Privacy Laws 2026: GDPR, CCPA, LGPD — Your Rights Practical Guide

Three laws frame the personal data ecosystem in 2026 — the European GDPR (since 2018), the Californian CCPA/CPRA (2018 strengthened 2023), and the Brazilian LGPD (2020). Together, they cover ~700 million people and structure compliance of tech giants (Meta, Google, Amazon, Apple, Microsoft) across most of the Western and Latin world. Understanding which rights you can exercise, how to exercise them concretely, and what to do when a company ignores them — that's the topic of this practical 2026 guide.

EU GDPR — global standard in 2026

The General Data Protection Regulation (GDPR), in force since May 25, 2018, remains in 2026 the global reference for personal data protection. Six years after entry into force, the compliance ecosystem has matured: mandatory DPOs in any organization processing > 250 employees or sensitive data, standardized records of processing activities, impact assessments (DPIA) integrated into product processes at most EU tech companies.

Scope: 27 EU + 3 EEA countries (Norway, Iceland, Liechtenstein), covering ~450 million inhabitants. GDPR also applies to non-EU companies targeting EU residents (extraterritoriality art. 3) — that's why Meta, Google, Amazon, Microsoft apply GDPR globally to their European users.

Six fundamental rights enshrined in articles 15 to 22:

• Right of access (art. 15): obtain a copy of all data concerning you.
• Right to rectification (art. 16): correct inaccurate or incomplete data.
• Right to erasure / forgotten (art. 17): have data deleted when processing is no longer justified.
• Right to restriction (art. 18): temporarily freeze processing.
• Right to portability (art. 20): retrieve your data in structured, commonly readable format to transfer to another provider.
• Right to object (art. 21): refuse certain processing, especially direct marketing (absolute) or legitimate interest (conditional).

Standardized exercise procedure:

1. Identify the data controller (the company deciding why/how your data is processed) and its DPO (Data Protection Officer).
2. Send a written request to the DPO with: identity, nature of request, desired format.
3. The company has 1 month to respond (extendable 2 months for complexity).
4. In case of refusal or non-response: complaint to your national supervisory authority (CNIL France, ICO UK, AEPD Spain, Garante Italy, Datatilsynet Norway).

Record fines 2024-2026

GDPR has demonstrated its deterrent reach with record sanctions:

2025-2026 trend: CNIL multiplies medium sanctions (€5-50M) on cookie consent — 73% of French sites were non-compliant in January 2026 per CNIL annual audit.

CCPA / CPRA California — opt-out model

The California Consumer Privacy Act (CCPA) entered into force January 1, 2020, strengthened by the California Privacy Rights Act (CPRA) on January 1, 2023. It protects California residents defined as natural persons residing in California regardless of nationality.

Fundamental difference from GDPR: CCPA follows the opt-out model by default (collection is authorized unless you object), whereas GDPR follows opt-in (prior consent required). This model reflects more permissive American legal culture on ad processing.

Application scope: companies meeting at least one of three criteria:

• Global annual revenue > $25M USD; OR
• Processing > 100,000 California consumers or households/year; OR

• 50% of revenue from sale or sharing of personal data.

Seven CPRA rights (extended from initial CCPA):

1. Right to Know — Request which categories and specific elements of data are collected. Response in 45 days, extendable.
2. Right to Delete — Have data deleted (with legal exceptions).
3. Right to Correct — Correct inaccurate information (added by CPRA 2023).
4. Right to Opt-Out of Sale — Refuse sale to third parties. "Do Not Sell or Share My Personal Information" button mandatory in footer.
5. Right to Opt-Out of Sharing for Cross-Context Behavioral Advertising — Refuse sharing for cross-context behavioral advertising purposes (added by CPRA 2023).
6. Right to Limit Use of Sensitive Personal Information — Limit use of sensitive data (precise geolocation, health, finance, communication content). New CPRA right.
7. Right to Non-Discrimination — No commercial disadvantage if you exercise your rights.

Execution: via company dedicated form (typically privacy@ page), or complaint to California Privacy Protection Agency (CPPA), created by CPRA in 2023. CPPA has direct sanctioning power since July 2023.

Practical impact for European users

CCPA does not apply to European residents, except temporary travel to California. But in practice, many tech companies apply CCPA rights globally for operational simplicity — that's the "California effect": the strictest standard becomes the default standard.

