These aren’t three versions of the same rule — they’re two different legal traditions bolted together, plus a third that works almost backwards from the first two. The ePrivacy Directive controls the moment a cookie gets placed on a visitor’s device. GDPR controls everything that happens to the data after that cookie has collected it. CCPA/CPRA doesn’t require a cookie’s permission slip at all by default — it requires you to honor a visitor’s request to stop, after the fact. Which one applies to your WordPress site depends entirely on who’s visiting it, not where you or your server happen to be.
The Three Laws, in Plain Terms
ePrivacy Directive (EU/UK, 2002/58/EC) is the actual “cookie law” — the reason consent banners exist in the first place. It says you need prior opt-in consent before you set any cookie or similar tracking technology that isn’t strictly necessary for the site to function, full stop, regardless of your size or revenue. It’s a Directive, not a Regulation, which matters mechanically: each EU member state passed its own national law implementing it, so enforcement and fine structures vary somewhat country to country (Spain and France’s regulators, for instance, have historically been more cookie-banner-active than most). It’s enforced by national data protection authorities, and in most member states, violations get folded into GDPR’s penalty structure rather than carrying a separate fine schedule.
GDPR (EU, Regulation 2016/679) is the general data protection law — it governs what you’re allowed to do with personal data once you have it, cookie-derived or not. That includes having a valid legal basis for processing (consent is only one of six), giving people the right to access, correct, delete, or export their data, notifying regulators of serious breaches within 72 hours, and restricting how you move EU personal data outside the EU. A cookie consent banner is where GDPR and ePrivacy meet in practice: ePrivacy is why the banner has to appear and be opt-in before tracking starts, and GDPR governs everything the plugin, your analytics tool, or your ad network does with the data once someone clicks “accept.”
CCPA/CPRA (California, effective as amended 2023, with ongoing CPPA rulemaking through 2026) runs on a different model entirely: opt-out, not opt-in. A covered business can process and even sell personal information by default — it just has to give consumers clear, low-friction ways to say no, and to actually honor that “no” without retaliating (no charging a fee or degrading service because someone opted out). It only applies once your business crosses a specific size threshold; unlike GDPR, small sites are exempt by law, not just by enforcement priority. As of the CPPA’s most recent Consumer Price Index adjustment (effective January 1, 2025), that threshold is: annual gross revenue over $26,625,000, OR you buy, sell, or share the personal information of 100,000 or more California consumers or households a year, OR 50% or more of annual revenue comes from selling or sharing personal information.
Side by Side
| Dimension | ePrivacy / GDPR (EU/UK) | CCPA/CPRA (California) |
| Trigger | Any EU/UK visitor reaching your site, regardless of your size or location. | Only once your business crosses the revenue/volume thresholds below. |
| Consent model | Opt-in — required before the cookie fires. | Opt-out — the default is “on” until a visitor tells you to stop. |
| What’s regulated | ePrivacy: placing a cookie/tracker. GDPR: everything done with the data afterward (legal basis, rights, breaches, transfers). | Sale/sharing of personal information, plus the same rights model (access, deletion, correction, opt-out, limiting sensitive-data use). |
| Small-site exemption | None — a 200-visit/month blog with Google Analytics is technically in scope. | Yes, by statute, below the revenue/volume thresholds. |
| Required mechanic | A prior-consent banner that blocks non-essential scripts until accepted. | A “Do Not Sell or Share”/”Your Privacy Choices” link, honoring GPC as a valid opt-out, with symmetrical accept/decline design (per 2025-2026 CPPA enforcement). |
| Maximum penalty | Up to €20M or 4% of global annual turnover (most serious Article 83 violations; not realistic exposure for a small site with a stale banner). | Up to $2,663 per violation ($7,988 for intentional or minor-involving violations); private right of action of $107–$799 per incident for certain breaches. |
Why This Actually Matters for Your Site, Not Just in the Abstract
If your WordPress site can be reached by EU or UK visitors — which, unless you’ve geo-blocked the region, it can — the ePrivacy/GDPR combination applies the moment you set a non-essential cookie, no matter your traffic or revenue. That’s the one with no small-business door to walk through. CCPA/CPRA is the one most WordPress site owners in this series’ audience won’t actually be legally required to comply with yet, because most personal blogs, niche review sites, and small WooCommerce stores don’t clear $26.6 million in revenue or handle 100,000+ Californians’ data a year. But two things make it worth building for anyway: first, a lot of consent plugins (see our plugin roundup — Complianz in particular) handle GDPR, CCPA, and a dozen other regimes in the same free tier, so there’s rarely a reason to configure for GDPR only; second, CCPA’s thresholds are revenue-based, and a site that starts small doesn’t always stay that way.
