GDPR fines have reached roughly EUR 7.1 billion since the regulation took effect on 25 May 2018, according to DLA Piper's GDPR Fines and Data Breach Survey, published in January 2026. CCPA, by contrast, has produced roughly $24.9 million in confirmed settlements since California's first case in August 2022, based on PrivacyTerms.io's tracking of publicly disclosed enforcement actions. The two figures are in different currencies and cover different enforcement windows, so the roughly 285x gap is not a precise exchange-rate conversion, but it reflects a real structural difference in how each law is built and enforced.
That structural difference starts with scope. GDPR reaches any organization handling an EU resident's data, anywhere in the world, regardless of size. CCPA only reaches businesses that clear a specific size threshold in California. The rest of this page lays out that scope gap, the consent models, the penalty structures, and the fine totals side by side, in one comparison table.
What is the biggest difference between GDPR and CCPA scope?
GDPR's Article 3 gives it extraterritorial reach: it applies to any controller or processor established in the EU, and separately to any organization outside the EU that offers goods or services to, or monitors the behavior of, people located in the EU, no matter where that organization is based or how much revenue it earns. CCPA works the opposite way, starting from a California-specific size test rather than a location test for the business itself.
Figure 1: GDPR sets no minimum revenue for applicability; CCPA sets three. Source: GDPR Article 3, California Civil Code Section 1798.140.
A one-person consultancy in Ohio that emails a handful of clients in Germany falls under GDPR the moment it processes their personal data, the same way a multinational bank does. CCPA does not reach that same consultancy at all unless it separately crosses one of California's three business thresholds: more than $26,625,000 in annual gross revenue, personal data on 100,000 or more California consumers or households in a year, or 50% or more of annual revenue from selling or sharing personal information, according to the California Privacy Protection Agency's current threshold figures, effective 1 January 2025 and next due for a CPI-based adjustment on 1 January 2027. GDPR's uncapped, location-triggered model is unusual even among the 172 countries that now have a national privacy law; most of those laws set some form of size or in-country presence test closer to CCPA's than to GDPR's.
How do GDPR and CCPA rules compare side by side?
The table below lines up the core mechanics of both laws as they stand in 2026. Every figure is drawn from the primary regulatory source for that law, linked in Where the Numbers Come From below.
| Factor | GDPR | CCPA / CPRA |
|---|---|---|
| Effective date | 25 May 2018 | 1 January 2020 (CPRA amendments 1 January 2023) |
| Who it covers | Any organization processing an EU resident's data, any size, any location | For-profit businesses over $26,625,000 in revenue, 100,000+ CA consumers, or 50%+ data-sale revenue |
| Default consent model | Opt-in before most processing | Opt-out; processing allowed by default |
| Maximum penalty | EUR 20 million or 4% of global turnover, whichever is higher | $7,988 per intentional violation, no revenue-based cap |
| Primary enforcement body | National data protection authorities, coordinated by the EDPB | California Privacy Protection Agency and the California Attorney General |
| Cumulative fines to date | Roughly EUR 7.1 billion since 2018 | Roughly $24.9 million since 2022 |
GDPR's penalty cap scales with company size because it is set as a percentage of global turnover. CCPA's penalty cap is a flat dollar figure per violation, which is one reason the two laws produce such different fine totals even before enforcement volume enters the picture.
How much have GDPR and CCPA actually fined companies?
GDPR regulators have brought far more enforcement cases than CCPA regulators, and that case-count gap explains most of the difference in cumulative totals. The CMS Enforcement Tracker Report counted 2,685 confirmed GDPR fines through its March 2026 cutoff, while PrivacyTerms.io's tracking of CCPA settlements counts 13 confirmed cases since Sephora's first CCPA settlement in August 2022.
Figure 2: Confirmed enforcement case counts, GDPR versus CCPA. Source: CMS Enforcement Tracker Report 2026 (cutoff 1 March 2026), PrivacyTerms.io CCPA settlement tracking (through May 2026).
What is less widely reported is that the average confirmed fine per case is much closer between the two laws than the headline totals suggest. GDPR's average confirmed fine is EUR 2.28 million, per the CMS Enforcement Tracker Report 2026. Dividing CCPA's $24.9 million total by its 13 confirmed settlements implies an average of roughly $1.92 million per case, a PrivacyTerms.io calculation rather than a figure any regulator publishes directly.
Figure 3: Average confirmed fine per case, shown in each law's own currency and not exchange-rate adjusted. Source: CMS Enforcement Tracker Report 2026, PrivacyTerms.io CCPA settlement tracking.
The largest individual fines follow the same pattern of scale. GDPR's record fine is EUR 1.2 billion, issued by Ireland's Data Protection Commission against Meta Platforms Ireland Limited in May 2023 over unlawful EU-to-US data transfers. CCPA's record fine is $12.75 million, paid by General Motors and its OnStar connected-car service in a settlement announced 8 May 2026 over selling driver location and behavior data without adequate consent. If your business processes any EU resident's data, even a fraction of the compliance gaps that drove those cases, you can generate a privacy policy covering both GDPR's disclosure requirements and CCPA's opt-out rules in one document.
Which businesses have to comply with each law?
The compliance test each law runs is structurally different, which is why the same business can be squarely covered by one law and entirely outside the other.
