10/13/2026
Does your nonprofit collect data from supporters in California or the EU? If so, privacy laws apply to you — regardless of where your organization is based.
GDPR and CPRA aren't just for large corporations. They apply based on where your donors, members, and volunteers live. And with more US states passing similar laws, the list of places that matter is growing.
The practical side is manageable. A consent banner that blocks tracking scripts until visitors approve them. A CiviCRM extension that logs subscription changes and supports data subject requests. A clear two-step process when someone requests their data be deleted — because personal data lives in both your Drupal user records and your CiviCRM contacts, and both need to be addressed.
We wrote up a plain-language guide covering which laws apply, what they actually require, and which tools handle the technical heavy lifting.
https://f.mtr.cool/22jakkm0id
A nonprofit guide to GDPR and US state privacy law compliance, covering data subject rights, Klaro consent management, the CiviCRM GDPR extension, and the two-step contact anonymization process.