Texas Data Privacy and Security Act
Published 18 min read
Texas has no head count: if you do business there, process personal data and are not an SBA small business, the whole act applies, and even a small business needs consent before it sells sensitive data.
Does the Texas act reach you?
Most state privacy laws open with a head count: so many thousand residents’ data a year, or a share of revenue from selling it. Texas has none. Its chapter applies to a person that meets three conditions at once, and the third is the one that decides most cases.
“(1) conducts business in this state or produces a product or service consumed by residents of this state; (2) processes or engages in the sale of personal data; and (3) is not a small business as defined by the United States Small Business Administration …”
Scope walk. Answer for your firm or load an example. Nothing leaves your browser.
Ohio SaaS with Texas users
Inside the act
- No headcount or revenue line to stay under: the full chapter applies.
- It protects Texas residents acting as individuals or households, not people in a work or business role (§ 541.001(7)), and job-applicant and staff data is exempt (§ 541.003(15)).
A reading of the statute’s scope sections, not legal advice.
What “small business” means here
The act sets no size line of its own; it points to the US Small Business Administration. The SBA’s standards are written per industry: each NAICS code carries a cap measured either in employees or in average annual receipts, and the employees or receipts of affiliates count toward it. The SBA’s own summary is that most manufacturers with 500 employees or fewer, and most other firms with average annual receipts under $7.5 million, qualify, with exceptions by industry. A 30-person agency and a 30-person software firm can land on different sides, so look your code up in the SBA’s size standards guide rather than guessing.
The SBA writes its standards for federal contracting and lending. Texas reuses the definition without saying which counting period applies, so a firm close to its industry’s cap should treat itself as covered until a lawyer says otherwise.
Whose data counts
A “consumer” is a Texas resident acting in an individual or household context; the definition excludes anyone acting in a commercial or employment context (§ 541.001(7)). Data about applicants, staff and contractors, kept and used within that role, is exempt as well (§ 541.003(15)). So the act is about your customers, users and site visitors in Texas, not your payroll or the buyer at a client firm.
Settle the size question in writing and keep the note with your privacy file. If you sell into several states, the which-laws check runs Texas beside the head-count states in one pass.
The act in short
- Full name
- Texas Data Privacy and Security Act, Tex. Bus. & Com. Code ch. 541 (H.B. 4, 2023)
- In force
- 1 Jul 2024; the opt-out signal duty from 1 Jan 2025
- Who it binds
- No volume test: processes or sells personal data and is NOT an SBA small business (small businesses still bound by § 541.107 on selling sensitive data)
- Who it protects
- Texas residents acting in an individual or household context
- Rights
- Confirm and access, correct, delete, portable copy, opt out of targeted ads, sale and significant profiling
- Request clock
- 45 days + 45 once; appeals answered within 60 days
- Enforced by
- Attorney General (exclusive); no private right of action
- Cure period
- 30 days, ongoing
- Penalty
- Up to $7,500 per violation
Statute as posted by the Texas Legislature, read 22 Oct 2026. Information, not legal advice.
The one rule a small business still keeps
Being an SBA small business takes a firm out of almost the whole chapter: no privacy notice duty, no request clock, no assessments. One section follows it anyway, and it carries the chapter’s full penalty (§ 541.107(b)).
“A person described by Section 541.002(a)(3) may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer.”
Two definitions decide whether it bites: what counts as sensitive data, and what counts as a sale. Both are the act’s own, and both are wider than a small firm tends to assume.
