DPO SchoolDPO School

Texas Data Privacy and Security Act

Texas privacy law (TDPSA): sensitive data

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, citizenship or immigration status, identifying genetic or biometric data, data from a known child under 13, and precise geolocation within 1,750 feet. Controllers need consent to process it, and must follow COPPA for a known child. Controllers that sell sensitive or biometric data must post a set notice, and even exempt small businesses need prior consent to sell sensitive data.

Key points

  1. Sensitive data definition, including precise geolocation within 1,750 feet.

    Section: § 541.001(29); § 541.001(21)

  2. Consent required to process sensitive data; a known child's data must be processed under COPPA.

    Section: § 541.101(b)(4)

  3. Child means under 13; known child means actual knowledge or wilful disregard of age.

    Section: § 541.001(5), (17)

  4. Sellers of sensitive data must post: 'NOTICE: We may sell your sensitive personal data.'

    Section: § 541.102(b)

  5. Sellers of biometric data must post: 'NOTICE: We may sell your biometric personal data.'

    Section: § 541.102(c)

  6. Small businesses may not sell sensitive data without prior consent.

    Section: § 541.107(a)

Sources

Compare sensitive data across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Texas statute

Reference material, not legal advice.