Texas Data Privacy and Security Act (TDPSA): An Overview

Texas was the tenth state to pass a comprehensive consumer privacy law, HB 4, which was signed on June 18, 2023, and took effect on July 1, 2024. Florida’s Digital Bill of Rights, signed earlier that month, is not counted here because it applies mainly to very large businesses.

Six state privacy laws were passed between March and June 2023: Iowa, Indiana, Tennessee, Montana, Florida, and Texas. Texas used the Virginia Consumer Data Protection Act (VCDPA) as a foundation for its law. The U.S. still has no comprehensive federal privacy law.

What Is the Texas Data Privacy and Security Act (TDPSA)?

The Texas Data Privacy and Security Act protects the privacy and personal data rights of the state’s 30 million-plus residents, and establishes data privacy responsibilities for companies doing business in the state or providing goods or services consumed by Texas residents.

Most state privacy laws refer to goods or services “targeting” a state’s residents. The TDPSA instead refers to goods or services “consumed by” Texas residents, which can bring out-of-state businesses with Texas customers within its scope.

In the course of doing business these organizations process consumers’ personal information. Texas defines a consumer as a resident of the state acting in an individual or household context, but not acting in a commercial or employment context.

Like most U.S. state privacy laws, the TDPSA uses an opt-out model for most processing, with consent required for sensitive data. Businesses covered by the law must tell consumers what data they process, for what purposes, and with which third parties they share it. They must also give consumers a way to opt out of sale, targeted advertising, and certain profiling, and they and any processors they use must maintain reasonable data security.

Definitions in the Texas Data Privacy and Security Act

The Texas Data Privacy and Security Act (TDPSA) relies on a set of defined terms to determine who must comply and which information falls under its protections. Understanding these definitions is the first step in assessing how the law applies to your business, beginning with the term at its center: personal data.

Personal Data Under the TDPSA

The TDPSA uses a fairly standard definition of personal data (also called personal information in some other laws): “any information, including sensitive data, that is linked or reasonably linkable to an identified or identifiable individual. The term includes pseudonymous data when the data is used by a controller or processor in conjunction with additional information that reasonably links the data to an identified or identifiable individual.” The law excludes publicly available information or de-identified data.

The Act does not list specific examples of personal data, as some other state-level data privacy laws do, but common types include name, phone number, account/username, IP address, email address, Social Security number, driver’s license number, or passport number.

Consent Under the TDPSA

The European Union’s General Data Protection Regulation (GDPR) has set the standard for defining consent and has been followed by many data privacy laws passed since it came into effect in 2018.

Under TDPSA, consent is defined as: “clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. The term includes a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.”

Like Montana’s law, the TDPSA lists things that do not count as consent, which reflect common digital experiences. Consent does not include:

• Acceptance of a general or broad terms of use or similar document that contains descriptions of personal data processing along with other, unrelated information
• Hovering over, muting, pausing, or closing a given piece of content
• Agreement obtained through the use of dark patterns

Unlike some more recent state laws, the TDPSA does not include a provision on revoking consent.

Sensitive Data Under the TDPSA

Sensitive data is a category of personal data that could cause harm if misused. Under the TDPSA, it includes:

• Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, or citizenship or immigration status
• Genetic or biometric data processed for the purpose of uniquely identifying an individual
• Personal data collected from a known child, meaning a child under 13 whose age the controller actually knows or willfully disregards
• Precise geolocation data, meaning data that identifies a person’s location within a radius of 1,750 feet (533.4 meters)

Controller Under the TDPSA

Businesses that collect and process personal information will likely qualify as controllers, which the TDPSA defines as “an individual or other person that, alone or jointly with others, determines the purpose and means of processing personal data.”

Processor Under the TDPSA

For businesses that share personal data for processing purposes, the business will be the controller and the third-party entity with which personal data is shared will be the processor, defined in the Texas privacy act as “a person that processes personal data on behalf of a controller.”

Sale Under the TDPSA

The TDPSA defines a sale as “the sharing, disclosing, or transferring of personal data for monetary or other valuable consideration by the controller to a third party.” The definition does not include disclosures:

• To a processor that processes the personal data on the controller’s behalf
• To a third party to provide a product or service the consumer requested
• To an affiliate of the controller
• Of information the consumer intentionally made available to the general public through a mass media channel and did not restrict to a specific audience
• To a third party as an asset that is part of a merger or acquisition

Targeted Advertising Under the TDPSA

The TDPSA defines targeted advertising as “displaying to a consumer an advertisement that is selected based on personal data obtained from that consumer’s activities over time and across nonaffiliated websites or online applications to predict the consumer’s preferences or interests.”

The goal is to use the personal data to predict the consumers’ interests and preferences to increase relevance and personalize the advertising experience.

