Texas Data Privacy and Security Act
Texas's comprehensive consumer data privacy law, effective July 1, 2024 (with universal opt-out provisions effective January 1, 2025). Imposes transparency, purpose-limitation, security, and consumer-rights obligations on controllers processing the personal data of Texas residents. Enforced exclusively by the Texas Attorney General; no private right of action.
The Texas Data Privacy and Security Act (TDPSA) is Texas's comprehensive consumer data privacy law. Signed by Governor Abbott on June 18, 2023, it took effect July 1, 2024, with the authorized-agent opt-out provision in § 541.055(e) taking effect January 1, 2025. The TDPSA imposes transparency, purpose-limitation, security, and consumer-rights obligations on businesses that process the personal data of Texas residents.
Applicability
The TDPSA applies to any person who (1) conducts business in Texas or produces products or services consumed by Texas residents; (2) processes or engages in the sale of personal data; and (3) is not a small business as defined by the U.S. Small Business Administration. Notably, the TDPSA contains no revenue threshold and no minimum-consumer-count threshold, distinguishing it from California, Colorado, and most other state privacy laws. Small businesses are exempt from most obligations except the requirement to obtain consumer consent before selling sensitive data.
Controller obligations
A controller, the entity determining the purpose and means of processing personal data, must (1) limit personal data collection to what is reasonably necessary for the disclosed purpose; (2) provide a clear privacy notice describing categories of data, purposes, sharing practices, and consumer rights; (3) obtain consent before processing sensitive data (precise geolocation, mental or physical health diagnosis, biometric or genetic data used to identify an individual, racial or ethnic origin, religious beliefs, sexuality, citizenship or immigration status), and process a known child's data in accordance with the federal Children's Online Privacy Protection Act; (4) respond to consumer-rights requests within 45 days, extendable once by 45 days; and (5) maintain reasonable administrative, technical, and physical security measures.
Consumer rights
Texas residents acting in an individual or household context (excluding employment and commercial contexts) have rights to (1) know whether their data is being processed; (2) access the data; (3) correct inaccurate data; (4) delete data; (5) obtain a portable copy; and (6) opt out of (a) sale of personal data, (b) targeted advertising, and (c) profiling that produces legal or similarly significant effects. Since January 1, 2025, a consumer may designate an authorized agent through a browser setting, extension or device setting to opt out of targeted advertising and sales, and controllers must honor those requests subject to the verification and other conditions in § 541.055(e).
Enforcement
The Texas Attorney General has exclusive enforcement authority. The AG must provide written notice of a violation and a 30-day cure period before initiating an enforcement action. Civil penalties may reach $7,500 per violation for violations continuing after the cure period, and the attorney general may seek an injunction and recover attorney's fees and investigative expenses. The TDPSA does not provide a private right of action. Consumers cannot sue businesses directly under the statute.
For a business that is not an SBA small business, the statute's main operational requirements are a conforming privacy notice (§ 541.102), at least two methods for consumer requests (§ 541.055), contracts with processors (§ 541.104), handling of authorized-agent opt-out signals (§ 541.055(e)), data protection assessments for targeted advertising, sales, sensitive data and other listed processing (§ 541.105), and reasonable data security (§ 541.101(a)(2)). Breach notification is governed separately by Chapter 521.
Companion article: Data Breach Response: The First 72 Hours