Texas Data Privacy Laws: TDPSA & Consumer Rights Guide (2026)

The Texas Data Privacy and Security Act (TDPSA), codified at Tex. Bus. and Com. Code Chapter 541, took effect July 1, 2024, granting Texas residents rights to access, correct, delete, and opt out of the processing of their personal data. Only the Texas Attorney General enforces the law; civil penalties reach USD 7,500 per violation.

Texas has built one of the most aggressive data privacy enforcement frameworks in the country. The state combines a broad consumer data protection law, dedicated biometric protections, strict breach notification requirements, children's online privacy rules, a data broker registry, and a new AI governance statute.

The Texas Attorney General's office has backed this framework with landmark enforcement. The USD 1.4 billion Meta settlement in July 2024 and the USD 1.375 billion Google settlement finalized in October 2025 together represent the largest state-level privacy recoveries in U.S. history.

This guide covers each major Texas privacy statute, what rights consumers hold, what businesses must do, and what the penalties are for noncompliance. It is current as of May 2026, except for the SCOPE Act litigation section, which was rechecked on October 29, 2026.

Texas Data Privacy and Security Act (TDPSA)

The Texas Data Privacy and Security Act is codified at Chapter 541 of the Texas Business and Commerce Code. It was enacted through House Bill 4 during the 88th Texas Legislative Session and took effect July 1, 2024.

The TDPSA is Texas's comprehensive consumer data protection law. It governs how businesses collect, use, process, store, sell, share, analyze, and otherwise handle personal data belonging to Texas residents.

Who the TDPSA Covers

The TDPSA applies to any person or entity that conducts business in Texas or produces a product or service consumed by Texas residents, and that collects, uses, stores, sells, shares, analyzes, or processes consumers' personal data.

This is a notably broad trigger. Most state privacy laws set minimum revenue or data-volume thresholds before coverage kicks in. Texas does not. Any business touching Texas consumer data is potentially covered, subject to the exemptions below.

Exempt Entities

The TDPSA applies only to a person that is not a small business as defined by the federal Small Business Administration (Tex. Bus. & Com. Code Section 541.002(a)(3)). Beyond that applicability threshold, Section 541.002(b) exempts six categories from the chapter entirely:

• State agencies and political subdivisions of Texas
• Financial institutions governed by the Gramm-Leach-Bliley Act (GLBA)
• Covered entities and business associates governed by HIPAA
• Nonprofit organizations
• Institutions of higher education
• Electric utilities, power generation companies, and retail electric providers, as defined by Section 31.002 of the Utilities Code

The small-business threshold carries an important carve-out. A small business that sells sensitive consumer data must still obtain the consumer's consent before doing so. Size does not permit the sale of health information, biometric data, precise geolocation, or children's data without permission.

Consumer Rights Under the TDPSA

The TDPSA grants Texas consumers the following rights:

Confirm and access. You can ask a business to confirm whether it processes your personal data and request a copy of that data.

Correct inaccuracies. You can request that a business correct inaccurate personal data it holds about you.

Delete your data. You can request deletion of personal data collected from or about you.

Portability. You can request a copy of your data in a portable, readily usable format.

Opt out of targeted advertising. You can opt out of the use of your personal data for targeted advertising purposes.

Opt out of data sales. You can opt out of the sale of your personal data to third parties.

Opt out of profiling. You can opt out of profiling that produces legal or similarly significant effects concerning you.

Controllers must respond to verified consumer requests within 45 days. If additional time is needed, controllers may extend by another 45 days with notice. If a controller denies a request, it must provide a reason and explain how the consumer can appeal. The appeal must be decided within 60 days.

Universal Opt-Out Mechanisms

Since January 1, 2025, Texas has let consumers designate an authorized agent to opt out of data sales and targeted advertising on their behalf using technology such as a browser setting or extension, including Global Privacy Control (GPC) (Business and Commerce Code section 541.055(e)). A controller must comply with such a request if it can verify, with commercially reasonable effort, the consumer's identity and the agent's authority, but the statute excuses compliance in listed situations, including when the controller cannot verify that the consumer is a Texas resident or does not process similar requests it receives under other states' comparable laws. The signal must reflect the consumer's own affirmative choice rather than a default setting (section 541.055(f)(2)). Separately, a controller that processes data for targeted advertising or sells personal data must provide a clear and conspicuous means for consumers to opt out.