Sensitive data, in the act’s four groups
Racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexuality, citizenship or immigration status
§ 541.001(29)(A)
Genetic or biometric data processed to uniquely identify a person
§ 541.001(29)(B)
Personal data collected from a known child: under 13, where you know the age or wilfully ignore it
§ 541.001(29)(C), (5), (17)
Precise geolocation: a location within a radius of 1,750 feet
§ 541.001(29)(D), (21)
A sale is not only a sale for money
The act defines a sale as sharing, disclosing or transferring personal data to a third party “for monetary or other valuable consideration” (§ 541.001(28)). An app that hands precise location to an ad network in return for a better revenue share is very likely selling in the act’s sense. These five transfers are carved out by name:
- Passing data to a processor that works on your behalf
- Passing data to a third party to provide a product or service the consumer asked for
- Transfers to an affiliate
- Information the consumer made public through a mass media channel without limiting the audience
- Data moved as an asset in a merger or acquisition
What consent has to look like
Consent means a clear affirmative act that is freely given, specific, informed and unambiguous. The act names what does not count: accepting broad terms of use, hovering over, muting, pausing or closing a piece of content, and agreement obtained through a dark pattern (§ 541.001(6)). A pre-ticked box in a sign-up flow fails on its face.
A covered controller that sells sensitive data also owes a fixed line in its privacy notice: “NOTICE: We may sell your sensitive personal data.” (§ 541.102(b)). A small business sits outside § 541.102, so for it the duty is the prior consent alone, and that consent is not optional.
List every outbound data feed (ad pixels, SDKs, data partners) and mark the ones that carry any of the four sensitive groups for value. Each of those needs a consent step before the first transfer, small business or not.
What sits outside the act
The exemptions come in two kinds, and mixing them up is the common mistake. Six kinds of organisation are outside the chapter altogether (the Gramm-Leach-Bliley carve-out also reaches data subject to that law in anyone’s hands). Everything else is exempt by dataset: the records are out, the firm that holds them is not.
| Exempt | Reach | Section |
|---|---|---|
| Texas state agencies and political subdivisions | Whole firm | § 541.002(b)(1) |
| A financial institution, or data, subject to Title V of Gramm-Leach-Bliley | Firm or data | § 541.002(b)(2) |
| HIPAA covered entities and business associates | Whole firm | § 541.002(b)(3) |
| Nonprofit organizations as the act defines them (incl. 501(c)(3), (c)(6), (c)(12), (c)(19) and political organizations) | Whole firm | § 541.002(b)(4), § 541.001(18) |
| Institutions of higher education | Whole firm | § 541.002(b)(5) |
| Electric utilities, power generation companies, retail electric providers | Whole firm | § 541.002(b)(6) |
| Protected health information, health records, research data under federal human-subjects rules | The data only | § 541.003(1)–(10) |
| Consumer-report activity regulated by the Fair Credit Reporting Act | The data only | § 541.003(11) |
| Data handled under the Driver's Privacy Protection Act, FERPA or the Farm Credit Act | The data only | § 541.003(12)–(14) |
| Applicant, employee and contractor data used in that role; emergency contacts; benefits data | The data only | § 541.003(15)–(17) |
| Processing for a purely personal or household activity | The data only | § 541.004 |
Tex. Bus. & Com. Code ch. 541 as posted by the Texas Legislature, read 22 Oct 2026. | ||
So a payroll bureau or a marketing agency with a healthcare client list is judged as a firm on the size test, and only the named records drop out. A firm that follows the parental-consent method of the federal children’s privacy law (COPPA) for data collected online is treated as meeting the act’s own parental-consent requirements (§ 541.005).
Write down which exemption you rely on and whether it covers the firm or a dataset. If it is a dataset, the website, the newsletter and the ad stack usually stay inside.
The controller's file: every duty in one register
A covered firm that decides why and how data is processed is a “controller”. Its duties are spread over two subchapters; this register puts them on one sheet, in the order a small privacy file would hold them.