Targeted advertising does not include:

• Advertisements based on activities within a controller’s own websites or online applications
• Advertisements based on the context of a consumer’s current search query or visit to a website or online application
• Advertisements directed to a consumer in response to the consumer’s request for information or feedback
• Processing personal data solely for measuring or reporting advertising performance, reach, or frequency

Who Has to Comply With the TDPSA?

The TDPSA does not use consumer-count or revenue thresholds. Nebraska’s law takes a similar approach. A business is covered if it meets all three of these criteria:

• It conducts business in Texas or produces a product or service consumed by Texas residents
• It processes personal data or engages in the sale of personal data
• It is not a small business as defined by the U.S. Small Business Administration (SBA)

SBA size standards vary by industry and are based on either employee count or revenue, so a business should check the standard for its own industry. Even a business that qualifies as a small business may not sell sensitive personal data without the consumer’s prior consent.

Exemptions to the TDPSA

The TDPSA exempts certain organizations outright and certain categories of data.

Exempt organizations include:

• State agencies and political subdivisions of Texas
• Financial institutions and data subject to the Gramm-Leach-Bliley Act (GLBA)
• Covered entities and business associates governed by HIPAA and the HITECH Act
• Nonprofit organizations
• Institutions of higher education
• Electric utilities, power generation companies, and retail electric providers

Exempt data includes:

• Protected health information under HIPAA, health records, and certain other health care and research data
• Information created for the Health Care Quality Improvement Act and patient safety work product under the Patient Safety and Quality Improvement Act
• Information regulated by the Fair Credit Reporting Act (FCRA), to the extent that law applies
• Personal data regulated by the Family Educational Rights and Privacy Act (FERPA), the Driver’s Privacy Protection Act, or the Farm Credit Act
• Data processed in an employment context, such as for job applicants, employees, agents, and independent contractors, along with emergency contact and benefits administration data

The Children’s Online Privacy Protection Act (COPPA) is handled separately, and complying with COPPA’s parental consent requirements is treated as complying with the TDPSA’s parental consent obligations.

Consumers’ Rights Under the Texas Data Privacy and Security Act

Consumers have five main rights under the TDPSA. Parents or legal guardians can exercise a known child’s rights. Controllers also may not discriminate against consumers for exercising these rights, although bona fide loyalty and rewards programs are among the permitted exceptions.

The TDPSA has no private right of action, so consumers cannot sue controllers for violations. California’s private right of action is limited to certain data breaches.

TDPSA Consumer Rights

Right to access

Confirmation of whether the controller is processing the consumer’s personal data, and access to that data

Right to correction

Correct inaccuracies in the consumer’s personal data, taking into account the nature of the data and the purposes of the processing

Right to delete

Delete personal data provided by or obtained about the consumer

Right to portability

If the data is available in a digital format, obtain a copy of the personal data the consumer previously provided to the controller, in a portable and, to the extent technically feasible, readily usable format

Right to opt out

Opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling “in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer”

How Does the Texas Data Privacy and Security Act Affect Businesses?

The Texas Data Privacy and Security Act places obligations on organizations that do business in Texas or offer products and services to Texas residents, and it sets requirements for how they collect, use, and share personal data. The practical effect depends on a business’s role and the data it handles, so the next step is to understand what meeting those requirements involves.

Consumer Requests and Appeals

Controllers must tell consumers about their rights and how to exercise them, and must provide at least two secure and reliable methods for submitting requests. A controller with a website must offer a way to submit requests there, and a controller that operates exclusively online and has a direct relationship with the consumer only needs to provide an email address. A controller cannot require a consumer to create a new account, although it can require use of an existing one.

Controllers must respond within 45 days of receiving a request. They can decline if they cannot authenticate the consumer’s identity using commercially reasonable efforts. They can also charge a reasonable fee or decline requests that are manifestly unfounded, excessive, or repetitive, but they bear the burden of demonstrating that. Responses must be free of charge at least twice a year per consumer.

A controller can extend the response period once by 45 days when reasonably necessary, if it tells the consumer about the extension and the reason within the first 45 days.

If a controller declines a request, the consumer can appeal, and the appeal process must be conspicuously available. The controller has 60 days to respond to an appeal in writing, with an explanation of its reasons. If the appeal is denied, the controller must give the consumer the online mechanism for submitting a complaint to the Attorney General.

Purpose Limitation Under the TDPSA

Controllers must limit the collection of personal data to what is “adequate, relevant, and reasonably necessary” for the purposes disclosed to the consumer. They also may not process personal data for purposes that are neither reasonably necessary to nor compatible with those disclosed purposes unless they obtain the consumer’s consent.