Personal Data and Sensitive Data

"Personal data" means any information that is linked or reasonably linkable to an identified or identifiable individual. Publicly available information and properly de-identified data fall outside this definition.

"Sensitive data" receives heightened protection and requires the consumer's affirmative consent before processing. The TDPSA's sensitive data categories are:

• Racial or ethnic origin
• Religious beliefs
• Mental or physical health diagnosis
• Sexuality or sexual orientation
• Citizenship or immigration status
• Genetic data
• Biometric data processed for the purpose of unique identification
• Precise geolocation data (within a radius of 1,750 feet)
• Personal data of a child under 13

Consent obtained through dark patterns or buried within general terms of service does not satisfy the TDPSA's consent standard.

Controller and Processor Obligations

Data controllers under the TDPSA must satisfy these baseline requirements:

Data minimization. Collection must be limited to what is adequate, relevant, and reasonably necessary for the disclosed purpose.

Purpose limitation. Data cannot be processed for purposes incompatible with what was disclosed to the consumer at the time of collection.

Security. Controllers must implement and maintain reasonable administrative, technical, and physical security practices appropriate to the volume and nature of the personal data.

Data protection assessments. Controllers must conduct and document data protection assessments before undertaking processing activities that present heightened risk: targeted advertising, data sales, certain profiling uses, and the processing of sensitive data. The Texas AG may request these assessments, and controllers must produce them.

Processor contracts. Contracts with data processors must include all elements the TDPSA requires, including obligations to assist with consumer rights requests and data protection assessments.

TDPSA Enforcement and Penalties

The Texas Attorney General holds exclusive enforcement authority. There is no private right of action under the TDPSA.

Before filing suit, the AG must give the company written notice of the alleged violation and a 30-day window to cure. If the company cures and provides a written statement of compliance, no enforcement action may proceed for that violation. If the company fails to cure, or later breaches its written cure statement, the AG may seek:

• Civil penalties up to USD 7,500 per violation
• Injunctive relief
• Attorney's fees and investigative costs

There is no aggregate cap on penalties per enforcement action.

Texas Capture or Use of Biometric Identifier Act (CUBI)

The Capture or Use of Biometric Identifier Act (CUBI) is codified at Chapter 503 of the Texas Business and Commerce Code. It predates the TDPSA and provides dedicated protections for biometric data beyond what the TDPSA's sensitive data provisions require.

What CUBI Covers

CUBI regulates the capture and commercial use of biometric identifiers. The law defines biometric identifiers as:

• Retina or iris scans
• Fingerprints
• Voiceprints
• Records of hand geometry or face geometry

CUBI Requirements

Before capturing an individual's biometric identifier for a commercial purpose, a person or entity must:

1. Inform the individual that a biometric identifier is being collected or stored
2. Obtain the individual's consent to that collection or storage

CUBI also bars selling, leasing, or otherwise disclosing a biometric identifier to another person unless one of four narrow exceptions applies: the individual consented to the disclosure for identification purposes in the event of the individual's disappearance or death; the disclosure completes a financial transaction the individual requested or authorized; the disclosure is required or permitted by a federal statute or by a state statute other than Chapter 552 of the Government Code; or the disclosure is made by or to a law enforcement agency for a law enforcement purpose in response to a warrant. A general consent checkbox does not authorize biometric data sharing under CUBI. The statute also requires destruction of the biometric identifier within a reasonable time, and no later than the first anniversary of the date the purpose for collecting it expires.

The Texas Responsible AI Governance Act (TRAIGA, H.B. 149, 89th Legislature), effective January 1, 2026, amended CUBI to clarify that an individual does not consent to capture simply because an image containing their biometric identifiers exists somewhere on the internet or in publicly available sources, unless the individual personally made that image publicly available. TRAIGA also added two new CUBI exemptions effective the same date: biometric identifiers used to develop, train, evaluate, or otherwise offer an artificial intelligence model or system, unless that system is used to uniquely identify a specific individual, and biometric identifiers used in an AI model or system to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, or other illegal activity.

CUBI Penalties

Each violation of CUBI carries a civil penalty of up to USD 25,000. The Texas AG enforces the statute. Unlike the TDPSA, CUBI does not include a 30-day cure period before the AG can pursue penalties.

Meta Settlement (July 2024)

In July 2024, Attorney General Ken Paxton secured a USD 1.4 billion settlement from Meta for alleged violations of CUBI. The AG's lawsuit alleged Meta captured the facial geometry of Texas residents through its facial-recognition "Tag Suggestions" feature without obtaining informed consent. The USD 1.4 billion figure is the largest privacy settlement ever obtained by a single state attorney general.

Google Settlement (Finalized October 2025)

Texas filed suit against Google in 2022 alleging violations of CUBI and other Texas privacy statutes, including unauthorized capture of biometric identifiers through Google Photos and Google Assistant. The parties reached an agreement in principle on May 9, 2025, and finalized a USD 1.375 billion settlement on October 31, 2025. The settlement also resolved claims related to location tracking and Incognito-mode data collection.

Data Breach Notification Requirements (ITEPA)

The Texas Identity Theft Enforcement and Protection Act (ITEPA), codified at Chapter 521 of the Texas Business and Commerce Code, governs breach notification obligations for businesses that maintain sensitive personal information about Texas residents.

What Triggers Notification

A "breach of system security" occurs when sensitive personal information is acquired by an unauthorized person. Sensitive personal information under ITEPA includes:

• Social Security numbers
• Driver's license or state identification card numbers
• Financial account numbers combined with security codes, passwords, or access codes
• Health insurance policy or subscriber numbers combined with health information
• Information about an individual's physical or mental health condition or treatment

Notification Timelines

Texas imposes two parallel deadlines:

Consumer notification. The business must notify affected individuals no later than 60 days after the date on which it determines that a breach occurred. Notification may be delivered by mail, email, conspicuous website posting, or statewide media broadcast.

Attorney General notification. If the breach affects 250 or more Texas residents, the business must also notify the Texas AG as soon as practicable and no later than 30 days after discovering the breach. Reports are submitted through the AG's data breach portal.

Data Disposal Requirements

ITEPA requires that when a business disposes of records containing personal identifying information, the disposal method must render the data unreadable or indecipherable. This applies to both physical records and electronic storage media.

ITEPA Penalties

The AG may seek civil penalties between USD 2,000 and USD 50,000 per violation. For failures to take reasonable action to notify consumers, an additional penalty of up to USD 250,000 per breach event may apply. The AG may also recover attorneys' fees, investigative costs, and court costs.

Securing Children Online Through Parental Empowerment (SCOPE) Act

The SCOPE Act, codified at Chapter 509 of the Texas Business and Commerce Code, took effect September 1, 2024. It imposes specific obligations on digital service providers that operate online platforms for social interaction when those platforms are accessed by minors under 18.

What the SCOPE Act Requires

Covered platforms must:

• Limit the collection and use of a minor's personally identifiable information and prohibit sharing or selling it
• Refrain from collecting a minor's geolocation data
• Refrain from displaying targeted advertising to minors
• Prevent minors from making purchases or conducting financial transactions on the platform
• Develop and implement a strategy to prevent minors' exposure to material that promotes self-harm, substance abuse, bullying, harassment, trafficking, or sexual exploitation (enforceability unsettled in court, see below)
• Provide parents with tools to manage and control their child's privacy settings

A violation of the SCOPE Act is treated as a deceptive trade practice. The AG may seek injunctive relief and civil penalties of up to USD 10,000 per violation.

Where the SCOPE Act Stands in Court

Several SCOPE Act duties are in federal litigation, and the appellate ruling that had settled their status no longer exists. On July 24, 2026, a Fifth Circuit panel decided consolidated appeals in Computer and Communications Industry Association v. Paxton and Students Engaged in Advancing Texas v. Paxton (No. 24-50721 c/w No. 25-50096), reported at 184 F.4th 420. Judge Douglas wrote for the panel, joined by Judge Higginbotham, with Judge Ho concurring in the judgment in part and dissenting in part.

That panel held that the monitoring-and-filtering duty in Section 509.053, the requirement that a platform develop a strategy to block harmful material from known minors, is preempted by Section 230 of the Communications Decency Act, 47 U.S.C. Section 230(c)(1), and it affirmed the August 30, 2024 preliminary injunction that the Western District of Texas had entered against that provision. The panel applied the same reasoning to Section 509.056(1), which requires that a platform's recommendation algorithm not interfere with its Section 509.053 duties.

The panel reached the companion case differently. It held that the SEAT plaintiffs did not have standing to challenge the monitoring-and-filtering, targeted-advertising, and unlawful-advertising requirements, a defect it located in their showing at the preliminary-injunction phase and described in a footnote as not clearly incurable. It did not reach standing on the age-verification duty in Section 509.057 at all, because it held that challenge foreclosed by Free Speech Coalition v. Paxton, 606 U.S. 461 (2025), where the Supreme Court upheld a materially similar requirement for pornographic websites as surviving intermediate scrutiny. On that basis the panel directed that the February 7, 2025 order enjoining the age-verification requirement be vacated. Having resolved the CCIA appeal on preemption, the panel then declined to reach the First Amendment and vagueness questions those plaintiffs raised.

None of those holdings stands today. On October 28, 2026, the Fifth Circuit granted rehearing en banc in the consolidated appeals and vacated the July 24, 2026 panel opinion under 5th Cir. R. 41.3. The two-page per curiam order recites that a judge requested a poll, that a majority of the circuit judges in regular active service and not disqualified voted in favor, and that the case will be reheard with oral argument on a date to be fixed later. As of October 29, 2026 the en banc court has issued no decision and the clerk has set no argument date.

Rule 41.3 provides that, unless otherwise expressly provided, granting a rehearing en banc vacates the panel opinion and judgment of the court and stays the mandate. Because the panel judgment is vacated and the mandate stayed, nothing the panel ordered took effect in the district courts. That is true of both halves of its disposition: neither its affirmance of the August 30, 2024 order nor its direction that the February 7, 2025 order be vacated, including the part of that order enjoining the age-verification requirement, ever took effect. On the face of the documents reviewed, that leaves both Western District of Texas orders standing as entered, the August 30, 2024 order enjoining the monitoring-and-filtering requirement and the February 7, 2025 order enjoining the monitoring-and-filtering, targeted-advertising, unlawful-advertising, and age-verification requirements. The documents reviewed do not settle whether any later stay or modification issued; a reader who needs the current posture should check the dockets in 1:24-CV-849 and 1:24-CV-945.

The en banc order itself addresses nothing but rehearing. It does not mention the district courts' injunctions and does not say whether any SCOPE Act provision may now be enforced, so the enforceability of Sections 509.052(2)(D), 509.053, 509.055, 509.056(1), and 509.057 is unsettled pending the en banc decision. Treat each of those duties as an open question and check the docket in No. 24-50721 before relying on either result.

Texas Data Broker Registration Law

Texas requires certain data brokers to register with the Secretary of State under Chapter 510 of the Business and Commerce Code. The original data broker law (enacted as SB 2105 during the 88th Legislature, effective September 1, 2023) was expanded by two bills signed June 20, 2025, both effective September 1, 2025.

Who Must Register

A "data broker" is now defined (following the 2025 amendments from SB 2121 and SB 1343) as a business entity that collects, processes, or transfers personal data that the entity did not collect directly from the individual. The 2025 amendment removed the prior requirement that data brokering be the company's "principal source of revenue," substantially broadening the registration obligation.

Registration is required if the entity, in a 12-month period, either derives more than 50 percent of its revenue from processing or transferring such data, or processes or transfers the personal data of more than 50,000 individuals not collected directly from those individuals.

Registration Process

Qualifying data brokers must register with the Texas Secretary of State by filing a registration statement and paying a USD 300 annual fee. The registration must include:

• The data broker's legal name and contact information
• A physical address
• A link to a page explaining how consumers can exercise their rights under TDPSA Section 541.051

In 2024, the AG notified over 100 companies of their apparent failure to comply with the data broker registration requirement. The AG has continued active enforcement of the registry since.

Texas Responsible AI Governance Act (TRAIGA)

The Texas Responsible AI Governance Act (TRAIGA), signed in 2025, took effect January 1, 2026. TRAIGA amends and interacts with the TDPSA by imposing obligations on persons and entities that develop or deploy AI systems in Texas.

Key TRAIGA Requirements

TRAIGA prohibits the use of AI systems for behavioral manipulation, discrimination, the creation or distribution of unlawful deepfakes or child sexual abuse material, and infringement of constitutional rights.

For AI systems that interact with Texas consumers, governmental entities must disclose to consumers that they are interacting with an AI system. The statute also establishes a regulatory sandbox program for AI developers and creates the Texas Artificial Intelligence Advisory Council.

TRAIGA's liability framework is intent-based: unlike statutes that impose strict liability for discriminatory outcomes, TRAIGA requires proof of intentional misconduct. The AG holds exclusive enforcement authority, with a 60-day cure period before any enforcement action may proceed.

The TRAIGA amendment to the TDPSA clarifies that data processors must assist controllers in adhering to security requirements when processing data through AI systems.

Recent Enforcement Actions

The Texas AG's office has been among the most aggressive state enforcers of data privacy in the country.

Texas v. Allstate and Arity (January 2025)

On January 13, 2025, the Texas AG filed the first-ever lawsuit under any state comprehensive data privacy law. The complaint alleged that Allstate and its subsidiary Arity secretly harvested location and movement data from over 45 million Americans by embedding a software development kit into popular mobile apps including Life360, GasBuddy, and Fuel Rewards. The SDK tracked real-time location, movement patterns, and driving behavior without user knowledge or consent. The AG alleged violations of the TDPSA, including failures related to sensitive geolocation data, and also alleged that Arity violated the data broker registration requirement by failing to register despite processing data on millions of individuals.

Meta Settlement (July 2024)

The Texas AG secured a USD 1.4 billion settlement from Meta in July 2024 for alleged CUBI violations related to facial-recognition technology. The settlement is the largest privacy settlement ever obtained by a single state attorney general.

Google Settlement (October 2025)

The Texas AG finalized a USD 1.375 billion settlement with Google in October 2025, resolving claims related to biometric data collection through Google Photos and Google Assistant, unauthorized location tracking, and Incognito-mode data collection. The settlement is the largest state-level privacy settlement ever obtained against Google.

Investigations Into Platform Safety for Minors

The AG launched investigations into Character.AI, Reddit, Instagram, Discord, and other platforms over their privacy and safety practices for minors under the SCOPE Act and related statutes.

Actions Against Foreign Companies

Texas also pursued legal action against Chinese companies for alleged violations of Texas residents' privacy rights, signaling that Texas enforcement extends beyond domestic technology companies.

Federal Privacy Overlay

Several federal statutes apply alongside Texas law and provide additional protections for Texas residents.

TAKE IT DOWN Act (Pub. L. 119-12, signed May 19, 2025). This federal law criminalizes the publication of nonconsensual intimate images (NCII), including AI-generated deepfakes. The criminal prohibition took effect immediately on May 19, 2025. Platform takedown obligations (requiring covered platforms to establish a notice-and-removal process within 48 hours) became effective May 19, 2026, with FTC enforcement authority.

HIPAA. Covered entities and business associates handling protected health information are governed by HIPAA's Privacy and Security Rules, which overlay the TDPSA's sensitive data provisions for health information.

Gramm-Leach-Bliley Act (GLBA). Financial institutions subject to GLBA are exempt from the TDPSA's scope, but GLBA's Safeguards Rule imposes its own data security and privacy notice requirements.

Children's Online Privacy Protection Act (COPPA). COPPA governs the online collection of personal information from children under 13 and applies alongside Texas's SCOPE Act for covered operators.

Fair Credit Reporting Act (FCRA). Consumer reporting agencies and users of consumer reports face FCRA obligations independent of state law.

FTC Act Section 5. The Federal Trade Commission can pursue unfair or deceptive data practices against most companies under Section 5, providing a federal enforcement backstop.

American Privacy Rights Act (APRA). The 2024 bicameral APRA draft did not pass. An APRA 2.0 proposal circulated in 2025 but had not been enacted as of May 2026. No federal comprehensive privacy law is in force.

Penalty Comparison Table

Practical Compliance Steps for Businesses

Businesses operating in Texas or serving Texas residents should take the following steps:

Map your data. Identify all personal data collected from Texas residents, categorize it by sensitivity level, and document the purpose of each processing activity.

Update your privacy notice. Your notice must clearly disclose what data you collect, why you collect it, whether you sell it or use it for targeted advertising, and how consumers can exercise their rights.

Build consumer rights workflows. You need documented processes to handle access, correction, deletion, portability, and opt-out requests within 45 days. Designate a point of contact or build a consumer request portal.

Be ready to process opt-outs sent through GPC. If you sell personal data or process it for targeted advertising, section 541.055(e) requires you to act on opt-out requests sent by a consumer's authorized agent, including a browser setting such as GPC, when you can verify the consumer and the agent's authority; the statute lists the limited situations in which you need not comply.

Conduct data protection assessments. Document your assessments for targeted advertising, data sales, profiling, and sensitive data processing activities before beginning those activities.

Audit your biometric data practices. If you collect fingerprints, facial geometry, voiceprints, iris scans, or hand geometry for any commercial purpose, inform the individual before you capture the identifier and obtain their consent, then implement a retention-and-destruction schedule. Section 503.001(b) requires notice and consent but does not require a signed writing, so Texas does not follow the written-release standard Illinois applies under BIPA.

Register if you are a data broker. If your business fits the post-2025-amendment definition, register with the Texas Secretary of State and pay the USD 300 annual fee.

Review AI deployments. TRAIGA took effect January 1, 2026. Businesses developing or deploying AI in Texas need to assess whether their systems fall within TRAIGA's scope and what disclosure or prohibition requirements apply.

Prepare breach response protocols. Know your 60-day consumer notification deadline and your 30-day AG notification deadline for breaches affecting 250 or more Texans.

How Texas Consumers Can Exercise Their Rights

If you are a Texas resident, you have several avenues to protect your personal data:

Submit requests directly to businesses. Contact the company's privacy team or use their designated privacy portal to submit access, correction, deletion, portability, or opt-out requests. Businesses must respond within 45 days.

Use Global Privacy Control. Enable GPC in your browser (supported in Firefox, Brave, and via browser extensions) to send automatic opt-out signals to covered businesses as you browse.

Appeal a denial. If a business denies your request, you can submit an appeal. The business must respond to your appeal within 60 days and explain the reason for any continued denial.

File a complaint with the Texas AG. The AG's Consumer Protection Division accepts data privacy complaints online. The AG handles complaints under the TDPSA, CUBI, ITEPA, SCOPE Act, and Data Broker Act.

Report to the FTC. Federal complaints about deceptive data practices can be filed at ReportFraud.ftc.gov. The FTC enforces COPPA, FCRA, and FTC Act Section 5.

Related State Comparisons

Comparing Texas with other states can help businesses assess their multi-state compliance posture:

• California Data Privacy Laws (CCPA/CPRA with CPPA rulemaking authority)
• Illinois Data Privacy Laws (BIPA biometric law; no comprehensive consumer privacy law yet)
• Colorado Data Privacy Laws (CPA, effective July 1, 2023)
• Virginia Data Privacy Laws (VCDPA)
• Our world data privacy overview for cross-jurisdictional comparison

This article is for informational purposes only and does not constitute legal advice. Data privacy laws change frequently. Consult a licensed Texas attorney for advice about your specific situation. Last reviewed: October 29, 2026.

Related news

• Texas app store age-verification law (SB 2420)

In-depth guides

• What Is the TDPSA? Texas Data Privacy and Security Act
• TDPSA Consumer Rights: Your Texas Data Privacy Rights
• TDPSA Compliance Checklist for Businesses (2026)

More Texas Laws

• Texas Deepfake Laws
• Texas Employee Monitoring Laws
• Texas GPS Tracking Laws
• Texas Recording Laws

Frequently Asked Questions

Does the Texas Data Privacy and Security Act apply to small businesses?