| Duty | Section | What it asks |
|---|---|---|
| Collect only what the purpose needs | § 541.101(a)(1) | Adequate, relevant and reasonably necessary for the purposes you disclosed |
| Keep it secure | § 541.101(a)(2) | Reasonable administrative, technical and physical practices, scaled to the volume and nature of the data |
| No new purpose without consent | § 541.101(b)(1) | A use neither reasonably necessary to nor compatible with the disclosed purpose needs consent first |
| Consent before sensitive data | § 541.101(b)(4) | Consent for any processing of sensitive data; for a known child, process it as COPPA requires |
| No penalty for using a right | § 541.101(b)(3), (c) | No denial, higher price or lower quality; bona fide loyalty, rewards and discount programmes stay allowed |
| Privacy notice | § 541.102 | Six items, plus a fixed line if you sell sensitive or biometric data |
| Say so if you sell or target ads | § 541.103 | Disclose it clearly and conspicuously, with how to opt out |
| Two ways to send a request | § 541.055(a)–(d) | Two or more secure, reliable methods; no new account required; a website mechanism; online-only firms may use an email address |
| Processor contract | § 541.104(b) | Instructions, nature and purpose, data types, duration, both sides' rights and the processor's five promises |
| Data protection assessments | § 541.105 | Documented, for five kinds of processing (see Assessments below) |
| Deidentified data | § 541.106(a) | Reasonable measures against re-linking, a public commitment not to re-identify, and the same duty in every recipient's contract |
Tex. Bus. & Com. Code ch. 541, subchapters B and C, read 22 Oct 2026. | ||
The notice: six items and two fixed lines
A notice drafted for Virginia, which asks for five items, needs one more for Texas: a description of the request methods themselves. The two fixed lines are the other Texas feature. Their wording is set by the statute, so copy them exactly rather than softening them into house style. The privacy policy checklist covers the GDPR and CCPA items; run it first, then check these six against the same policy.
What a Texas privacy notice carries
- 01The categories of personal data you process, including any sensitive data
- 02Why you process it
- 03How consumers use their rights, including how to appeal your decision
- 04If applicable, the categories of personal data you share with third parties
- 05If applicable, the categories of third parties you share it with
- 06The methods (§ 541.055) through which consumers can send a request
Only if you sell that kind of data, in the same place and manner:
NOTICE: We may sell your sensitive personal data.
NOTICE: We may sell your biometric personal data.
§ 541.102(b)–(c), wording fixed by the statute
The processor contract
Every vendor that processes data for you needs a contract that covers the instructions, the nature and purpose of the processing, the type of data, its duration and both sides’ rights and obligations. The processor must also promise confidentiality from its staff, deletion or return at the end, the information that proves compliance, cooperation with your reasonable assessments (or an independent assessor’s report instead), and written flow-down terms for any subcontractor (§ 541.104(b)–(c)). Since 1 January 2026 the processor’s duty to help with security expressly covers personal data in an artificial intelligence system (amended by H.B. 149, 2025). A data processing agreement template written for the GDPR usually covers these terms; check the subcontractor and assessment clauses against the list.
Put the register in your privacy file as a checklist with an owner per line. The two duties small teams miss are the second request method and the sixth notice item.
The request clock
Texas residents get five rights (§ 541.051(b)). The list will look familiar from the other state laws; the clock behind it is the part to put in a calendar.
- Confirm and access. Whether you process their data, and access to it.
- Correct. Fix inaccuracies, given the data's nature and purpose.
- Delete. Data they gave you and data you obtained about them.
- Portable copy. Data they gave you, in a portable, readily usable format, where it is held digitally.
- Opt out. Of targeted advertising, sale, and profiling behind decisions with legal or similarly significant effects.
One request, start to finish
- Day 0The request arrives through one of your methods. The clock starts on receipt. § 541.052(b)
- By day 45Answer it, or decline with your reasons and how to appeal. Need longer? Say so now, with the reason. § 541.052(b)–(c)
- By day 90The one extension ends. There is no second. § 541.052(b)
- Appeal + 60Answer an appeal in writing, with reasons, within 60 days of receiving it. § 541.053(c)
The extension only counts if the consumer hears about it, with the reason, inside the first 45 days. A request that sits unanswered past day 45 with no notice is late, whatever its complexity.
The smaller rules that shape a reply
- Answers are free at least twice a year per consumer. A manifestly unfounded, excessive or repetitive request can be charged a reasonable fee or declined, and the burden of showing that is yours (§ 541.052(d)).
- If you cannot authenticate the person with commercially reasonable effort, you need not comply, and you may ask for the information needed to authenticate them (§ 541.052(e)).
