GDPR vs CCPA: what is the difference for website cookies?

The GDPR requires opt-in consent before non-essential cookies are set, while the CCPA works on opt-out: cookies may load by default, but businesses must let visitors refuse the sale or sharing of their data and honor signals like Global Privacy Control. A site with both EU and California visitors needs a banner that handles both models.

The GDPR model

Under GDPR and the ePrivacy rules, consent comes first. Non-essential cookies stay blocked until the visitor actively accepts, refusal must be as easy as acceptance, and the visitor can withdraw consent later. Consent must also be specific and informed, which is why vague banners fail.

The CCPA model

The CCPA does not require prior consent for most cookies. Instead it gives California residents the right to opt out of the sale or sharing of their personal information, which covers many advertising trackers. Sites must provide a clear opt-out mechanism and honor browser opt-out signals.

Running both from one banner

The standard approach is geotargeting: EU and UK visitors get the opt-in banner with pre-consent blocking, while California visitors get a notice plus a working opt-out. Modern consent platforms handle this split automatically, so one installation satisfies both regimes.