Figure 4: The compliance test each law actually runs. Source: GDPR Article 3, California Civil Code Section 1798.140(d).
A small US-only e-commerce store with $2 million in annual revenue and no EU customers clears neither law's test. A German freelancer with three clients clears GDPR's test on day one. A national retailer with $40 million in California sales and no EU presence clears CCPA's revenue threshold but never touches GDPR at all. Most mid-size businesses that sell internationally end up needing to satisfy both tests independently, since crossing one law's threshold has no bearing on the other.
How have GDPR and CCPA evolved since they took effect?
Both laws have kept moving since their original effective dates, through amendments, threshold adjustments, and landmark enforcement actions that reset expectations for what counts as a serious violation.
Figure 5: Key dates and landmark cases under both laws. Source: EUR-Lex GDPR text, California Civil Code, DPC Ireland decisions, CPPA announcements.
CCPA's threshold and penalty figures are not fixed the way GDPR's statutory caps are. The California Privacy Protection Agency adjusts the revenue threshold and both penalty tiers every other year based on the California Consumer Price Index, with the next adjustment due 1 January 2027, so the $26,625,000 and $7,988 figures in this post are current for 2026 but will change again.
GDPR and CCPA are not the only two enforcement models in play. Canada's PIPEDA runs a third approach entirely: its regulator closed 39 well-founded complaints in fiscal 2024-25 without issuing a single fine, because PIPEDA grants no administrative penalty power at all, a structural gap neither GDPR's percentage-of-turnover caps nor CCPA's flat per-violation fines share.
The Bottom Line
GDPR and CCPA solve the same underlying problem, giving people more control over their personal data, with almost opposite mechanics. GDPR sets no size floor and defaults to opt-in consent, which is why its enforcement reaches thousands of cases and a EUR 7.1 billion cumulative total. CCPA sets a specific revenue or data-volume floor and defaults to opt-out, producing a far smaller but still growing enforcement record at roughly $24.9 million and 13 confirmed cases. Neither law is a substitute for the other: a US business with no EU customers can ignore GDPR entirely, and a small EU-facing business can ignore CCPA entirely, but a growing number of businesses now need to satisfy both tests at once, with different consent flows, different disclosure language, and different rights processes for each.
Frequently Asked Questions
What is the biggest difference between GDPR and CCPA? GDPR applies to any organization of any size that processes an EU resident's personal data, with no revenue threshold, while CCPA only applies to for-profit businesses that exceed $26,625,000 in annual revenue, hold personal data on 100,000 or more California consumers or households, or derive 50% or more of revenue from selling or sharing personal information.
How much bigger are GDPR fines than CCPA fines? GDPR fines total roughly EUR 7.1 billion since May 2018, according to DLA Piper's GDPR Fines and Data Breach Survey published in January 2026, versus roughly $24.9 million in confirmed CCPA settlements since August 2022. That gap of about 285 times is driven mainly by case volume, 2,685 confirmed GDPR cases against 13 confirmed CCPA settlements, not by a much higher average penalty per case.
Does CCPA require opt-in consent like GDPR? No. GDPR requires opt-in consent before most processing, including cookies, under Articles 4(11) and 7. CCPA and its CPRA amendments default to opt-out: businesses may process, sell, or share personal information unless a California consumer actively exercises their right to opt out under Civil Code Section 1798.120.
Which businesses have to comply with GDPR versus CCPA? Any business, of any size, that processes personal data of people located in the EU has to comply with GDPR, under its Article 3 extraterritorial scope. CCPA only reaches for-profit businesses that do business in California and cross one of three thresholds: over $26,625,000 in annual gross revenue, personal data on 100,000 or more California consumers or households, or 50% or more of annual revenue from selling or sharing personal information.
Where the Numbers Come From
- DLA Piper. (2026). "GDPR Fines and Data Breach Survey: January 2026." Cumulative total EUR 7.1 billion since 25 May 2018, data through 10 January 2026.
- CMS Law. (2026). "GDPR Enforcement Tracker Report 2026, Numbers and Figures." 2,685 fines, EUR 2.28 million average, cutoff 1 March 2026.
- GDPR-info.eu. "Art. 3 GDPR, Territorial Scope." Official text and commentary on extraterritorial applicability.
- GDPR-info.eu. "Art. 83 GDPR, General Conditions for Imposing Administrative Fines." Statutory caps of EUR 10M/2% and EUR 20M/4% of global turnover.
- Data Protection Commission Ireland. Referenced decisions establishing the Meta Platforms Ireland Limited EUR 1.2 billion fine, May 2023.
- California Privacy Protection Agency. (2024). "California Privacy Protection Agency Announces 2025 Increases for CCPA Fines and Penalties." Revenue threshold $26,625,000, penalties $2,663/$7,988, effective 1 January 2025.
- California Attorney General. "California Consumer Privacy Act (CCPA)." Official CCPA text, business definition, and enforcement authority.
- California Legislative Information. "Civil Code Section 1798.120, Right to Opt-Out of Sale or Sharing." Opt-out consent default.
Note: All figures verified as of August 2026. CCPA's revenue and penalty thresholds are adjusted every other year by the CPPA and are current through 2026, with the next adjustment due 1 January 2027. Cumulative fine totals for both laws are refreshed at least twice a year to track new enforcement data and regulatory updates.
