Texas Data Law

What Is

What Is the CCPA (California Consumer Privacy Act and CPRA)

The California Consumer Privacy Act (CCPA), Civil Code §1798.100 and following, took effect January 1, 2020. The California Privacy Rights Act (CPRA), approved by voters in November 2020, amended it, created the California Privacy Protection Agency, and took effect January 1, 2023.

The CCPA applies to a for-profit business that does business in California, determines the purposes and means of processing consumers' personal information, and meets any one of three tests: annual gross revenue above $25 million in the prior year, adjusted for inflation to $26,625,000 from January 1, 2025; buying, selling, or sharing the personal information of 100,000 or more California consumers or households a year; or earning half or more of its revenue from selling or sharing personal information (§1798.140(d)).

California residents may know what personal information a business collects, delete it, correct it, opt out of its sale or sharing for cross-context behavioral advertising, limit the use of sensitive personal information, and exercise those rights without discrimination. Businesses must honor opt-out preference signals.

The Agency and the Attorney General enforce the law, with fines of up to $2,663 per violation or $7,988 per intentional violation or violation involving the personal information of a consumer under 16 that the business actually knew was under 16 (2025 adjusted amounts; the next adjustment is January 2027). Consumers may bring the CCPA's private action for specified security breaches involving nonencrypted and nonredacted personal information listed in Civil Code 1798.81.5(d)(1)(A), or an email address combined with a password or security question and answer permitting account access, when the breach results from a business's failure to maintain reasonable security. Available damages are actual damages or statutory damages of $107 to $799 per consumer per incident, whichever is greater; statutory-damages claims are subject to the law's 30-day notice-and-cure provisions (1798.150). Installing reasonable security after the breach does not by itself cure the breach.

The regulations took effect January 1, 2026, with distinct obligations and stages. Required risk assessments for covered processing already underway must be completed by December 31, 2027; the first agency submission of specified assessment information and an executive attestation is due April 1, 2028. Section 7121 sets first cybersecurity-audit-report completion dates of April 1, 2028, 2029, or 2030 according to its revenue bands and covered periods. Section 7124 separately requires certification by April 1 following a year in which an audit must be completed. Covered ADMT uses before January 1, 2027 must comply by that date; covered uses on or after that date must comply whenever the technology is used. Determine assessment, audit, and ADMT coverage separately.

Why it matters in Texas. Many Texas businesses serve California residents and must follow the CCPA for that data even though Texas law differs. The Texas Data Privacy and Security Act has no revenue threshold, exempts SBA-defined small businesses instead, gives no private right of action, and is enforced only by the Attorney General.

Pinpoint: Cal. Civ. Code §1798.100 et seq.; Cal. Code Regs. tit. 11, §7000 et seq..

Related