General Data Protection Regulation (GDPR) & California Consumer Privacy Act (CCPA)

The California Consumer Privacy Act (CCPA) effective date is January 1, 2020 in the United States and the General Data Protection Regulation (GDPR) effective date is May 25, 2018 in the European Union (EU).

Any company that does business in California having over $25 million in annual revenues, transfers data over 50,000 California consumers, and makes at least half its revenue from the sale of Califoria consumer data — can be subject to the CCPA.

The CCPA recognizes:

Right to Access
Right to Knowledge of Sale
Right to Equal Pricing and Service (based on the consumer’s data)
Right to Object

The GDPR recognizes:

Right to Access
Right to Object
Right to Be Informed
Right to Rectify
Right to Delete or “Be Forgotten”
Rgiht to Restrict Processing
Right to Data Portability
Right to Not Be Subject to Automated Decision

Users can request that a business subject to the GDPR give users access to:

What information is collected on them
What information is shared or sold
Who that information may be shared with or sold to

Penalties under the GDPR can be up to up to 4% of company’s annual revenue 20 million euros.

Penalties under the CCPA are $750 for each violation, per person.

The GDPR requires user consent if processing sensitive information e.g. race, ethnicity, religion, political history, medical history, financial history, or sexuality.

The CCPA requires consent to sell data of users under age 16.

The CCPA requires right to withdraw consent to sale of data at any time. This also requires “Do Not Sell My Personal Information” posted on the homepage and privacy policy so users can opt out of the sale of data.

The GDPR requires keeping data encrypted, confidential and accessible; notifying users of data breach; and performing Data Protection Impact Assessment (DPIA) before processing personal data.

CCPA lawsuits can be brought by the Attorney General’s Office for breach of privacy if company data is mishandled or infiltrated.

Michael A. Long, Esq.


Over 20 years in business and law combined.  Achieved highly favorable outcomes for clients in high-stakes litigation. California & USPTO-licensed.

Representative Cases