Concretely, in May 2026:

• The "Do Not Sell or Share My Personal Information" button appears on ~85% of US sites visible from US IP.
• Many US sites hide it from non-US IPs — using a US VPN allows displaying and exercising it (with CA postal address provided).
• Apple generalized App Tracking Transparency to all global users following CCPA (April 2021).

LGPD Brazil — Latin America 2026

The Lei Geral de Proteção de Dados (LGPD), in force since August 18, 2020, transposes the GDPR model to Brazil. Scope: 215 million Brazilians + companies processing Brazilian residents' data even outside Brazil.

Six legal bases identical to GDPR: consent, contract performance, legal obligation, vital interest, public interest, legitimate interest. User rights quasi-identical: existence confirmation, access, correction, anonymization/blocking/elimination, portability, information on third-party sharing, consent withdrawal.

Sanctions: up to 2% of Brazilian revenue capped at 50 million Brazilian Reais (~€9M) per infraction. Significantly weaker than GDPR but represents real risk for Brazilian players. 2024-2025 records:

• Cielo (payment) — 7M BRL (~€1.3M) for non-consented sharing with marketing partners.
• Locaweb (hosting) — 2.5M BRL for security breach not declared to ANPD.

The ANPD (Autoridade Nacional de Proteção de Dados) regulator, operational since 2020, progressively ramps up in 2025-2026.

How to concretely exercise your rights

Unified procedure applicable GDPR / CCPA / LGPD:

Step 1 — Identify the contact

Step 2 — Draft the request

Minimal template for GDPR right of access:

Subject: Exercise of GDPR right of access (art. 15)

Dear DPO,

I wish to exercise my right of access under Article 15 of the GDPR. Please provide me, within the one-month deadline of Article 12.3:

1. The complete copy of personal data concerning me that you process;
2. The purposes of processing;
3. Categories of recipients (third parties, providers, partners);
4. Expected retention duration;
5. The origin of data if not collected from me.

I attach a copy of my ID for verification.

[Name, address, relevant account identifiers]

Keep a trace of the sending (email with read receipt, registered mail). This trace is necessary in case of supervisory authority complaint.

Step 3 — Follow-up and escalation

Step 4 — Complaint if refused

GDPR/CCPA pitfalls to know in 2026

Pitfall 1 — Dark patterns on consent. 73% of French sites in 2026 still use deceptive designs: colored "Accept" button vs grayed "Refuse" at page bottom, mandatory scroll before refusal, banner re-display on each visit if refused. CNIL multiplies sanctions (Yahoo €10M January 2025). To detect: if refusal takes more than 2 clicks, it's non-compliant.

Pitfall 2 — Fake DPO or generic form. Many companies list a generic "contact" form instead of a reachable DPO. GDPR requires dedicated DPO email. If the company doesn't provide one, that's a GDPR violation in itself (art. 37-39).

Pitfall 3 — Partial response to right of access. Meta has been fined several times (DPC 2023, CNIL 2024) for providing incomplete exports — omitting ad inferences, engagement models, inference data. Verify the export received: must contain > 50 JSON/CSV files for a Meta account > 5 years old.

Pitfall 4 — "Anonymized data" not really anonymous. Many companies argue that "pseudonymized" data no longer falls under GDPR. False — pseudonymized data remains personal per CJEU (CFLA 2019, OC Vilnius 2023 rulings). Only truly anonymous data (irreversible, k-anonymity > 5) escapes GDPR.

Pitfall 5 — Unframed international transfer. Since Privacy Shield invalidation (CJEU Schrems II, July 2020), transfers to USA require Standard Contractual Clauses + EU-US Data Privacy Framework (July 2023). Check privacy policy: DPF mention must appear explicitly for US transfers.

Practical tools 2026

Key takeaways

GDPR, CCPA/CPRA and LGPD constitute in 2026 the global legal trio framing the personal data ecosystem. Your rights are real and enforceable — not symbolic. Exercise requires method (dedicated DPO email, 30/45-day follow-up, escalation to regulator if refused) but succeeds in most cases. Record fines (Meta €1.2 Bn, Amazon €746M) prove regulators have the means to impose compliance on tech giants.

Combining these legal rights with technical tools (audited no-log VPN, DoH, ECH, privacy browser) maximizes effective protection. GDPR provides the framework, technical tools execute day-to-day protection. See our audited no-log VPN comparison and our DNS over HTTPS guide for the technical layer.