GDPR vs CCPA/CPRA and US State Privacy Laws — Comprehensive Comparison

By mid-2026, over 19 US states have enacted comprehensive privacy laws, creating a complex multi-jurisdictional compliance landscape. For non-EU businesses serving both EU and US customers, understanding how GDPR compares with US state laws is critical — especially because GDPR compliance alone does not satisfy US state law requirements, and vice versa.

GDPR vs CCPA/CPRA — Scope and Applicability

The California Consumer Privacy Act (CCPA), strengthened by the California Privacy Rights Act (CPRA), was the first US comprehensive privacy law. Key differences from GDPR:

• Extraterritorial scope: GDPR Article 3(2) applies to any non-EU entity offering goods/services to EU residents. CCPA/CPRA applies to for-profit businesses meeting revenue/volume thresholds — smaller businesses may be exempt.
• Consumer definition: GDPR covers “data subjects” (any natural person); CCPA covers “consumers” who are California residents acting in a non-employment context.
• Consent vs opt-out: GDPR generally requires opt-in consent for processing; CCPA/CPRA uses an opt-out framework for data sales/sharing.
• Individual rights: Both grant access, deletion, and portability rights. GDPR adds the right to restriction and objection. CPRA adds the right to correct inaccurate data and opt out of automated profiling.
• Fines: GDPR: up to EUR 20 million/4% of global turnover. CCPA/CPRA: up to USD 7,500 per intentional violation per consumer per incident.

Other US State Privacy Laws

Beyond California, major state laws include:

• Virginia (VCDPA): Effective 2023. Consumer rights, opt-out for targeted advertising/sales, non-profit exemption.
• Colorado (CPA): Effective 2023. Broader definition of “sale,” universal opt-out mechanisms required.
• Connecticut (CTDPA): Effective 2023. Similar to Colorado, no revenue threshold, universal opt-out required from 2025.
• Utah (UCPA): Effective 2023. More business-friendly, narrower consumer rights, no private right of action.
• Iowa (ICDPA): Effective 2025.
• Texas, Oregon, Montana, Delaware, Nebraska, Minnesota, New Jersey, Tennessee: Effective 2024-2027 with varying scopes.

The Critical Difference: Article 27

US state privacy laws do not require an EU Representative equivalent. Article 27 of GDPR is unique — no US state imposes a similar requirement for non-US entities. This means if you are a non-US company serving California residents, you need CCPA/CPRA compliance but no “US Representative.” But if you also serve EU residents, you need an EU Representative under Article 27. The two compliance regimes are separate and must be addressed independently.

Practical Compliance Strategy

For non-EU businesses serving both markets: appoint an EU Representative for GDPR compliance, implement CCPA/CPRA opt-out mechanisms for California users, monitor new state law developments, and maintain a comprehensive ROPA covering all processing of both EU and US data. Get started →