Data Security Under the TDPSA

Controllers must protect personal data by establishing, implementing and maintaining reasonable administrative, technical, and physical security measures. These measures should be appropriate to the nature and volume of personal information being processed.

Data Protection Assessments (DPAs) Under the TDPSA

Controllers must conduct and document a data protection assessment (DPA) for the following processing activities:

• Processing for targeted advertising
• Sale of personal data
• Processing of sensitive data
• Profiling that presents a reasonably foreseeable risk of harm to consumers, such as unfair or deceptive treatment, unlawful disparate impact, or financial, physical, or reputational injury
• Any other processing that presents a heightened risk of harm to consumers

The assessment must weigh the benefits of the processing against the risks to consumers, as reduced by safeguards. One assessment can cover a comparable set of processing operations, and an assessment prepared for another law can count if its scope and effect are reasonably comparable. DPAs are confidential, and the Attorney General can request them through a civil investigative demand.

Consent Requirements Under the TDPSA

Like most U.S. states with privacy laws, Texas uses an opt-out model, so consent is not required before collecting and processing personal data in many cases. 

Consent is required to process sensitive data, and to process personal data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes. Consumers must be given clear notice about processing and be able to opt out of sale, targeted advertising, or certain profiling.

For known children under 13, controllers must process data in accordance with the federal COPPA, which includes obtaining verifiable parental consent. All personal data collected from a known child is sensitive data under the TDPSA.

Nondiscrimination Under the TDPSA

Controllers are prohibited from unlawful discrimination against consumers, and from processing personal data if doing so is in violation of state or federal laws governing discrimination. Controllers cannot discriminate against consumers for exercising their rights. For example, a consumer cannot be blocked from accessing a website if they opt out of allowing collection or processing of their personal data.

However, some website features depend on certain cookies or trackers, so if a consumer opts out of them, the site may not work as intended. This is not discriminatory.

Controllers can offer a different price, level of quality, or selection to a consumer who has opted out, or in connection with a bona fide loyalty, rewards, premium features, discounts, or club card program. Offers should still be reasonable and proportionate, since regulators may scrutinize incentives that look like payment for consent.

Transparency Under the TDPSA

Controllers must give consumers a reasonably accessible and clear privacy notice, commonly on the company’s website. Under the TDPSA, the notice must include:

• The categories of personal data processed, including any sensitive data
• The purpose for processing personal data
• How consumers can exercise their rights, including how to appeal a decision
• The categories of personal data shared with third parties, if any
• The categories of third parties with which personal data is shared, if any
• A description of the methods consumers can use to submit requests

Controllers that sell personal data to third parties or process it for targeted advertising must also clearly and conspicuously disclose that activity and explain how consumers can opt out of it.

A controller that sells sensitive personal data must post the notice “NOTICE: We may sell your sensitive personal data.” A controller that sells biometric personal data must post the notice “NOTICE: We may sell your biometric personal data.” Each notice must appear in the same location and in the same manner as the privacy notice.

Third-Party Contracts Under the TDPSA

Controllers must have contracts in place with third-party processors (vendors and service providers) with clear information about:

• Duty of confidentiality
• Instructions for processing data
• Nature and purpose of the processing
• Type of data subject to processing
• Duration of the processing
• Rights and obligations of both parties
• Requirements for deletion or return of data when the processing is complete

Universal Opt-Out Signals Under the TDPSA

Since January 1, 2025, a Texas consumer can designate an authorized agent to opt out of targeted advertising and the sale of personal data using technology, such as a browser setting or extension or a global device setting, that signals the consumer’s intent to opt out. This is how Texas addresses universal opt-out signals such as Global Privacy Control (GPC).

The statute does not name GPC, but controllers must honor opt-out requests sent this way once they can verify, with commercially reasonable effort, the identity of the consumer and the agent’s authority.

The TDPSA includes limits. A controller does not have to comply if the request is not communicated clearly and unambiguously, if it cannot verify that the consumer is a Texas resident, if it cannot process the request, or if it does not process similar requests under another state’s law. The technology also may not use a default setting: The consumer must make an affirmative, freely given, and unambiguous choice to opt out.

These signals let consumers set their preferences once and have them communicated to every website they visit. Honoring them can help businesses that operate in several states apply a consistent approach to opt-out requests.

Updates to the TDPSA

Texas lawmakers have revisited the TDPSA since its enactment, and some of the resulting changes affect how businesses work with processors and use artificial intelligence. The first to consider is HB 149.

HB 149: Processors and AI Systems

On June 22, 2025, the Governor signed HB 149, the Texas Responsible Artificial Intelligence Governance Act (TRAIGA), which took effect on January 1, 2026. Among its provisions, TRAIGA amended the TDPSA’s processor duties. A processor must already assist the controller with the security of processing and with breach notification, and the amendment clarifies that this assistance extends to personal data processed through artificial intelligence systems.

