VaferEurope asks permission first; California asks forgiveness never — it demands an exit. GDPR is an opt-in regime: non-essential tracking may not run until the visitor agrees. CCPA and its sibling state laws are opt-out: tracking may run, but saying no must be one easy click, and it must actually work.
The practical differences, side by side
| GDPR (EEA + UK) | CCPA-style (California + other US states) | |
|---|---|---|
| Model | Opt-in — consent before tracking | Opt-out — tracking until objection |
| Defaults before choice | Everything non-essential OFF | May be ON |
| Required UI | Banner with equal Accept / Reject | “Do Not Sell or Share My Personal Information” link |
| Automatic signals | — | GPC must be honoured, no click needed |
| Pre-ticked boxes | Invalid | N/A (nothing to tick) |
| Applies to you when | You have EEA/UK visitors, regardless of your size | Thresholds on revenue / data volume, varies by state |
What this means for a Shopify banner
One banner shown identically to the whole world gets at least one region wrong. Show an opt-out banner to Germans and you're tracking EU visitors without consent; show a strict opt-in wall to Texans and you're paying a conversion cost no law asked of you. The pattern that fits both: resolve the visitor's region first, then apply that region's rule — opt-in with everything held for the EEA and UK, opt-out with the required link for the US, and a deliberate choice everywhere else.
Two traps merchants hit
The symmetric-buttons rule
EU regulators have repeatedly faulted banners where accepting takes one click but rejecting takes three. Reject must be as easy as Accept — same screen, same prominence.
The opt-out that doesn't do anything
A “Do Not Sell” link that sets a flag nobody reads is worse than none: it documents that you knew. The click has to flow into something enforced — on Shopify, that means writing sale_of_data: false to the Customer Privacy API and stopping the marketing trackers.