GDPR vs CCPA: what a CMP must do

GDPR, the EU's General Data Protection Regulation, and the CCPA and CPRA, California's privacy laws, are the two regimes most sites have to satisfy. They share a goal — giving people control over their data — but they take opposite default positions, and that difference shapes everything your consent platform does.

Under GDPR, consent is opt-in. Non-essential cookies and trackers may not run until the visitor has actively agreed, which is why genuine prior blocking matters: analytics, advertising and embedded third-party tags must stay inert until consent is given, not merely be hidden while they quietly load. A banner that sets cookies before you click “accept” is not compliant, however polished it looks.

GDPR also sets a quality bar for the consent itself. It must be freely given, specific, informed and unambiguous, and — under guidance from European regulators — as easy to refuse as to accept. In practice that means a “reject all” button with the same prominence as “accept all”, no pre-ticked boxes, granular choice per purpose, and the ability to withdraw consent at any time as easily as it was given.

The legal basis behind cookies is ePrivacy as much as GDPR. The ePrivacy Directive is what actually requires consent before storing or reading information on a device; GDPR defines what valid consent looks like and how it must be recorded. A CMP has to satisfy both: block first, ask clearly, and keep proof.

Under the CCPA and its successor the CPRA, the model is opt-out. Businesses may process personal information by default but must let California residents decline the “sale” or “sharing” of it — terms defined broadly enough that passing data to many advertising and analytics partners can count. The mechanism is usually a clear “Do Not Sell or Share My Personal Information” link.

The CPRA also made honouring the Global Privacy Control mandatory in California. GPC is a browser-level signal that broadcasts an opt-out automatically; a compliant site must treat its presence as a valid request to stop selling or sharing, without making the visitor click anything. A good CMP detects navigator.globalPrivacyControl and applies the opt-out before the page finishes loading.

California is no longer alone. A growing set of US states — Virginia, Colorado, Connecticut, Texas, Oregon and others — have their own comprehensive privacy laws, several of which also require honouring a universal opt-out mechanism. The details differ, but the shape is the same: opt-out by default, with an automated signal that must be respected. A platform that handles California cleanly is most of the way to handling the rest.

This is why geography drives behaviour. A platform serving a global audience has to resolve the right regime per visitor: an opt-in banner with prior blocking for someone in the EEA or UK, opt-out controls and a “Do Not Sell or Share” link for someone in California, and automatic respect for GPC everywhere it applies. Deciding this from the visitor's actual location — ideally at the edge, before the page renders — keeps each person in the correct regime without shipping five banners.

Both regimes expect you to be accountable, and accountability means records. Under GDPR you must be able to demonstrate that you obtained valid consent; under CCPA you must be able to show you honoured opt-outs. If a regulator or a data subject asks what a person chose and when, “we think they clicked accept” is not an answer — you need a durable, queryable record.

The stronger form of that record is a tamper-evident log. When each consent event is hashed together with the one before it, any later alteration breaks the chain and becomes detectable, which turns your log from a claim into evidence. Pairing it with standards-based consent receipts — modelled on the ISO/IEC TS 27560 consent-record format — gives you a portable, structured proof of exactly what was presented and agreed to.

Records are also what make the ongoing rights work. Both regimes let people revisit their decision — withdraw consent under GDPR, opt back out under CCPA — so a preference centre that reopens the original choices, and a log that captures each change, are what keep you compliant after the first visit, not just during it.

Cookie Munch handles both models from one embed: regional opt-in with prior blocking, and opt-out controls with a “Do Not Sell or Share” link, GPC and Do-Not-Track honoured automatically, a preference centre for revisiting choices, and a SHA-256 hash-chained log with 27560-style receipts as proof. One setup, both regimes, and evidence on hand when someone asks.