CCPA, GDPR or Both? — TechKnowSurge

About this interactive

The California Consumer Privacy Act (CCPA) protects California residents. It was modeled on GDPR, the European Union's regulation, so the two have a lot in common, and a few key differences. (The CCPA was signed in June 2018 and took effect on January 1, 2020; the video gives May 2018.) Who must comply. GDPR applies to an organization of any size that has an office in the EU, offers goods or services to people in the EU, or tracks or monitors them. The CCPA applies only to for-profit businesses doing business in California that pass one of three tests: a set level of yearly revenue (the lesson's $25 million, now adjusted for inflation), buying, selling or sharing the personal information of 100,000 or more California residents or households, or making half their yearly revenue from selling it. Both can reach a company based somewhere else. GDPR protects people in the EU, not "Eastern European residents" as the video puts it. The model. The CCPA is an opt-out law: a business may collect and sell personal information until the consumer says stop. GDPR is called a consent model: processing needs a legal basis before it starts, and consent is the best known of six. What counts. Both protect personal information such as a name and an email address. The CCPA's definition also reaches a household. The video adds devices to the CCPA's list; GDPR covers online identifiers too, so the household is the real difference. Penalties. The CCPA fines up to a set amount per violation, more when it is intentional (the lesson's $2,500 and $7,500, now adjusted for inflation). GDPR fines reach 4% of worldwide annual turnover or 20 million euros, whichever is higher; the video says 2 million. Both lessons end on the same point: other states and countries are copying these laws, so it pays to build their practices in now.

What you'll learn

Compare the CCPA and GDPR on what the two lessons teach (who must comply, the opt-out and consent models, what counts as personal information, and penalties) and say which law a feature belongs to
Recognize what the two laws have in common: each protects the personal information of a place's residents, reaches companies based elsewhere, carries penalties and has been copied by other laws

Aligned to

CompTIA Security+

5.4 Summarize elements of effective security compliance.

ISC2 CISSP

1.4 Understand legal, regulatory, and compliance issues that pertain to information security in a holistic context

NIST NICE

K0678 Knowledge of privacy laws and regulations

K0681 Knowledge of privacy principles and practices

Key terms

California Consumer Privacy Act: A California state law that grants consumers the right to know what personal data businesses collect about them, to request deletion, and to opt out of the sale of their personal information. It is one of the most comprehensive consumer privacy laws in the United States.
General Data Protection Regulation: A European Union regulation that establishes comprehensive data protection and privacy rights for individuals within the EU and EEA, and imposes obligations on organizations that process EU residents' personal data regardless of where the organization is located. GDPR introduced concepts such as data minimization, the right to erasure, and mandatory breach notification.
Data Subject: An individual whose personal data is being collected and processed by another party.

Topics

Ccpa Gdpr Privacy Regulatory Compliance Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →