Three state breach notification laws and what they change in martech

What to take away

Why breach notification timelines change martech incident response

A breach notification timeline is a legal deadline that starts before your incident response is finished. That is the core change for marketing operations and martech. Your team may still be scoping the incident while the notification clock is already running.

Automation platforms hold identity data, consent records and behavioral events. A single customer profile can span a CRM, a marketing automation platform, a customer data platform and an ad tech vendor. The breach may be discovered in one system and affect data in four others.

Most marketing ops teams have response steps for campaign failures, not for regulator deadlines.

A practical first step is to map which platform fields are personal information under each state's definition. That map decides which clocks apply. It also decides who inside the company must be called at 2 a.m.

California, New York and Texas are not the only states with breach laws. They are the three that most often reach marketing databases because of how they define personal information and who must be told. Massachusetts, Illinois, Washington, Florida and Colorado add their own variations, but these three set the pattern.

Federal law overlaps but does not replace state law. The FTC Act covers unfair or deceptive data security practices, and CAN-SPAM governs commercial email. Neither sets a general breach notification deadline for customer data. State law does.

California: notification timelines, thresholds and the AG enforcement record

California's breach notification law applies to any person or business that owns or licenses computerized data containing personal information. The statute is California Civil Code Section 1798.82. If unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person, the business must notify affected California residents.

Personal information in California includes a name plus a Social Security number, driver's license number, financial account number, medical information, health insurance information, or a username or email address with a password or security question. That last item is common in marketing automation platforms.

California notification timelines: notice must be made in the most expedient time possible and without unreasonable delay. The statute does not give a fixed day count, but the attorney general has treated 30 days from discovery as the outer edge in practice.

If more than 500 California residents are affected, the business must also submit a sample copy of the notice to the attorney general.

California thresholds are low because they are content-based, not volume-based. One affected resident can trigger notice. The 500-resident figure triggers the attorney general sample submission, not the notice itself.

The California AG enforces the law through civil penalties and public settlements. The office maintains a privacy and data security page that covers both breach enforcement and CCPA enforcement.

The California AG privacy and data security page is the starting point for that record.

Enforcement examples matter for budget conversations. The California AG publishes settlements and actions on its press release page, and those releases show the pattern: failures to encrypt, failures to maintain reasonable security, and delays in notice. The California AG press releases list the cases by name and date.

For marketing ops, the CCPA and CPRA add a second layer. Personal information sold or shared with ad tech partners can create both a breach issue and a privacy rights issue. If your automation platform sends audiences to ad networks, your breach scope may include data you never stored yourself.

A useful internal test is to ask whether your platform could produce a notice list within 30 days. If it cannot, the timeline is already a risk. This is where marketing data governance work pays off before an incident.

New York: the SHIELD Act additions that reach marketing databases

New York's SHIELD Act amended the state's breach notification law and added a data security requirement. The SHIELD Act is New York General Business Law Sections 899-aa and 899-bb. It applies to any person or business that owns or licenses private information of a New York resident, even if the business is not in New York.

New York notification thresholds are broader than California's in one important way. Private information includes a username or email address in combination with a password or security question and answer that permits access to an online account. It also includes account numbers, credit or debit card numbers, and biometric information.

That means a marketing database with email addresses and hashed passwords can be in scope. So can a loyalty program, a customer portal login, or a webinar registration system that stores credentials. The SHIELD Act reaches marketing databases that older laws did not.

New York notification timelines: notice must be made without unreasonable delay. The law allows a delay if law enforcement determines that notice impedes a criminal investigation. The attorney general, the department of state, and the state police must be notified in the same manner as affected residents whenever resident notice is sent.

The SHIELD Act also requires reasonable safeguards for private information. Those safeguards are not a checklist, but the law names administrative, technical and physical measures. Encryption, access controls, and employee training are the usual evidence.

New York's attorney general has brought SHIELD Act cases against companies that failed to secure consumer data. The cases often cite weak credential management and missing multi-factor authentication. For marketing ops, that points at platform admin accounts and shared logins.

