Texas Data Privacy and Security Act

Texas has no revenue or visitor-count threshold. The law applies to anyone who does business in Texas or makes products or services Texans use, processes or sells personal data, and is not a small business under the U.S. Small Business Administration’s size standards.

Small businesses are not entirely off the hook: they may not sell sensitive data without the consumer’s prior consent (§ 541.107).

• Texans can confirm and access their data, correct it, delete it, get a portable copy, and opt out of targeted advertising, the sale of their data, and profiling for significant decisions.
• Respond within 45 days, extendable once by another 45 days when reasonably necessary.
• Requests are free at least twice a year per person.
• Appeals: answer within 60 days, and if you deny the appeal, tell the person how to complain to the Texas Attorney General.

Since January 1, 2025, a consumer can opt out through a browser setting or extension, or a global setting on their device, and a business must comply. The signal must reflect an affirmative choice, not a default setting. The law doesn’t name Global Privacy Control, but GPC is that kind of browser setting.

Sensitive data includes racial or ethnic origin, religious beliefs, health diagnoses, sexuality, citizenship or immigration status, genetic or biometric data used to identify someone, data collected from a known child, and precise geolocation. You need the consumer’s consent before processing it, and consent can’t come from dark patterns or from someone hovering over, muting or closing content.

If you sell sensitive data, your privacy notice must include, in the same place and manner: “NOTICE: We may sell your sensitive personal data.” If you sell biometric data: “NOTICE: We may sell your biometric personal data.”

Only the Texas Attorney General enforces the law. Before suing, the Attorney General must give 30 days’ written notice, and no action may be brought if the business cures the violation and confirms it in writing. Penalties are up to $7,500 per violation. There’s no private right of action.

In January 2025 the Attorney General sued Allstate and its data subsidiary Arity, saying they collected and sold driving data without notice or consent. It was reported as the first enforcement action under a state comprehensive privacy law.