The Other State Laws You’ve Probably Heard Of
CCPA isn’t the only U.S. state privacy law anymore — it’s just the oldest and best-known. As of 2026, twenty U.S. states have comprehensive consumer privacy laws in effect, including three (Indiana, Kentucky, and Rhode Island) that took effect January 1, 2026. Most of the newer ones — Colorado, Connecticut, Virginia, Utah, Oregon, Texas, and the rest — largely follow Virginia’s template rather than California’s or the EU’s: opt-out by default, revenue/volume thresholds, and (increasingly) a requirement to honor the Global Privacy Control signal specifically. Twelve states now require GPC compliance by law: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas. Practically, if your consent plugin already honors GPC for CCPA, you’re most of the way to compliant with the other eleven states’ GPC requirement too — it’s one signal, not twelve separate integrations.
What’s Actually Changing Right Now
Two developments are worth knowing about. First, the long-proposed EU ePrivacy Regulation — which would have replaced the 2002 Directive outright — was formally withdrawn by the European Commission (approved July 16, 2025; published October 6, 2025). The current ePrivacy Directive and GDPR remain the binding law exactly as described above; nothing in this withdrawal changes what your site needs to do today.
Second, and still genuinely unsettled: the EU’s November 2025 “Digital Omnibus” package proposed folding cookie-consent rules directly into the GDPR through two new articles, 88a (consent mechanics — a single-click refusal option, equal-prominence accept/decline design, and a cooldown before re-prompting someone who refused) and 88b (a more ambitious browser- or OS-level consent signal that sites would have to recognize automatically, similar in spirit to Global Privacy Control). Since then, the text has moved more than once in Council negotiations: a Council position reported around June 18, 2026 dropped Article 88b while keeping 88a; a separate Council Presidency compromise dated June 22, 2026 did the opposite — proposing to delete Article 88a and revert cookie consent entirely to the existing ePrivacy Directive, while leaving 88b’s browser-signal idea “still under discussion” pending a Coreper-flagged impact assessment. As of the most recent check we could verify (mid-September 2026), that second, more recent position — 88a proposed for deletion, 88b undecided — is the latest documented state, though the Council’s own negotiating mandate has itself been repeatedly delayed, and the European Parliament hasn’t taken a position on either article yet. None of this has reached a final, adopted text, so treat it as a live negotiation to watch rather than a rule to comply with: the current ePrivacy Directive and GDPR described in this piece remain exactly what applies to your WordPress site right now, regardless of which way the Digital Omnibus eventually lands.
Bottom Line
Think of it less as three competing laws and more as two layers plus one outlier: ePrivacy is the door (can you set the cookie at all, and did you ask first), GDPR is the house (what you’re allowed to do with the data once you’re in), and CCPA/CPRA is a different building altogether that assumes entry is fine by default and regulates the exit instead. A WordPress site reachable from the EU/UK needs to satisfy the door-and-house combination regardless of size; a site that also crosses CCPA’s revenue or volume thresholds needs the opt-out mechanics on top of that. Most consent plugins worth using (see our roundup) are built to handle all of this — and the dozen-plus U.S. state laws behind it — from one configuration screen, which is the practical reason to set one up correctly once rather than chase each law individually.
For the practical “now what” — do I need a policy page, a banner, or both — see our companion piece, Do You Need a Cookie Policy on Your WordPress Site? And if you haven’t picked a tool yet, start with our plugin roundup.
Sources
- eur-lex.europa.eu — Directive 2002/58/EC (ePrivacy Directive) and Regulation (EU) 2016/679 (GDPR), including Article 83 fine tiers
- European Commission — formal withdrawal of the proposed ePrivacy Regulation (approved July 16, 2025; published October 6, 2025)
- cppa.ca.gov — “Updated Monetary Thresholds in CCPA” (CPI adjustment effective January 1, 2025): revenue exemption, administrative fine, and private-right-of-action figures
- cppa.ca.gov enforcement announcements — American Honda Motor Co. (March 2025) and Todd Snyder (May 2025) cookie/opt-out enforcement actions
- clym.io and multistate.us — 2026 U.S. state comprehensive privacy law tracker and 12-state Global Privacy Control requirement list
- EDRi — analysis of the Digital Omnibus Council compromise text (Articles 88a/88b safeguards)
- PPC Land — EU Council drops cookie signal after Google lobbying (June 18, 2026 Council position: Article 88b dropped, 88a retained)
- praxikon.com — Digital Omnibus and the GDPR tracker (June 22, 2026 Presidency compromise: Article 88a proposed for deletion, 88b still under discussion; checked Sept 15, 2026)
