---
title: "Texas privacy law (TDPSA): consumer rights"
canonical: "https://dposchool.com/state-privacy-laws/state/texas/consumer-rights"
source: "https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Texas Data Privacy and Security Act

# Texas privacy law (TDPSA): consumer rights

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Consumers may confirm and access, correct, delete data provided by or obtained about them, obtain a portable copy of data they provided, and opt out of targeted advertising, sale and significant profiling. Controllers answer within 45 days, extendable once by 45 days, and must answer free of charge at least twice a year per consumer. Appeals must be decided within 60 days, with a link to the Attorney General's complaint mechanism on denial.

## Key points

1. Rights to confirm and access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale and significant profiling.

   Section: [§ 541.051(b)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

2. A parent or legal guardian may exercise rights for a known child.

   Section: [§ 541.051(a)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

3. Response within 45 days; one 45-day extension with notice and reasons.

   Section: [§ 541.052(b)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

4. Free of charge at least twice a year per consumer.

   Section: [§ 541.052(d)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

5. Appeal decided in writing within 60 days; on denial the controller gives the Attorney General's online complaint mechanism.

   Section: [§ 541.053(c), (d)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

6. At least two secure methods to submit requests; website mechanism required, email enough for online-only businesses with a direct relationship.

   Section: [§ 541.055(a) to (d)](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

7. Contract terms waiving or limiting rights are void.

   Section: [§ 541.054](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

## Sources

- [https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

[Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access)
- [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion)
- [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Texas statute](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm)

Reference material, not legal advice.

## Other topics for Texas

- [Applicability](https://dposchool.com/state-privacy-laws/state/texas/applicability)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/texas/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/texas/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/texas/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/texas/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Texas](https://dposchool.com/state-privacy-laws/state/texas) / Consumer rights

Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/texas/applicability)

Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/texas/sensitive-data)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents