A startup with six employees in Austin can be pulled into European privacy rules by a single customer in Berlin. A two-person team in Lisbon can fall under California law by selling to enough households in San Diego. Privacy statutes rarely care how small you are. They care about where your users are, what you collect, and what you do with it.
The GDPR and the CCPA (as amended by the CPRA) are the two regimes most founders ask about, but they answer different questions. One asks whether you process data about people in Europe. The other asks whether you do business in California and cross a size or data-volume line. Plenty of companies are subject to both, and a few are subject to neither.
What Each Law Actually Covers
The GDPR governs the processing of personal data relating to people in the EU and EEA. It applies to your company if you have an establishment in the EU, or if you offer goods or services to people there, or monitor their behaviour — which includes ordinary web analytics and advertising pixels. There is no revenue test and no employee-count exemption. A free side project with a mailing list of European subscribers can fall inside it.
The CCPA applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above a figure in the mid-twenty-millions that is adjusted periodically, buying or selling or sharing the personal information of 100,000 or more consumers or households each year, or earning half or more of annual revenue from selling or sharing personal information. Since the CPRA amendments took effect, the law covers employees, job applicants and business contacts, not just customers.
Note also that these are not the only two laws in play. Several US states have their own statutes, the UK has a near-copy of the GDPR, and Brazil, Canada and others have their own regimes. Two laws are the starting point, not the finish line.
Applicability Triggers: Five Questions to Answer
- Do you serve or track people in the EU/EEA? If you ship to European addresses, run ads targeted at European users, or load analytics that profile them, treat the GDPR as applicable.
- Do you have California residents in your database? Customers, newsletter subscribers, employees and applicants all count.
- Do you clear a CCPA threshold? Revenue, data volume, or a business model built on selling or sharing personal information.
- Does your ad stack share data for cross-context behavioural advertising? Under the CCPA that counts as "sharing" and triggers opt-out duties even if you never sell anything.
- Do you employ or contract people in Europe? HR data falls under the GDPR and is often overlooked.
Write the answers down, date them, and revisit once a year. Thresholds and regulations change, and a memo from two years ago will not protect you.
Rights: Similar Labels, Different Mechanics
The rights sound alike, but the operational differences matter more than the names. Under the GDPR, individuals can access, correct, delete, restrict, port and object to processing, withdraw consent, and refuse decisions made solely by automated means. You generally need a lawful basis before you process anything, and consent must be freely given, specific and easy to withdraw. You have one month to answer a request, extendable by two months for complex cases.
Under the CCPA, California consumers can know what you collect, delete it, correct it, opt out of sale or sharing, limit the use of sensitive personal information, and expect no retaliation for exercising those rights. You have 45 days, extendable by another 45. The default posture is opt-out rather than opt-in: you may process data, but you must disclose it at or before collection and give people a working way to say stop.
In practice, that means a cookie banner with a "reject all" button as prominent as "accept," a "Do Not Sell or Share My Personal Information" link, and honouring browser-level opt-out signals such as the Global Privacy Control.
Penalties and Enforcement
GDPR fines come in two tiers: up to €10 million or 2% of total worldwide annual turnover, and up to €20 million or 4%, whichever is higher, for the most serious infringements. National regulators also issue reprimands, processing bans and audit orders, and some jurisdictions allow individuals to claim compensation through their own courts.
CCPA penalties are per violation, which is where small teams get hurt. Administrative fines run up to $2,500 per violation, and up to $7,500 for intentional violations or those involving the personal information of consumers under 16. Separately, the CCPA creates a private right of action for certain data breaches, with statutory damages of $100 to $750 per consumer per incident. Multiply that by a customer list and the exposure becomes real.
A Compliance Plan for a Small Team
If both laws apply, do not run two programmes. Build one that satisfies the stricter requirement on consent and the specific mechanics each law demands.
- Map your data. For each field: what it is, whose it is, where it lives, who receives it, why you have it, and when you delete it.
- Determine your regimes using the five questions above, and record the conclusion.
- Rewrite your privacy notice so it works as both a GDPR information notice and a CCPA notice at collection.
- Open one request channel. A simple form plus a tracked inbox, with calendar reminders at day 25 and day 40.
- Fix the opt-outs before an ad campaign, not after: reject-all button, do-not-sell link, GPC support.
- Tighten vendor contracts. Data processing agreements for GDPR, service provider terms limiting use for CCPA.
- Set a retention schedule and actually run it. Data you deleted cannot be breached or subpoenaed.
Start With the Triggers, Not the Paperwork
Most startups do not need to choose between these laws. They need a defensible answer to a simpler question: which ones bind us, and why? Get that analysis in writing, review it annually, and bring in privacy counsel before you launch anything that profiles users or shares data with advertisers. This piece is general information, not legal advice, and the specifics of your product and customer base will decide the outcome.
The most expensive mistake is not a fine. It is discovering in month eight that you should have been answering deletion requests in month one.
Photo: advogadoaguilar / Pixabay
