> CCPA and GDPR handle cookies differently. Opt-in vs opt-out, penalties, geographic scope: here is what changes for your website. > > Canonical: https://www.flowconsent.com/en/blog/ccpa-vs-gdpr-cookie-differences [Regulation](https://www.flowconsent.com/en/blog?category=regulation) # CCPA vs GDPR: the real differences for cookies By FlowConsent · Published 9 March 2026 · Updated 9 October 2026 · 4 min read In short CCPA and GDPR handle cookies differently. Opt-in vs opt-out, penalties, geographic scope: here is what changes for your website. ## **TL;DR** The GDPR and the CCPA are the two major regulatory frameworks governing cookie management on websites, but they work in fundamentally different ways. The GDPR (Europe) requires explicit consent before setting any non-essential cookie (opt-in). The CCPA/CPRA (California) allows cookies to be set by default, but requires an opt-out mechanism for the sale or sharing of personal data. A website targeting users in both regions must manage both sets of rules simultaneously, which requires a CMP capable of differentiating rules by geolocation. ## **Why this comparison matters** The GDPR starts from the principle that nothing should be collected without prior agreement. The CCPA starts from the principle that collection is allowed, but the user must be able to object. This distinction has direct consequences on your cookie banner configuration, script blocking, and CMP architecture. ## **GDPR and CCPA: two frameworks, two philosophies** ### **The GDPR in brief** The GDPR has been in force since May 2018 in the European Union. It defines personal data broadly: IP addresses, cookie identifiers, browsing data. Any non-essential cookie requires prior consent that is freely given, informed, specific, and unambiguous. This is the opt-in model. The conditions that make consent valid under this model are detailed in our article on [the 7 GDPR consent validity requirements](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements). ### **The CCPA/CPRA in brief** The CCPA has been in force since January 2020, strengthened by the CPRA since January 2023. It applies to businesses exceeding certain thresholds ($25M revenue, 100,000 residents, or 50% revenue from data sales). The CCPA follows an opt-out model: cookies can be set as soon as the page loads, but users must be able to object through a Do Not Sell or Share link and the GPC signal. ## **The concrete differences for cookies** Under the GDPR, if your site loads Google Analytics or an advertising pixel before the user clicks Accept, you are in violation. Under the CCPA, those scripts can load immediately, but the user must be able to prevent the sale or sharing of their data through an accessible opt-out. If Google Analytics is your main tracker, our article asking [whether Google Analytics is GDPR compliant](https://www.flowconsent.com/en/blog/google-analytics-gdpr-compliant) covers the European side in depth. ## **What this means in practice for your website** ### **If you target Europe only** Block all non-essential scripts before consent. Your [cookie banner](https://www.flowconsent.com/en/blog/cookie-banner-gdpr-compliance-guide) must offer a granular choice with a Reject button as visible as the Accept button. Consent proof must be stored. ### **If you target California only** You can load tracking scripts as soon as the page loads. Display a Do Not Sell or Share link accessible from all pages. Your site must honor the GPC signal. ### **If you target both regions** Your CMP must detect visitor location and apply the corresponding rules. When [choosing a CMP](https://www.flowconsent.com/en/blog/how-to-choose-consent-management-platform) that handles both regulations, verify it supports geolocation, GPC, and Consent Mode v2. ## **Which cookies are affected by each regulation** The two regulations do not target exactly the same [types of cookies](https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work). Strictly necessary cookies are exempt in both cases. Analytics cookies require opt-in under the GDPR. Advertising cookies are covered by both regulations. ## **Common mistakes (and how to avoid them)** **Applying the same rules everywhere.** Applying GDPR rules to all visitors reduces consent rates in California. Applying CCPA rules to all visitors is not GDPR compliant. If your audience extends beyond Europe and California, see our guide to [managing cookies under LGPD, POPIA, PDPA and DPDPA](https://www.flowconsent.com/en/blog/lgpd-popia-pdpa-dpdpa-cookies-outside-europe). **Ignoring the GPC signal.** The CCPA/CPRA requires honoring Global Privacy Control. In 2025, Tractor Supply was fined $1.35 million, in part for not honoring GPC. **Confusing Do Not Sell with Reject All.** The CCPA's Do Not Sell link targets data sale and sharing with third parties specifically, not all cookies. **Forgetting Consent Mode v2.** If you use Google Analytics and target the EEA, [Consent Mode v2](https://www.flowconsent.com/en/blog/google-consent-mode-v2-implementation-guide) has been mandatory since March 2024. This is separate from CCPA requirements. **Neglecting documentation.