- Data bought or received from someone else is treated as deleted if you keep a minimal suppression record, or opt the person out of all non-exempt processing (§ 541.052(f)).
- The appeal route must be conspicuous and work like the request route. If you deny an appeal, give the person the Attorney General’s online complaint mechanism (§ 541.053(b), (d)).
What a request looks like when it lands, and what to send back, is the same work under every law; the guide to data subject requests walks through it.
Log each Texas request with its day of receipt and let the DSAR deadline calculator set the day-45 and day-90 dates. Put the extension notice on day 40, not day 45.
Opt-out signals: the duty that started in 2025
The act took effect on 1 July 2024, but one subsection waited: § 541.055(e), which lets a consumer opt out through an authorized agent, took effect on 1 January 2025 (H.B. 4, SECTION 7). The agent can be a piece of technology, which is how a browser privacy signal enters Texas law without being named.
“A consumer may designate an authorized agent using a technology, including a link to an Internet website, an Internet browser setting or extension, or a global setting on an electronic device, that allows the consumer to indicate the consumer's intent to opt out of the processing.”
The signal covers two of the three opt-outs: targeted advertising and sale. Profiling is not on the list. You must act on it when you can verify, with commercially reasonable effort, the consumer’s identity and the agent’s authority. The statute then lists four cases where you need not comply:
- The agent does not send the request in a clear and unambiguous way.
- You cannot verify, with commercially reasonable effort, that the consumer lives in Texas.
- You do not have the ability to process the request.
- You do not process similar or identical requests under other states' laws.
Read the fourth case before relying on it. A firm that already honours browser signals for California or Colorado is processing “similar or identical requests” under another state’s law, so that way out is unlikely to be open to it. The technology itself must not be a default setting: it needs the consumer’s affirmative, freely given choice (§ 541.055(f)(2)).
The Global Privacy Control checker shows whether your own browser is sending the signal, so you can test your site with it on, and what each state expects a site to do when it arrives.
Data protection assessments
An assessment is a documented weighing of what a processing activity is worth against the risk it puts on consumers, with the safeguards that reduce it. Texas requires one for each of five activities (§ 541.105(a)):
Targeted advertising
Selling personal data
Profiling with a reasonably foreseeable risk of unfair treatment, injury, intrusion or other substantial harm
Processing sensitive data
Any processing with a heightened risk of harm to consumers
What goes in, and who can read it
Weigh the benefits to you, the consumer, other stakeholders and the public against the risks, and factor in deidentified data, consumers’ reasonable expectations, the context and your relationship with the people concerned (§ 541.105(b)). One assessment can cover a set of comparable operations, and one written for another law counts if its scope and effect are reasonably comparable (§ 541.105(e)–(f)). The Attorney General can demand it in an investigation; it stays confidential and outside the Public Information Act, and handing it over does not waive privilege (§ 541.105(c)–(d)).
Ad pixels that feed retargeting or audiences built across other sites are targeted advertising in the act’s sense (§ 541.001(31)), so they need an assessment. The privacy impact assessment template gives a structure that also serves the GDPR, which § 541.105(f) lets you reuse.
Enforcement: the Attorney General's 30-day letter
Only the Texas Attorney General can enforce the act (§ 541.151), and the chapter rules out any private right of action (§ 541.156): customers cannot sue under it. The Attorney General can open with a civil investigative demand and ask for your data protection assessments as part of it (§ 541.153).
Before suing, the Attorney General must write to you at least 30 days ahead, naming the provisions said to be broken. If you cure inside those 30 days and send a written statement, no action can be brought (§ 541.154). Unlike several states whose cure period was temporary, the Texas one has no end date in the text.
