Opt-In vs Opt-Out
The most fundamental difference lies in consent architecture. GDPR requires explicit, active consent (opt-in) before processing non-essential data. CCPA generally allows processing until a consumer explicitly says "Do Not Sell/Share My Personal Information" (opt-out).