The Conventional Wisdom
Many U.S. legal teams view the California Privacy Rights Act (CPRA) as a step toward aligning with the General Data Protection Regulation (GDPR). The idea is simple: California's CCPA set the stage in 2018, GDPR highlighted the gaps, and now CPRA (effective January 2023) aims to bridge them. The belief is that if you comply with CPRA, you're nearly compliant with GDPR too. This narrative suggests one compliance framework can cover both regulations with minimal adjustments.
You'll often hear, "CPRA brings California closer to GDPR." The implication is that this closeness means compatibility, suggesting a single consent system can satisfy both with minor changes.
Why This View Is Misleading
This narrative overlooks a key difference: CPRA and GDPR are built on different legal foundations. They're not just different versions of the same regulation; they reflect distinct regulatory philosophies addressing similar issues.
GDPR starts with prohibition. Article 6 mandates a legal basis for all data processing. Without one of six specific grounds (consent, contract, legal obligation, vital interests, public task, or legitimate interests), processing is not allowed. Consent under GDPR Article 7 must be freely given, specific, informed, and unambiguous. The controller must prove valid consent.
In contrast, CPRA focuses on consumer choice and disclosure. It gives Californians the right to opt out of personal information sales (Section 1798.120) and to limit the use of sensitive information (Section 1798.121). It doesn't prohibit processing by default. The assumption is you can process data unless the consumer opts out.
This isn't a minor difference. It's the difference between "prove you can" and "let me stop you."
The Evidence
Consider how consent works under each framework.
GDPR Article 4(11) requires a clear affirmative action for consent. Pre-ticked boxes, inactivity, or scrolling past a notice don't count. The EDPB Guidelines 05/2020 clarify that consent can't be inferred from silence. Your Consent Management Platform (CMP) must capture an active opt-in before any Non-Essential Cookies are used.
CPRA doesn't have this requirement. Section 1798.140(h) defines consent similarly, but applies it mainly to sensitive information, not all processing. For most data, California consumers must opt out, not in.
Here's where compliance architecture fails: if your CMP meets GDPR's opt-in requirement, you're compliant in Europe. But not automatically in California, because CPRA demands different disclosures, rights mechanisms, and handling of sensitive data that don't align with GDPR's categories.
The reverse is worse. If you build for CPRA's opt-out model, you're non-compliant when a European visitor accesses your site.
What to Do Instead
Stop treating these as converging standards. Treat them as parallel obligations needing distinct technical solutions.
Run separate consent flows by jurisdiction. Your CMP should detect visitor location and serve the correct consent architecture. European visitors should see an opt-in Consent Notice that blocks Non-Essential Cookies until they provide clear affirmative action. California visitors should see data sales and sharing disclosures with an accessible opt-out option.
Map your data practices to both frameworks independently. Don't assume documenting your Legal Basis for Processing under GDPR Article 6 satisfies CPRA's disclosure requirements under Section 1798.100. CPRA requires specific disclosures about data categories, sources, purposes, and third-party recipients. This differs from GDPR's Article 13 transparency requirements.
Audit your vendor contracts through both lenses. GDPR Article 28 requires written data processing agreements with specific clauses. CPRA requires contracts when sharing data with service providers (Section 1798.140(ag)), but the requirements differ. A vendor qualifying as a processor under GDPR might not meet CPRA's service provider definition, or vice versa.
Build your consent records to satisfy both evidentiary standards. GDPR Article 7(1) requires proof of consent. CPRA doesn't impose the same burden for most processing, but it requires verifiable opt-out requests. Your CMP needs to log different consent events: opt-in timestamps for GDPR, opt-out requests for CPRA, and separate records for sensitive information under CPRA Section 1798.121.
When the Conventional Wisdom Is Right
The convergence narrative isn't entirely wrong, it's just incomplete. CPRA closes gaps that made CCPA seem like a draft compared to GDPR.
CPRA introduces data minimization principles (Section 1798.100(c)) similar to GDPR Article 5(1)(c). It creates the California Privacy Protection Agency, akin to European data protection authorities. It expands the definition of sensitive information to include precise geolocation, aligning with GDPR's view of location data.
If you're building privacy infrastructure from scratch, these similarities matter. A privacy-by-design approach meeting GDPR's Article 25 will satisfy many CPRA obligations. A robust data inventory mapping processing activities, purposes, and third-party sharing serves both frameworks.
But here's the key: architectural alignment isn't the same as compliance alignment. You can respect both GDPR and CPRA principles while needing separate implementations for consent, disclosures, and consumer rights.
CPRA moves California closer to GDPR in spirit. It doesn't make California and Europe interchangeable compliance destinations. Your legal team should stop looking for shortcuts and start building for both.