Inside the 30 days, your written statement to the Attorney General
Four things it must say
- (A)You cured the alleged violation
- (B)You told the consumer their privacy violation was addressed, if you have their contact details
- (C)Supporting documents showing how it was cured
- (D)Any internal policy changes needed so it does not happen again
§ 541.154(2)
Miss the cure, or breach the statement you sent, and the penalty is a civil penalty of up to $7,500 for each violation, plus an injunction and the Attorney General’s reasonable fees and investigation costs (§ 541.155). Breaching the cure statement exposes you to that penalty on its own, so state only what is done.
The Attorney General’s page on the act carries the consumer complaint route the statute requires (§ 541.152). That is the link to hand a consumer whose appeal you deny.
Treat a letter from the Attorney General as a 30-day project with a named owner, and keep the evidence of each fix as you make it: the statement needs supporting documents, not a summary.
Texas beside the other state laws
Texas shares Virginia’s 45-day clock with one extension, its open-ended 30-day cure and its exclusive Attorney General enforcement. It parts from it on scope and on opt-out signals. Colorado shows the other common shape: a head count, a signal duty, and a cure period that has already ended.
| Texas (TDPSA) | Virginia (VCDPA) | Colorado (CPA) | |
|---|---|---|---|
| In force | 1 Jul 2024 | 1 Jan 2023 | 1 Jul 2023 |
| Who it reaches | No volume test: processes or sells personal data and is NOT an SBA small business (small businesses still bound by § 541.107 on selling sensitive data) | ≥100,000 consumers in a calendar year; or ≥25,000 consumers + over 50% of gross revenue from selling personal data | ≥100,000 Colorado consumers in a calendar year; or revenue/discount from selling personal data + ≥25,000 consumers. From 1 Oct 2025 the minors' duties (§§ 6-1-1305.5, 6-1-1308.5, 6-1-1309.5) apply to any controller doing business in or targeting Colorado, with no volume test (SB 24-041) |
| Cure period | 30 days, ongoing | 30 days, ongoing | 60 days, ended 1 Jan 2025 |
| Opt-out signal duty | Yes (authorized-agent technology incl. browser setting), 1 Jan 2025 | None in the chapter | Yes, 1 Jul 2024 (GPC is the only recognised UOOM) |
| Enforced by | Attorney General (exclusive) | Attorney General (exclusive) | Attorney General and district attorneys |
| Request clock | 45 days + 45 once | 45 days + 45 once | 45 days + 45 |
Each state’s statute or Attorney General page, read 22 Oct 2026. | |||
The full set of state laws, with their thresholds and dates, is in the US state privacy laws guide; the Virginia guide covers the law Texas sits closest to.
Questions
Does the Texas act apply to a company with no office in Texas?
It can. The test is whether you conduct business in Texas or produce a product or service consumed by Texas residents (§ 541.002(a)(1)), not where you sit. An out-of-state firm with Texas customers, that processes personal data and is not an SBA small business, is inside.
Is there a revenue or customer-count threshold?
No. Texas uses the US Small Business Administration’s definition of a small business instead, which varies by industry. The one duty that still follows a small business is getting prior consent before selling sensitive data (§ 541.107).
Can a customer sue us under the TDPSA?
No. The chapter says it may not be construed as a basis for a private right of action (§ 541.156). Enforcement belongs to the Attorney General alone.
Does it cover employee and applicant data?
No. A consumer is someone acting in an individual or household context, not a commercial or employment one (§ 541.001(7)), and data kept on applicants, staff and contractors within that role is exempt (§ 541.003(15)).
Do we have to honour Global Privacy Control in Texas?
The act does not name it. Since 1 January 2025 it requires you to act on opt-outs of targeted advertising and sale sent by an authorized agent, and a browser setting or extension can be that agent (§ 541.055(e)), subject to the four exceptions in the statute.
Do we need a "Do Not Sell" link for Texas?
The act prescribes no link text. If you sell personal data or process it for targeted advertising, you must disclose that clearly and conspicuously, with how to opt out (§ 541.103). A link built for California usually does that job; the Do Not Sell or Share link guide covers how it is built.
What is the fine?
Up to $7,500 for each violation, after a 30-day cure period has passed without a cure, plus an injunction and the Attorney General’s reasonable fees and costs (§ 541.155).