GDPR vs CCPA vs HIPAA: which applies to your website?

Three laws with three different jobs

The quickest way to understand the difference is to ask what each law protects and who it binds.

• GDPR protects any personal data about people in the EU, and UK GDPR does the same for people in the UK. It binds businesses established there, and businesses elsewhere that offer goods or services to people there or monitor their behaviour online, for example with analytics or advertising cookies.
• CCPA, the California Consumer Privacy Act as amended by the California Privacy Rights Act, protects personal information about California residents. It binds for-profit businesses that do business in California and meet at least one size or data threshold.
• HIPAA, the US Health Insurance Portability and Accountability Act, protects protected health information. It binds covered entities, meaning healthcare providers that bill electronically, health plans and healthcare clearinghouses, plus their business associates.

So the questions are not alternatives. Asking GDPR or CCPA is really asking whether you have UK or EU visitors and whether you are a sizeable business with Californian customers. Asking GDPR or HIPAA is asking whether you serve people in Europe and whether you are part of the US healthcare system. Both answers can be yes.

GDPR, CCPA and HIPAA side by side

The biggest practical difference for a website is the consent model. Under GDPR and PECR you ask first and set non-essential cookies only after a yes. Under the CCPA you may collect by default, but you must say what you collect at or before collection and let people opt out of their data being sold or shared for cross-context behavioural advertising.

How to work out which laws apply to you

Answer these questions in order and write the answers down; they form part of your records.

1. Are you established in the UK or EU? If yes, GDPR applies to everything you do.
2. If not, do you target people there? Prices in pounds or euros, delivery to Europe, local language pages or advertising aimed there all point to yes. So does tracking their behaviour with analytics or advertising cookies.
3. Do you do business in California? If so, check the three CCPA thresholds against your last calendar year. Revenue counts worldwide, not only Californian sales.
4. Are you a healthcare provider that bills insurers electronically, a health plan, or a clearinghouse? If yes, HIPAA applies to your patient information.
5. Do you handle health information for one of those? A developer, host or marketing agency working for a clinic is likely a business associate.

Your server logs and analytics show where visitors come from. A quick look at country data tells you whether UK or EU visitors are more than occasional, and checkout data shows where you ship.

What to change on the site for GDPR

• A cookie banner that blocks non-essential cookies until consent, with equal Accept and Reject options. See cookie consent.
• A privacy notice that gives your lawful basis for each purpose, recipients, transfers, retention and rights. See privacy policy.
• Unticked opt-in boxes for marketing on forms.
• Processor agreements with every provider that receives personal data, and a transfer safeguard for those outside the UK or EU.
• A way to handle access, deletion and correction requests within one month.

If you are outside the UK and EU but GDPR applies, you may also need a representative there. The full ordered list is in the GDPR compliance checklist.

What to change on the site for the CCPA

If you sell or share personal information, which includes letting advertising pixels collect data for cross-context behavioural advertising, you need a clear link in the footer:

<footer>
  <a href='/privacy-choices'>Do Not Sell or Share My Personal Information</a>
</footer>

A single Your Privacy Choices link with the official icon can replace it. The page it leads to must let visitors opt out without creating an account.

You must also treat a Global Privacy Control signal as a valid opt-out. Browsers and extensions that support it send a Sec-GPC: 1 request header and expose a JavaScript property:

if (navigator.globalPrivacyControl === true) {
  // Treat as an opt-out of sale and sharing:
  // do not load advertising pixels for this visitor
  window.optOutOfSale = true;
}

On the server you can check the header instead, for example in nginx with $http_sec_gpc. Other items for the site:

• A privacy policy describing the categories of information collected, the purposes, the categories of third parties, and the rights to know, delete, correct, opt out and limit use of sensitive information. Review it at least every 12 months.
• At least two ways to make requests. A business that operates only online and deals directly with consumers can offer just an email address.
• Service provider terms with vendors that limit how they may use the data.

What to change on the site for HIPAA

For a covered entity, the website risk is usually not the brochure pages but anything that ties a person to health information: appointment forms, symptom checkers, patient portals and the tracking tags that run on them.

• Tracking tags. US Department of Health and Human Services guidance says tracking technology on authenticated pages, such as a patient portal, can disclose protected health information to the tag vendor. A 2024 court ruling struck down part of that guidance about some public pages, but tags on logged-in or appointment pages remain a clear risk. Remove advertising and analytics tags from those pages unless the vendor signs a business associate agreement.
• Forms. Send health information from forms over https into a system covered by a business associate agreement, not into ordinary email or a general form builder.
• Hosting. Your host, form tool, email provider and any developer with access to patient data need business associate agreements.
• Security. The HIPAA Security Rule requires risk analysis, access controls, audit logs and encryption appropriate to the risk.

To see which third parties a patient page talks to, list the hosts in the DevTools Network panel while you are signed in, and check each one against your list of signed agreements.

The fix, step by step

Edge cases worth knowing

• A UK clinic with US patients. It is under UK GDPR, but HIPAA does not apply unless it is a US covered entity or works for one.
• A US practice with European visitors. Treating EU residents who travel to the US may not bring GDPR into play, but actively marketing to or tracking people in Europe can.
• Small Californian businesses. Below all three thresholds the CCPA does not apply, though California's other privacy and breach rules still do.
• B2B and employee data. The CCPA now covers employee and business contact information too, after temporary exemptions expired in 2023.
• Fines. GDPR fines reach 4% of worldwide turnover, the CCPA allows thousands of dollars per violation, and HIPAA penalties are tiered by how culpable the failure was.

Keeping it right

1. Write down which laws apply and why, and revisit the decision each year when revenue, customer numbers or markets change.
2. Build one banner and one privacy setup that satisfies the strictest law that applies, and add the CCPA link and GPC handling on top where needed. This is simpler than separate versions per region.
3. Check every new tag or plugin against all applicable laws before it goes live, especially on forms and logged-in pages.
4. Keep vendor agreements of each type in one place: data processing agreements, service provider terms and business associate agreements.

A GDPR scan shows which trackers your pages load and whether they wait for consent, and the GDPR guide explains the European rules in more depth.