Precise Geolocation Data (Texas Data Privacy and Security Act)
Location information precise enough to identify where a person is within a radius of 1,750 feet. The TDPSA classifies it as sensitive data, so a Texas controller needs consent before processing it. The definition excludes the content of communications and data from advanced utility metering equipment. It figured in the attorney general's first lawsuit under the TDPSA.
Precise geolocation data is sensitive data in Texas. The classification can turn a routine product feature into processing that requires consent before it happens.
The 1,750-foot line
Section 541.001 defines precise geolocation data as information derived from technology, including global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet. The definition excludes the content of communications and data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.
Roughly a third of a mile. GPS-level coordinates from a phone are typically far more precise than that, and Wi-Fi, beacon and vehicle telematics data often are as well. Coarse IP-based city-level geolocation generally does not, though that is a factual question rather than an automatic answer, and a coarse signal combined with other data can land inside the radius.
Consent, not notice
Because precise geolocation data falls within sensitive data under § 541.001, § 541.101(b)(4) forbids processing it without the consumer's consent. Consent carries its own statutory definition: a clear affirmative act signifying freely given, specific, informed and unambiguous agreement. An operating system permission prompt granting an app access to location is a step, but it is permission granted to the platform, not necessarily informed consent to the controller's stated processing purposes. The gap is widest where location collected to make a navigation or delivery feature work is later monetized.
Section 541.105 adds a documented data protection assessment for processing sensitive data, and the attorney general may reach that document through the investigative authority in § 541.153.
Where enforcement started
The attorney general's first TDPSA action, filed in January 2025 against Allstate and its data analytics affiliate Arity, was built on driving and location data gathered through mobile applications, including applications published by unrelated developers that had integrated the analytics software development kit. The pleaded theories tracked the statute closely: no adequate privacy notice describing the collection, no consent for processing precise geolocation data, no working opt-out for sale and targeted advertising, and no posting of the notice required by § 541.102(b) for the sale of sensitive personal data. The case, State of Texas v. Allstate Corp., was filed in Montgomery County district court, and the TDPSA count was pleaded against the Arity entities only. Allstate's securities filings continued to report the suit in 2026.
Two lessons follow for any Texas business collecting location. The sensitive-data sale notice is a fixed string, "NOTICE: We may sell your sensitive personal data.", and it must appear in the same location and manner as the privacy notice. And while disclosure or transfer of personal data to an affiliate of the controller is excluded from the definition of sale under § 541.001, that exclusion protects the transfer and not what the affiliate then does. Routing collection through a sister entity does not launder a downstream sale.
Location data collected at a precision coarser than a 1,750-foot radius falls outside the definition of precise geolocation data. It may still be personal data, and the rest of the chapter can still apply.