Small businesses as defined by the federal Small Business Administration are generally exempt from the TDPSA. There is one firm exception: if a small business sells sensitive consumer data (including health information, biometric data, precise geolocation, or data about children under 13), it must obtain the consumer's consent before doing so. Size does not eliminate that obligation.

What rights do Texas consumers have under the TDPSA?

Texas consumers have the right to confirm whether a business processes their personal data, access that data, correct inaccuracies, request deletion, obtain a portable copy, and opt out of targeted advertising, data sales, and profiling that produces legal or similarly significant effects. Businesses must respond to verified requests within 45 days. If a business denies a request, the consumer may appeal within a reasonable period of time, and the business then has 60 days to decide the appeal.

How quickly must a business notify Texas residents of a data breach?

Under the Texas Identity Theft Enforcement and Protection Act, businesses must notify affected individuals no later than 60 days after determining a breach occurred. If the breach affects 250 or more Texas residents, the business must also notify the Texas Attorney General within 30 days of discovering the breach.

Can I sue a company directly for violating the TDPSA?

No. The TDPSA does not include a private right of action. Only the Texas Attorney General can bring enforcement actions. If you believe a company has violated your data privacy rights, file a complaint with the Texas AG's Consumer Protection Division at texasattorneygeneral.gov.

What is the penalty for collecting biometric data without consent in Texas?

Under the Texas Capture or Use of Biometric Identifier Act (CUBI), collecting biometric identifiers such as fingerprints, facial geometry, retina scans, or voiceprints without informed consent carries a civil penalty of up to USD 25,000 per violation. The Texas AG enforces CUBI and has already secured the two largest biometric privacy settlements in U.S. history: USD 1.4 billion from Meta (July 2024) and USD 1.375 billion from Google (October 2025).

Does Texas require businesses to recognize Global Privacy Control?

Yes, with conditions. Since January 1, 2025, section 541.055(e) of the Business and Commerce Code lets Texas consumers use a browser setting such as Global Privacy Control as an authorized agent to opt out of data sales and targeted advertising. A covered controller must comply if it can verify the consumer's identity and the agent's authority with commercially reasonable effort, but the statute excuses compliance in listed situations, such as when the controller cannot verify Texas residency. Texas frames this as an authorized-agent right rather than the stand-alone universal opt-out mandate used in states such as Colorado and Connecticut.

What is the Texas SCOPE Act and who does it cover?

The Securing Children Online Through Parental Empowerment (SCOPE) Act, effective September 1, 2024, applies to digital service providers that operate online platforms for social interaction used by minors under 18. Covered platforms cannot collect minors' geolocation data, display targeted advertising to minors, permit financial transactions by minors, or sell minors' personal data. Violations are treated as deceptive trade practices with penalties up to USD 10,000 per violation. The status of several duties is unsettled. A Fifth Circuit panel held on July 24, 2026 that the separate duty to monitor and filter harmful material for known minors (Section 509.053) is preempted by Section 230 of the Communications Decency Act, but on October 28, 2026 the Fifth Circuit granted rehearing en banc and vacated that panel opinion under 5th Cir. R. 41.3, so the panel's holdings no longer stand and the enforceability of the litigated duties is unsettled pending the en banc decision.

What changed with Texas data broker law in 2025?

Two bills signed June 20, 2025 (SB 2121 and SB 1343), both effective September 1, 2025, significantly expanded Texas's data broker registration requirement. The prior definition required that data brokering be a company's principal revenue source; the new definition covers any business entity that collects, processes, or transfers personal data it did not collect directly from the individual. Qualifying businesses must register with the Texas Secretary of State and pay a USD 300 annual fee.

What does the Texas Responsible AI Governance Act (TRAIGA) require?

TRAIGA, effective January 1, 2026, prohibits AI systems from being used for behavioral manipulation, discrimination, unlawful deepfakes, or infringement of constitutional rights. Government entities must disclose when consumers are interacting with an AI system. The AG enforces TRAIGA with a 60-day cure period. The law also amended the TDPSA to clarify that processors must help controllers meet security obligations when processing data through AI systems.