The GDPR requires opt-in consent before non-essential cookies are set, while the CCPA works on opt-out: cookies may load by default, but businesses.
California's CCPA was first, and more than a dozen states now have comprehensive privacy laws, including Virginia, Colorado, Connecticut, Utah,.