad enough that many businesses were surprised to learn that using standard advertising and analytics tools, ones that share visitor identifiers with ad networks or analytics vendors, can qualify as a "sale" or "sharing" even without any money changing hands. Whether a specific third-party script triggers that definition often depends on exactly how data flows to that vendor and under what contract terms, and it's an area where reasonable compliance teams still disagree on edge cases. If your site runs third-party ad or analytics tags, that determination is worth a real legal review rather than a guess.

The second is GDPR's treatment of analytics cookies specifically. Some regulators and practitioners argue that certain analytics cookies, particularly first-party analytics used only for aggregate site improvement, could rely on "legitimate interest" rather than consent as their legal basis, since the ePrivacy Directive's strict consent requirement is generally read as covering all non-essential cookies, analytics included. In practice, most EU data protection authorities have pushed back hard on this argument for standard analytics tools like Google Analytics, treating them as needing consent like any other non-essential cookie. Where a specific analytics setup falls is genuinely contested territory, and blanket claims that "analytics never needs consent under GDPR" should be treated with real skepticism.

What this means if you serve both audiences

Most businesses with meaningful web traffic end up needing to satisfy both models at once, which in practice means building for the stricter one and layering the other's specific requirements on top.

A common, workable pattern: default to GDPR's opt-in behavior everywhere, non-essential cookies stay off until a visitor consents, with an equal-weight Accept/Reject banner. Then, on top of that baseline, add the CCPA-specific pieces GDPR doesn't require: an explicit "Do Not Sell or Share My Personal Information" link, GPC signal detection and honoring, and privacy policy language covering the CCPA-specific consumer rights (know, delete, correct, opt out, limit use of sensitive information). Geolocation or IP-based logic can then serve the appropriate flow, opt-in banner for EU visitors, opt-out link and GPC handling for California visitors, without maintaining two separate codebases.

Whichever approach you take, the requirements above need to actually show up in your privacy policy and cookie policy, not just your banner code. A privacy policy that never mentions the right to opt out of sale/sharing, or a cookie policy silent on how consent is recorded, is an easy thing for a regulator or a plaintiff's attorney to point at.

Our Privacy Policy Generator builds a policy that covers both frameworks, GDPR's legal-basis and data-subject-rights language alongside CCPA/CPRA's consumer-rights and opt-out disclosures, based on the jurisdictions you tell it you operate in. Pair it with our Cookie Policy Generator to document your actual cookie categories and the consent mechanism your banner uses, so the policy and the banner tell the same story.

The information in this article is for informational purposes only and should not be construed as legal advice on any matter, and does not create a lawyer-client relationship.