** The GDPR requires comprehensive documentation. The CCPA requires an up-to-date privacy policy and a notice at collection. Both require annual updates. On the GDPR side, part of this documentation is your [cookie policy, with what to include and a template](https://www.flowconsent.com/en/blog/cookie-policy-gdpr-guide). ## **How to configure your CMP for both regulations** Geolocation to identify visitor location. Adapted banner per region. Conditional script blocking. Consent proof storage. Use a [cookie scanner](https://www.flowconsent.com/en/scan) to verify your CMP configuration works correctly. To document what your configuration actually does, FlowConsent's [proof report](https://www.flowconsent.com/en/doc/proof-report) turns a refusal scan into dated audit evidence. ## **CCPA + GDPR cookie compliance checklist** 1. Identify where your visitors are located and which regulations apply. 2. Configure your CMP with differentiated rules by geolocation. 3. Block non-essential scripts before consent for European visitors. 4. Display a Do Not Sell or Share link for Californian visitors. 5. Configure GPC signal compliance. 6. Store consent proof for EU visitors. 7. Update your privacy policy with both GDPR and CCPA disclosures. 8. Configure Consent Mode v2 for EEA visitors. 9. Scan your site to verify blocking and opt-out work correctly. 10. Plan an annual review of your CMP configuration. ## **Conclusion and next step** The GDPR and the CCPA impose different obligations: opt-in in Europe, opt-out in California. A site receiving traffic from both regions must manage both sets of rules. Start with a [scan of your site](https://www.flowconsent.com/en/scan) to identify all active cookies and trackers. In 2026, both GDPR and CCPA enforcement continues to intensify, and sites operating across the US and EU need a clear compliance strategy for both frameworks. [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fccpa-vs-gdpr-cookie-differences) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fccpa-vs-gdpr-cookie-differences) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What is the main difference between the CCPA and the GDPR for cookies? The GDPR requires opt-in consent before setting non-essential cookies. The CCPA allows cookies to be set by default, but requires an opt-out mechanism if data is sold or shared with third parties. The logic is reversed: the GDPR blocks before consent, the CCPA allows then offers a refusal. ### Do I need a cookie banner for the CCPA? The CCPA does not require a cookie banner in the GDPR sense. However, it requires a Do Not Sell or Share My Personal Information link accessible on all pages, and compliance with the GPC signal. In practice, many sites use a cookie banner with a Do Not Sell tab to cover both regulations. ### Does the CCPA apply to my European website? The CCPA applies if your site collects personal data from California residents and your business exceeds one of three thresholds ($25M revenue, 100,000 residents, or 50% revenue from data sales). If your site receives significant Californian traffic, the CCPA likely applies. ### Can I apply GDPR rules to all visitors to simplify? Yes, this is technically compliant with both regulations. However, it reduces your consent rate in California (where opt-in is not required) and may impact your analytics and advertising data. The best approach is to adapt rules by geographic region. ### What penalties do I face for CCPA non-compliance? The CCPA provides for fines of $2,663 to $7,988 per violation (amounts adjusted in 2025). These fines are cumulative per affected user. Sephora paid $1.2 million in 2022, and Tractor Supply paid $1.35 million in 2025. ### Does Google Consent Mode v2 cover the CCPA? Consent Mode v2 is designed to transmit consent signals to Google under the GDPR and the DMA. It is not specifically designed for the CCPA. For CCPA compliance, you must separately configure GPC compliance and the Do Not Sell mechanism in your CMP. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Comparisons · 22 October 2026](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) ### [First-party vs third-party cookies: differences, examples and GDPR](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) [What separates first-party and third-party cookies, real examples of each, how Safari, Firefox and Chrome treat them in 2026, and why consent depends on purpose rather than domain.](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) [Read the article ](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies)· [Regulation · 17 March 2026](https://www.flowconsent.com/en/blog/cnil-cookie-sanctions-real-cases) ### [CNIL cookie sanctions: real cases you should know](https://www.flowconsent.com/en/blog/cnil-cookie-sanctions-real-cases) [Google, Amazon, Shein, Apple, TikTok: the CNIL regularly sanctions cookie violations. Overview of public cases and practical lessons.](https://www.flowconsent.com/en/blog/cnil-cookie-sanctions-real-cases) [Read the article ](https://www.flowconsent.com/en/blog/cnil-cookie-sanctions-real-cases)· [Comparisons · 12 October 2026](https://www.flowconsent.com/en/blog/cookie-notice-vs-cookie-policy) ### [Cookie notice vs cookie banner vs cookie policy: the differences](https://www.flowconsent.com/en/blog/cookie-notice-vs-cookie-policy) [What a cookie notice is, how it differs from a cookie banner, a cookie policy and a privacy policy, and what each one must contain under GDPR.](https://www.flowconsent.com/en/blog/cookie-notice-vs-cookie-policy) [Read the article](https://www.flowconsent.com/en/blog/cookie-notice-vs-cookie-policy) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)