Comprehensive state privacy law
Texas privacy law
Texas Data Privacy and Security Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Tex. Bus. & Com. Code §§ 541.001 to 541.205
- Enacted
- June 18, 2023. Acts 2023, 88th Leg., R.S., ch. 995 (H.B. 4)
- In force
- July 1, 2024
- Effective dates
- July 1, 2024: main provisions (H.B. 4, § 7(a)); data protection assessments apply only to processing activities generated after this date (H.B. 4, § 4)
- January 1, 2025: authorized-agent opt-out technology (universal opt-out signals) must be honored (§ 541.055(e); H.B. 4, § 7(b))
- January 1, 2026: H.B. 149 amendment to processor duties (artificial intelligence systems) in force
- Enforcer
- Attorney General (exclusive)
- Private right of action
- No. The chapter provides no basis for a private right of action (§ 541.156).
- Cure period
- 30 days. Before suing, the Attorney General must give 30 days' written notice. No action may be brought if the person cures within 30 days and gives a written statement of cure, consumer notice where possible, supporting documents and policy changes. The cure period has no end date. Breaching the written statement exposes the person to penalties (§ 541.155(a)). (§ 541.154)
- Rulemaking
- No. The chapter grants no rulemaking power. The Attorney General must post guidance and a complaint mechanism (§ 541.152).
Amendments
- Acts 2025, 89th Leg., R.S., ch. 1174 (H.B. 149), § 3 (in force January 1, 2026). Processors must also help controllers with the security of personal data collected, stored and processed by an artificial intelligence system (as defined in § 551.001).
Topics
- ApplicabilityThe act applies to any person that does business in Texas or produces a product or service consumed by residents, processes or sells personal data, and is not a small business as defined by the U.S. Small Business Administration. There is no consumer-volume or revenue threshold. Small businesses remain bound by one rule: they may not sell sensitive data without prior consent. State agencies, financial institutions or data subject to GLBA Title V, HIPAA covered entities and business associates, nonprofits, higher education and certain electricity companies are exempt.
- Consumer rightsConsumers may confirm and access, correct, delete data provided by or obtained about them, obtain a portable copy of data they provided, and opt out of targeted advertising, sale and significant profiling. Controllers answer within 45 days, extendable once by 45 days, and must answer free of charge at least twice a year per consumer. Appeals must be decided within 60 days, with a link to the Attorney General's complaint mechanism on denial.
- Sensitive dataSensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, citizenship or immigration status, identifying genetic or biometric data, data from a known child under 13, and precise geolocation within 1,750 feet. Controllers need consent to process it, and must follow COPPA for a known child. Controllers that sell sensitive or biometric data must post a set notice, and even exempt small businesses need prior consent to sell sensitive data.
- Controller dutiesControllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and not process for incompatible purposes without consent. The privacy notice must list categories of data (including sensitive data), purposes, rights and appeals, data and recipients shared with, and the request methods. Data protection assessments are required for targeted advertising, sale, risky profiling, sensitive data and other heightened-risk processing; universal opt-out technologies used through an authorized agent must be honored from 1 January 2025.
- ProcessorsProcessors must follow instructions and help with consumer requests, security (including, since 1 January 2026, data processed by an artificial intelligence system), breach notice and assessments. The contract must set out instructions, nature and purpose, data types, duration and the parties' rights and obligations. It must require confidentiality, deletion or return, compliance information, cooperation with assessments (or an independent assessor's report) and written flow-down to subcontractors.
- EnforcementThe Attorney General has exclusive enforcement authority and may issue civil investigative demands, including for data protection assessments. Before suing, the Attorney General must allow a 30-day cure period, which has no end date. Violations after the cure period, or breach of the written cure statement, carry a civil penalty of up to $7,500 per violation plus injunctions and fees; there is no private right of action.
Sources
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Texas statute
Reference material, not legal advice.