Texas Data Law

Insight

California’s New Privacy Regulations Took Effect Before Their Staged Compliance Dates

Which California privacy duties apply now and which have separate transition deadlines.

Compliance · All industries · Event date: January 1, 2026 (effective date) · For general counsel, privacy leads, and business operators

California's newest privacy regulations took effect January 1, 2026. Many of their duties start later, some not until 2030. A business that reads the later dates as the start dates will miss the obligations that already apply. The California Privacy Protection Agency adopted the package, and the Office of Administrative Law approved it on September 22, 2025. It amends the CCPA regulations, 11 C.C.R. §7000 et seq., and adds rules on risk assessments, cybersecurity audits, and automated decisionmaking technology (ADMT).

The schedule

DutySchedule and qualification
Revised consumer-facing regulationsEffective January 1, 2026; includes the revised opt-out-signal display requirement in §7025(c)(6)
Assessment for covered new processingBefore beginning covered processing on or after January 1, 2026, §7155(a)
Assessment for covered continuing pre-2026 processingComplete by December 31, 2027, §7155(b)
Risk-assessment submission information for 2026 to 2027 assessmentsDue April 1, 2028, §7157(a)(1)
Covered ADMT usesCompliance by January 1, 2027 for existing covered uses; compliance while using covered ADMT thereafter, §7200
First audit report: applicable business with more than $100 million in 2026 revenueApril 1, 2028; audit period January 1, 2027 to January 1, 2028, §7121(a)(1)
First audit report: applicable business with $50 to $100 million in 2027 revenueApril 1, 2029; audit period January 1, 2028 to January 1, 2029, §7121(a)(2)
First audit report: applicable business with less than $50 million in 2028 revenueApril 1, 2030; audit period January 1, 2029 to January 1, 2030, §7121(a)(3)

Reports are not certifications

The audit-report deadlines in §7121 are distinct from the certification requirement in §7124. Section 7124(a) through (b) requires a certification for each required audit year and sets its April 1 submission rule. Do not assume every CCPA business must conduct an audit: assess audit applicability under §7120 first, then assign the revenue tier.

Why the effective date matters

Two duties began in January 2026 and are easy to overlook. First, risk assessments. A business that starts significant-risk processing in 2026 must assess it before it begins. The April 2028 date is when the Agency first collects the results, not when the work is due. An assessment written in 2028 for processing started in 2026 is late. For a covered activity begun in 2025 and continuing into 2026, the transition deadline is December 31, 2027.

Second, the amended consumer-facing rules. The package revised the right-to-know, dark-pattern, and opt-out-signal provisions; those amendments applied on January 1, 2026 with no phase-in. Neural data is not a 2026 addition: SB 1223 (2024) added it to the sensitive-personal-information definition effective January 1, 2025. The opt-out-signal display rule says a business must display whether it honors the signal (§7025(c)(6)).

A concrete example: a covered business starts a new significant-risk processing activity in July 2026. Its assessment belongs before launch, even though its first submission of required assessment information is due in April 2028.

Applicability comes first

None of this matters unless the CCPA applies: the business definition, the California nexus, the thresholds, and the relevant exceptions. An organization cannot yet know its eventual 2027 or 2028 revenue with certainty; it should forecast and reassess. A TDPSA assessment can be reused only insofar as it contains or is supplemented with the California-required information, under §7156.

The Texas angle

Whether these rules reach a Texas company turns on the CCPA's business definition, its California nexus, and the statutory thresholds, subject to the statute's exceptions. A covered company can reuse a TDPSA assessment, required by §541.105, only insofar as it contains or is supplemented with the California-required information, under §7156. The California regime also requires filing assessment information with the regulator, which Texas does not.

Sources

Related