GDPR, ePrivacy & California Context

EU/EEA context

GDPR's territorial scope depends on establishment, offering goods/services or monitoring under Article 3; the presence of any EU visitor alone is not the complete test. Device storage/access is also governed by national ePrivacy implementation, with applicable exemptions.

Where consent is required, it must be informed, freely given, specific, unambiguous and withdrawable. Evidence of consent and accurate purposes matter. Not all ordinary cookie consent is the special GDPR category of explicit consent.

California context

CCPA/CPRA applies to covered businesses and activities, with thresholds, exemptions and special rules. It includes notice, access/deletion and opt-out of sale/sharing; minors and sensitive information can bring additional requirements. Do not reduce it to “all cookies allowed until declined.”

Check the California Privacy Protection Agency and current rules for applicability, adjusted thresholds and opt-out preference signals, including Global Privacy Control. This guide intentionally avoids stale dollar-threshold/fine tables.

Actual ConsentEase regional support

Geographic context can support a jurisdiction badge and language fallback. It does not automatically switch EU visitors to one legal consent model and Californian visitors to another button set.

This guide does not promise general GPC/Do Not Sell enforcement, automatic sale/sharing restrictions or all-law compliance. Provider-specific privacy sync must be configured and verified on the relevant platform.

Responsibilities

Assess each applicable jurisdiction and purpose, configure tags accordingly, supply notices and a usable withdrawal/opt-out route, and validate runtime behaviour. A location badge or successful scan is not legal approval.

Use the GDPR text and EDPB consent guidelines alongside jurisdiction-specific advice.