GDPR and CCPA for nonprofits: what you really need to know

The basics: what data privacy regulations mean for your nonprofit

• In Europe and the UK: GDPR and UK GDPR set the world’s strictest standards for data privacy.
• In the U.S.: Privacy laws are emerging, with CCPA leading the way in granting individuals rights similar to GDPR — such as data access, deletion, and opt-out from sharing.
• In Canada and beyond: Other regions are adopting GDPR-style protections such as PIPEDA, making global compliance increasingly important.

At their core, GDPR and CCPA are about respecting donor rights. That means:

• Consent matters: You need explicit, informed consent before contacting supporters with marketing messages.
• Donors control their data: Supporters can decide how their data is used, request access to it, or ask for it to be deleted (“the right to be forgotten”).
• Vendors must comply too: It’s not just your nonprofit that needs to be compliant, your technology partners do as well.

Think of these regulations less as red tape and more as an opportunity: when donors feel their data is handled responsibly, their trust in your organization grows.

What if you’re outside these regions?

Even if your nonprofit isn’t legally bound by GDPR or CCPA, the principles still apply:

• If you accept donations from Europe, the UK, or California, you must comply.
• Even if you don’t, adopting these practices builds donor trust and prepares you for evolving privacy laws across North America and beyond.

What are the risks of non-compliance?

Regulators have shown they’re serious. Meta was fined €1.2 billion in 2023 for unlawful data transfers, Amazon €746 million in 2021 for cookie consent issues, and TikTok €345 million in 2023 for mishandling user data. Other examples include Google (€50 million in 2019, with larger penalties later) and H&M (€35.3 million for excessive employee monitoring).

While nonprofits won’t be hit with fines of this magnitude, these cases highlight why compliance can’t be ignored, and why choosing technology partners who are proactive about data privacy is critical.

Choosing a donation platform: what to check

If a vendor claims GDPR or CCPA compliance, don’t just take their word for it. Look for:

• Proof of compliance (documentation, not just a marketing claim)
• A Data Protection Officer or equivalent compliance lead
• The ability to delete donor data upon request
• Although GDPR is a set of guidelines, annual audits or reviews of compliance processes should be conducted
• Built-in tools for cookies and consent, so you’re not left scrambling

💡 Tip: Compliance should be visible in both the platform’s technology and their internal governance processes. If your current donation platform can’t demonstrate these, it’s time to reevaluate.

How Fundraise Up supports GDPR and CCPA compliance

At Fundraise Up, compliance isn’t an afterthought. It’s built into our platform and reviewed annually. We’ve partnered with trusted providers like Thoropass to ensure we meet GDPR and CCPA standards.

Here are some of the ways we help you stay compliant, too:

Marketing consents

Available in campaign settings, our consent options let you capture supporter preferences in line with regional requirements:

• No consent – Skip consent prompts where not required
• General consent – One checkbox for broad communication permissions
• Customized consent – Donors choose preferred channels (email, SMS, phone, post, etc.) for granular control

You can also enable a smart setting so consent options only appear in regions where they’re required, such as the EU, UK, Canada, and California.

Cookie management

Fundraise Up uses only first-party cookies — never third-party. Some are strictly necessary (for fraud prevention and security), while others support personalization or performance tracking.

• On Campaign Pages, we automatically display a built-in cookie banner for visitors in regions with strict privacy laws, such as the EU, UK, EEA, Quebec, and California. This helps keep your pages compliant and allows supporters to manage their consent.
• For Checkout on your site, you can integrate with leading cookie tools (like OneTrust or CookieYes) or Google Tag Manager’s Consent API to ensure donors can set preferences.

This ensures donors know what cookies are in use and can manage their preferences.

Data rights

We have implemented measures to ensure that all data collected through our platform is stored securely and that individuals have the right to access, delete, or opt out of sharing their personal information.

Why compliance matters for fundraising results

Strong privacy practices aren’t just about avoiding penalties — they drive trust, loyalty, and repeat giving.

• Donors who feel confident in your data practices are more likely to give again.
• Clear consent flows reduce confusion and increase conversion.
• Transparent cookie use makes your website feel trustworthy, not risky.

In the end, strong compliance strengthens relationships with supporters — and that translates into stronger revenue for your mission.