LGPD, GDPR, and CCPA are data privacy regulations like so many others that are coming into force.
And, like all regulations, their text is long and detailed.

To simplify understanding, we've outlined the key similarities and differences. There are six main differences:

• LGPD applies throughout Brazilian territory.
• GDPR is applicable across the entire European Union.
• CCPA is specific to the state of California, USA. It's important to note that only data subjects residing in California fall under this law; in other words, the law applies to anyone doing business in the state.

The California law is also the one with the most detail behind it — revenue thresholds, the "sale" versus "sharing" distinction, and two mandatory links on the homepage. We cover all of it in our guide to the CCPA and cookies.

However, it's a misconception to think that these regulations are mere replicas of each other just because they concern data protection and privacy. Compliance with one doesn't guarantee compliance with the others.

• GDPR applies to personal data of data subjects, which includes users, whether they are customers or mere visitors to a website.
• CCPA applies to consumers, households, and residents.

1. For LGPD, personal data refers to any information related to an identified or identifiable person. Some information doesn't personally identify you; you remain anonymous. However, other information, like names, emails, and personal documents, can identify you individually.
2. For CCPA, personal data is any information that individually identifies a person or household. Anonymous data is not considered personal.
3. For GDPR, all of the above is considered personal data. There are even two distinct categories: data made public by the data subject and data related to nonprofit organizations.

Among these definitions of personal data, there's a more special category: sensitive data.

Sensitive data includes information revealing racial or ethnic origin, political beliefs, religious or philosophical affiliations, union membership, and matters related to health and sexuality.

Unlike LGPD and CCPA, GDPR prohibits the use of sensitive data unless such use is provided for by law.

LGPD and GDPR, within their respective territories, apply to all data processing except for personal use. Whether it's a company, NGO, or government institution, the law applies.

CCPA is different in this regard. It specifically applies to:

1. Companies with an annual gross revenue exceeding $25 million.
2. Companies that obtain data from more than 50,000 consumers, households, or devices.
3. Companies that generate over 50% of their revenue from selling personal information.

In LGPD and GDPR, the sale of personal data requires a legal basis prescribed by the law. It's not something anyone can do.

On the other hand, CCPA doesn't prohibit the sale of data. It only provides the option for the data subject to opt out of having their data sold. In other words, a person can agree or disagree with the sale of their data, and the company must respect that choice.

GDPR, LGPD, and CCPA impose different fines and penalties, so each one should be consulted separately. In this article, you can find more details about LGPD fines and penalties.

We've already seen that there are significant differences between the three regulations. So, what are the similarities?

All three regulations ensure transparency regarding data usage, including whether data is being processed, whether it can be sold, and the purpose behind these actions.

All three regulations allow users to revoke data consent and ensure they can update their data whenever they wish.

The regulations establish a governmental authority to ensure compliance. In the case of LGPD, it's the National Data Protection Authority. For CCPA, it's the Attorney General of the State of California.

As discussed in the previous sections, the laws apply to their respective territories. If your company handles data from Californians and Brazilians, you need to be fully aware of CCPA and LGPD. If your company processes data of European Union customers, GDPR compliance is necessary.

However, in practice, this is simpler. Since LGPD is based on GDPR, it's easy to align with both regulations. Given that all three are based on principles of transparency and consent, three steps will ensure that your website doesn't run into issues with any of these laws.

One thing LGPD, GDPR, and CCPA have in common is their emphasis on transparency and consent, which underpin the entire law.

What does this mean in practice?

Every user needs to know that their data is being collected and for what purpose your company will process this data. This information needs to be explicit. Knowing this, the user needs to agree. This is transparency and consent.

If the user doesn't agree to data processing, they should be able to express this decision clearly and directly. Your company should respect this choice without pressuring the user to provide data.

However, manually managing this process would make operations for any company complex. To streamline this service, we move on to the second step.

A cookie banner is a text notice, similar to what you saw when entering this blog. The cookie banner informs the user that the site collects data and requests the user's consent for data collection. The cookie banner also explains the purpose of collecting this information.

Most importantly, it records all of this. We can prove which data you agreed to provide, which is crucial for legal compliance. Moreover, through the cookie banner, you can specify which data you want to provide and which you don't, or even refuse to provide any information. And that's perfectly fine.

To ensure this operation runs smoothly, LGPD, GDPR, and CCPA require that each company has a responsible person. This professional is called a DPO: Data Protection Officer, which is the third step.

DPO stands for Data Protection Officer. Your company can outsource this service or select an internal employee for this role.

The DPO is legally responsible for the company's data protection policy, acting as the liaison between the company and the data protection authority. In the case of LGPD, this authority is the ANPD. For CCPA, it's the Attorney General of California.

With these best practices, your company is assured in this ever-changing landscape and extensive debate on data usage.