Does GDPR apply to US companies?

Yes, if they offer goods or services to people in the EU, or monitor the behavior of people in the EU — regardless of where the company itself is based. The same logic flows in the other direction for CCPA: companies anywhere in the world that handle California residents' personal information at certain thresholds are in scope.

Which is stricter, GDPR or CCPA?

GDPR is broader and more demanding — it requires a lawful basis for every processing activity, gives users more granular rights, and applies to any personal data. CCPA is narrower (focused on the sale and sharing of personal information) but adds specific consumer-facing controls and disclosure requirements that GDPR does not.

GDPR vs CCPA, explained for non-lawyers

The EU's General Data Protection Regulation (GDPR) and California's Consumer Privacy Act (CCPA, expanded by the CPRA) are the two most influential privacy laws on the modern web. Almost every Privacy Policy you read has been rewritten at some point to satisfy one or both of them. They are not the same.

The philosophies are different

GDPR treats personal data as something a company must justify collecting. Every processing activity needs a lawful basis (consent, contract, legitimate interest, etc.). Without one, the activity is unlawful.

CCPA treats personal data as something a company can collect, but must be transparent about and give users the ability to opt out of (particularly its sale or sharing). It's a "right to know and refuse" regime rather than a "lawful-basis-required" regime.

Who they apply to

GDPR applies to any organization processing personal data of people in the EU, regardless of where the organization itself is.

CCPA applies to for-profit companies doing business in California that meet certain thresholds (revenue, volume of personal data, or share of revenue from selling personal data).

User rights, side by side

Access: both grant a right to access personal data.
Deletion: both grant a right to deletion, with similar exceptions.
Correction: GDPR grants it; CPRA added it to California law.
Portability: GDPR grants a strong right; CCPA grants a more limited one.
Opt-out of sale/sharing: a defining CCPA right; under GDPR this is folded into the lawful-basis and consent rules.
Automated decision-making: GDPR gives specific rights around decisions made solely by automated processing; CPRA adds California-specific rules.

How both shape the Privacy Policies you read

Most modern Privacy Policies are written to satisfy both regimes simultaneously, which is why you'll often see two parallel sections — one labelled for EU/UK residents and one for California residents — covering similar ground in slightly different language. When either regulation evolves (and they do), thousands of Privacy Policies get rewritten in response.

That's a big part of why Termsight exists — to surface those rewrites in plain English the day they happen, not twelve months later at audit time.