Privacy, advertising, and sector rules - handled before they handle you.

It depends on where your customers live and what data you collect, not where you are headquartered. California's CCPA/CPRA, the Texas Data Privacy and Security Act, and an expanding list of other state laws each have their own thresholds and obligations. Most Austin small businesses serving U.S. consumers end up subject to at least two or three state regimes simultaneously, plus GDPR if any users come from the EU/UK. We run an applicability matrix as the very first step.

In practice, always. Even before any state privacy law applied, the FTC has treated the absence of a privacy policy as a deceptive practice under Section 5 if you collect personal information. California's CalOPPA has required one since 2004 for any commercial website that collects personally identifiable information from California residents. We treat a current, accurate privacy policy as table stakes for any business with a website and any data collection.

The Texas Data Privacy and Security Act took effect on July 1, 2024, with the cure period and certain provisions phasing in. It applies to businesses that conduct business in Texas or produce products or services consumed by Texas residents, with a small-business carve-out keyed to the federal Small Business Administration definition. The Texas Attorney General has enforcement authority and a 30-day cure period applies - private rights of action are not allowed under the statute.

COPPA applies if your service is directed to children under 13 or if you have actual knowledge that you are collecting personal information from children under 13. Mixed-audience services - those directed at both children and adults - can be subject to COPPA for the under-13 portion of the audience and have to implement age screens and parental consent for those users. The consequences are significant, with per-violation penalties and lengthy FTC consent decrees, so this is a question to answer with counsel before launching.

Within the first 24 hours: contain the incident, preserve forensic evidence, and engage outside counsel under privilege to direct the investigation. Inside the first week: scope the affected data, identify legal notification triggers under state breach laws and any contractual obligations, and prepare notifications. Most state breach notification laws have specific timelines (often 30-60 days) and content requirements - missing them compounds the regulatory exposure on top of the breach itself.

With every vendor that processes personal data on your behalf, yes. CCPA, the Texas DPSA, Colorado CPA, Virginia VCDPA, and GDPR all require specific contractual terms between controllers and processors. Most vendors have a standard DPA you can sign and that gets you most of the way there - but we still recommend a legal review for any vendor handling sensitive categories of data or significant data volume.