Businesses that use AI tools in their data workflows should review their processor contracts with this change in mind. The amendment does not rewrite the TDPSA’s general controller duties or its assessment requirements.

What Happens If a Business Violates the Texas Data Privacy and Security Act?

The TDPSA is enforced by the Texas Attorney General, and businesses that fall short of its requirements may face legal consequences. The details of how enforcement works are set out below.

Enforcement Under the TDPSA

The Texas Attorney General has exclusive authority to enforce the TDPSA, and the law has no private right of action. Consumers can submit complaints, including about a denied request or appeal, through the online mechanism the Attorney General maintains. Before bringing an action, the Attorney General must give the business written notice, at least 30 days in advance, that identifies the specific provisions allegedly violated.

Enforcement Activity

On January 13, 2025, the Attorney General sued Allstate and its subsidiary Arity, in what the Attorney General described as the first enforcement action by a state attorney general under a comprehensive privacy law. The complaint alleges that the companies collected, used, and sold precise geolocation and driving data through software embedded in third-party mobile apps, without a privacy notice or consumer consent. It also includes claims under Texas’s data broker law and Insurance Code.

These are allegations, and the case is a useful indication of the Attorney General’s focus on notice, sensitive data, and opt-out mechanics.

Cure Period Under the TDPSA

A business that receives the Attorney General’s notice has 30 days to cure the alleged violation. To avoid an action, it must also give the Attorney General a written statement confirming that it:

• Cured the violation
• Notified the affected consumer, if the consumer’s contact information is available
• Provided supporting documentation showing how the violation was cured
• Made changes to internal policies, if necessary, to help prevent further violations

Unlike in several other states, where the cure period has expired or been repealed, Texas’s cure period has no end date.

Fines and Penalties Under the TDPSA

A person who violates the TDPSA after the cure period, or who breaches the written statement given to the Attorney General, is liable for a civil penalty of up to USD 7,500 per violation. The Attorney General can also seek an injunction and recover reasonable attorney’s fees and other expenses of investigating and bringing the action.

How Consent Infrastructure Supports TDPSA Requirements

Texas asks businesses for clear notice, a working opt-out, and consent only in narrower cases. Consent infrastructure, such as a consent management platform (CMP), can help deliver all three.

Under the TDPSA, controllers can usually collect and process personal data without prior consent. Consent is required to process sensitive data and to process data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes. For known children under 13, controllers must follow COPPA.

Four requirements matter most to visitors:

• A clear privacy notice, including the required notice if the business sells sensitive or biometric data
• A way to opt out of targeted advertising, the sale of personal data, and certain profiling
• Clear and conspicuous disclosure of any sale or targeted advertising, with instructions for opting out
• Recognition of opt-out requests sent through authorized-agent technology, such as browser settings or extensions

A CMP can help on each front. Usercentrics Web CMP and App CMP can detect the cookies and other tracking technologies in use on websites and apps, present notices and choices in a banner, and show visitors which data categories, services, and third parties are involved. Consent records can also support an organization’s documentation of visitors’ choices.

A company operating across the U.S. or abroad may need to meet several privacy laws at once. Geotargeting helps by presenting the right notice and choices based on each visitor’s location, in the visitor’s preferred language. That can support privacy compliance efforts under the TDPSA, other U.S. state laws, and regulations such as the GDPR, which sets stricter consent requirements than U.S. state privacy laws.

Preparing for the Texas Data Privacy and Security Act

Organizations that meet the TDPSA’s criteria have been subject to it since July 1, 2024, and to the opt-out signal provision since January 1, 2025. Businesses that already meet the requirements of other state privacy laws, such as Virginia’s, have likely done much of the work, though each law has its own provisions. As always, a privacy by design approach benefits all operations, whether for regulatory purposes or not.

Meeting the TDPSA’s requirements mainly involves four checks:

• Applicability: Does the business operate in Texas or serve Texas residents, process or sell personal data, and fall outside the SBA small business definition? Small businesses still need consent before selling sensitive data
• Privacy notice: Does it cover the required items, including the notices for sales of sensitive or biometric data?
• Requests and signals: Are there at least two ways to submit requests, a 45-day response process, an appeal process, and a way to honor opt-out requests sent through authorized-agent technology?
• Processor contracts and assessments: Do contracts include the required terms, and are data protection assessments documented for the processing that requires them?

Usercentrics help with notices and opt-outs. Texas has already amended the law once, and further updates are possible as technology and consumer expectations change. Qualified legal counsel or the organization’s data protection officer (DPO) can help confirm specific obligations.

Protecting customer privacy proactively can strengthen customer relationships over time, and clear, respectful consent experiences can support higher-quality first-party data for audience building and measurement.

Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.