A common failure is a marketing automation platform with a single shared admin account and no MFA. That is not just a security problem. It is a notification problem, because you cannot prove who accessed what.

If your company serves EU customers, GDPR adds a 72-hour clock to the same incident. The New York clock and the GDPR clock can run at the same time. That is a coordination problem for legal and marketing ops, not a reason to delay either notice.

Texas: notification thresholds and who must be told

Texas breach notification applies to any person who conducts business in Texas and owns or licenses computerized data containing sensitive personal information. The statute is Texas Business and Commerce Code Section 521.053. The law uses the term sensitive personal information, which is narrower than California's personal information.

Texas sensitive personal information includes a name plus a Social Security number, driver's license number, government-issued identification number, financial account number, or information that identifies a person and relates to physical or mental health. A username or email address with a password is included only if it permits access to an online account.

Texas notification thresholds: notice must be given without unreasonable delay and not later than 60 days after discovery, unless law enforcement determines that notice would impede a criminal investigation. If 250 or more Texas residents are affected, the person must also notify the Texas attorney general within 30 days of determining that a breach occurred.

The 250-resident threshold is a key difference from California. A small incident can avoid the attorney general notice, but it still requires resident notice.

Texas also requires notice to consumer reporting agencies if more than 10,000 persons are affected at one time. That is a separate step from the attorney general notice. Marketing ops should not assume legal will catch it.

Texas does not have a general reasonable security statute for all data, but it does enforce under the Texas Data Privacy and Security Act and the Texas Deceptive Trade Practices Act. A breach caused by poor security can still become an enforcement matter.

For marketing ops, the Texas threshold question is whether your platform holds a username with a password. If it does, the data is sensitive personal information under Texas law. If it holds only names and email addresses, it may not be.

That distinction should be documented.

What each law changes in platform logging, retention and access controls

All three laws push the same operational requirements into marketing platforms: know what you hold, know who touched it, and be able to delete it. The differences are in timing and thresholds, not in the underlying evidence.

Logging is the first gap. Most marketing automation platforms log campaign sends and form submissions, not admin access. You need admin audit logs with user, timestamp, IP and action. If the platform does not provide them, that is a procurement issue.

Retention is the second gap. California and New York both treat data you no longer need as a liability. A retention schedule that deletes stale profiles reduces breach scope. It also reduces the number of notices you must send.

Access controls are the third gap. Shared admin accounts, standing privileges, and vendor accounts without MFA are common in martech. Each one makes the breach scope larger and the evidence weaker.

Vendor contracts are the fourth gap. Your automation platform, CDP, and ad tech vendors are likely service providers. The contract should require breach notice to you within a short window, indemnity, and cooperation with your state notices.

NIST publishes cybersecurity and privacy guidance that maps well to these requirements, including the Cybersecurity Framework and privacy framework. The NIST cybersecurity and privacy guidance is a defensible reference when you need to justify controls to legal or finance.

Staffing is the fifth gap. Someone must own the incident runbook and the platform evidence. The U.S. Bureau of Labor Statistics tracks information security analyst roles, and the BLS OEWS data for information security analysts is a useful benchmark when you build the case for headcount.

Many teams try to close these gaps with tools alone. That usually stalls. The common marketing operations questions are usually about ownership and process, not software.

When you evaluate platforms, ask for audit log retention, field-level access control, and deletion APIs. The customer data platforms comparison criteria apply here, because breach readiness depends on the same controls.

If you are comparing vendors, the how to manage marketing operations question is about evidence. Can the platform show who accessed a profile, when, and under what consent?

Finally, the incident itself often starts with an automation trigger. A misconfigured send can push personal data to the wrong audience. Designing identity, consent and triggers with breach scope in mind prevents some incidents and shrinks others.

A notification-ready checklist for automation platforms

This checklist is written for marketing ops and privacy staff who own the platform, not for lawyers. Work through it before an incident, not during one.

Common questions