Most store owners copy a generic privacy policy template and assume it covers both European and Californian shoppers, when the two laws name different thresholds and different rights and a template that ignores either one leaves gaps a regulator or a plaintiff's lawyer can find.
A store owner who searches for a privacy policy template usually wants one document that covers every shopper, and most templates are written to look like they do that while actually leaning on one law’s assumptions and hoping the other law’s requirements fit by coincidence. GDPR and CCPA do not share a threshold, a rights framework, or even a starting legal premise, so a template that treats them as interchangeable is going to miss something for one group of shoppers or the other.
The GDPR consolidated text, read from EUR-Lex, opens its reasoning by pointing to the Treaty on the Functioning of the European Union and in particular Article 16 of that treaty, alongside a proposal from the European Commission. The preamble also cites the Charter of Fundamental Rights of the European Union and Article 16(1) of the TFEU as the source of the right every person has over their own data. Recital 12 goes further and says Article 16(2) TFEU is the specific provision that mandated the European Parliament and the Council to lay down the rules that became the Regulation. None of this is about revenue or customer count. It is about a right that exists independent of how big the store is, which means a one-person shop selling to EU customers carries the same baseline obligation as a large retailer, at least as far as the Treaty-level reasoning goes.
That said, the GDPR text does reference business size in at least one place: it points to Article 2 of the Annex to Commission Recommendation 2003/361/EC when discussing how enterprises should be classified. A template writer building for an EU audience should know this reference exists even if the Regulation’s core rights language does not hinge on it the way CCPA’s thresholds do.
The California Attorney General’s guidance is far more concrete about who the law covers. A business doing business in California falls under CCPA if it meets any one of three conditions: gross annual revenue over $25 million, or buying, selling, or sharing the personal information of 100,000 or more California residents or households, or deriving 50% or more of annual revenue from selling California residents’ personal information. These three conditions are independent, so a store with modest revenue but a large customer list can still trigger the law through the data volume threshold alone, and a store with no direct sale of data but high revenue can trigger it through the dollar figure.
| Threshold type | GDPR basis | CCPA basis |
|---|---|---|
| Legal foundation | Article 16 TFEU and the Charter of Fundamental Rights | California Attorney General statutory guidance |
| Size-based test | References Commission Recommendation 2003/361/EC Annex Article 2 | Gross annual revenue over $25 million |
| Data-volume test | Not stated as a numeric threshold in the consolidated text | 100,000 or more California residents or households |
| Revenue-from-data test | Not stated as a numeric threshold in the consolidated text | 50% or more of annual revenue from selling personal information |
The figures behind this comparison come from reading the two primary documents directly: the GDPR consolidated text on EUR-Lex as it stood when checked on September 26, 2026, and the California Attorney General’s CCPA guidance page as checked on October 1, 2026. Neither number was taken from a secondary summary or a compliance vendor’s marketing page.
GDPR recital 16 states directly that the Regulation does not apply to issues of protection of fundamental rights outside areas covered by Union law in the way the Regulation defines its own scope. That is a boundary, not an invitation, and a template that stretches GDPR language to describe protections the Regulation itself does not claim is making a promise the law does not back up. Likewise, the GDPR text references liability rules for intermediary service providers found in Articles 12 to 15 of a separate directive rather than restating those rules inside the Regulation itself. A store that hands customer data to a payment processor or a fulfillment partner is relying on that separate liability framework, and a privacy policy template that is silent on this distinction leaves the merchant assuming protections that live in a different document entirely.
Because GDPR’s reasoning starts from a treaty-level right and CCPA’s reasoning starts from three numeric thresholds, a template that tries to answer both audiences in one undifferentiated paragraph is answering neither well. A GDPR-facing section should be able to point to the Article 16 TFEU basis and should stay within the boundary recital 16 sets. A CCPA-facing section should state the three thresholds plainly enough that a store owner can check their own revenue and customer count against them without needing a lawyer to translate the guidance page. Keeping the two sections structurally separate, rather than merged into one generic data-protection statement, is what lets a store answer a regulator’s question about either law without having to first untangle which parts of the template were written for which audience.
A merchant should read the EUR-Lex consolidated text and the California Attorney General’s guidance page directly before publishing any template, and should check their own revenue, resident count, and data-sale percentage against the CCPA thresholds rather than assuming a template’s boilerplate language already covers their specific numbers.
Yes if any of the three thresholds in the California Attorney General's guidance are met. A business doing business in California falls under CCPA if it has gross annual revenue over $25 million, or if it buys, sells, or shares the personal information of 100,000 or more California residents or households, or if it derives 50% or more of its annual revenue from selling California residents' personal information. A store under all three thresholds is not automatically exempt from good practice, but it is exempt from the statute itself. Read the guidance directly before assuming either way, because revenue and data volume both count separately.
The consolidated text traces the requirement back to Article 16 of the Treaty on the Functioning of the European Union, which the preamble cites alongside the Charter of Fundamental Rights of the European Union as the basis for the right everyone has over their personal data. Recital 12 explains that Article 16(2) TFEU is the provision that mandated the European Parliament and the Council to lay down the rules in the first place. A template built for the EU needs to reflect that chain, not just list generic bullet points about cookies.
It can, if it is structured in layers rather than written as one undifferentiated document. GDPR recital 16 states that the Regulation does not apply to issues of protection of fundamental rights outside its own scope, meaning the GDPR sections of a policy should stay bounded to what GDPR actually governs. CCPA's thresholds, by contrast, are about revenue and data volume, not fundamental rights framing, so the CCPA section needs its own separate test keyed to the $25 million and 100,000-resident figures.
GDPR's consolidated text references Article 2 of the Annex to Commission Recommendation 2003/361/EC when discussing how enterprises should be sized, which is a different mechanism from CCPA's flat dollar figure. There is no single revenue number in the GDPR text parallel to CCPA's $25 million mark. A merchant selling into the EU should not assume a small-business carve-out exists just because one exists under CCPA.
The GDPR consolidated text references liability rules for intermediary service providers found in Articles 12 to 15 of another directive, meaning GDPR itself does not fully restate those liability terms but points outward to them. A store using a payment processor or fulfillment partner as a data intermediary should check that separate liability framework rather than assume the privacy policy template alone settles the question.