People search for a GDPR statement expecting a paragraph they can paste into a footer. There is no such thing in the regulation. What the regulation requires is a set of information given to the person whose data you are collecting, at the time you collect it, in clear language. That set is what a privacy notice is, and a US company serving European visitors publishes one notice that carries both its California and its European obligations.
The information that has to be given
Who the controller is and how to contact them. The purposes of the processing and the legal basis for each. Where a legitimate interest is claimed, what that interest is. Who receives the data, including any recipient outside the region and the safeguard used. How long it is kept, or the criteria for deciding. The rights a person has, which include access, correction, erasure, restriction, portability and objection, and the right to complain to a supervisory authority. Whether providing the data is a statutory or contractual requirement. And whether there is automated decision making.
Where it goes
At the point of collection, which means the form, not only the footer. A sign-up form links to the notice beside the button; a checkout does the same; an offline collection does it on the paper. The footer link is the permanent address of the document, and the contextual link is what discharges the duty, because the duty is to inform the person at the time, not to have the information available somewhere for a person who goes looking.
Why a compliance badge is worse than nothing
A footer graphic asserting GDPR compliance is a claim about your own conduct, made to consumers, with nothing behind it. It is the shape of claim a regulator treats as a representation, and if the processing behind it is not what the badge implies, the badge is the evidence. Publish the notice, keep it true, and let the notice be the statement. Nobody has ever been reassured by a badge who was not already reassured by the page.
One notice, two regimes
A single privacy notice can carry both sets of duties without reading like a statute. Keep one structure: what we collect, why, who gets it, how long, your rights, how to exercise them, how to complain. The European obligations add the legal basis and the transfer safeguard. The California obligations add the categories sold or shared, the retention statement and the opt-out. Nothing about those two lists forces you to write two documents, and two documents drift apart the first time a tool changes.
Questions people ask about GDPR statement
Is a GDPR statement the same as a privacy policy?
In practice yes. What people call a GDPR statement is the transparency information the regulation requires, and the natural home for it is the privacy notice you already publish.
Do we need one if we only have a handful of EU users?
The regulation does not have a volume threshold. Offering goods or services to people in the region is what brings you in scope, and one customer is enough to start the argument.
Can we say we are GDPR compliant?
You can describe what you do. Asserting compliance as a status is a claim you have to be able to evidence, and the evidence is the register, the notice, the agreements and the request record, not the sentence.
Does the notice need a lawful basis for every purpose?
Yes, per purpose rather than per company. Marketing email, order fulfillment and fraud checks can each sit on a different basis, and a notice that names one basis for everything is usually wrong about at least one of them.