The Texas Data Privacy and Security Act (TDPSA) reaches almost any business that touches Texans' data, has no revenue or volume threshold, and is enforced by an Attorney General whose January 2025 suit against Allstate was, according to Hunton Andrews Kurth, the first enforcement action under any US state comprehensive privacy law. The Act sits in Chapter 541 of the Texas Business and Commerce Code and has applied since 1 July 2024. This guide goes past the multi-state comparison in our US State Privacy Laws Guide and works through the Texas text section by section: who is caught, what counts as sensitive data, the exact notices required, data protection assessments, processor contracts and how enforcement has played out. It is for privacy, security and engineering leads who have to turn the statute into data flows, consent screens and contract terms. Status line: statute sections and Attorney General guidance checked on 11 November 2026.
Key takeaways
- No size threshold, with one twist: the Act applies to anyone doing business in Texas or producing products or services Texans consume who processes or sells personal data, unless it is a small business under US Small Business Administration standards (section 541.002), and even small businesses need consent before selling sensitive data (section 541.107).
- Sensitive data needs opt-in consent: race or ethnicity, religious beliefs, health diagnosis, sexual orientation, citizenship or immigration status, biometric and genetic data used to identify, data from a known child under 13, and precise geolocation within 1,750 feet (section 541.001).
- Two mandatory notice sentences: a controller that sells sensitive data must state "NOTICE: We may sell your sensitive personal data." and one that sells biometric data must state "NOTICE: We may sell your biometric personal data." (section 541.102).
- Assessments are discoverable: data protection assessments for targeted advertising, sale, risky profiling and sensitive data must be produced to the Attorney General on a civil investigative demand (section 541.105).
- Enforcement is real but cured violations escape: the Attorney General alone enforces, must give 30 days' notice to cure, and can then seek up to $7,500 per violation plus injunctions and fees (sections 541.154 and 541.155).
Who the Act applies to
Section 541.002(a) sets three conditions, all of which must be met:
- Nexus: the person conducts business in Texas or produces a product or service consumed by Texas residents.
- Activity: it processes or engages in the sale of personal data.
- Size: it is not a small business as defined by the US Small Business Administration, except that section 541.107 still applies.
The SBA size standards vary by industry and are set by employee count or annual receipts, so check your NAICS code rather than assume. Section 541.002(b) excludes state agencies and political subdivisions, financial institutions and data subject to the Gramm-Leach-Bliley Act, HIPAA covered entities and business associates, nonprofit organisations, institutions of higher education, and electric utilities, power generation companies and retail electric providers.
Whose data is covered
A consumer is a Texas resident acting only in an individual or household context; people acting in a commercial or employment context are excluded. Personal data is anything linked or reasonably linkable to an identified or identifiable individual, including pseudonymous data when it is used with additional information that reasonably links it to a person, but not deidentified data or publicly available information.
| Term | Texas definition (section 541.001) | Practical effect |
|---|---|---|
| Sale of personal data | Sharing, disclosing or transferring personal data to a third party for monetary or other valuable consideration | Ad tech and data partnerships can be sales even with no cash; disclosures to processors, affiliates, for a requested service, or in a merger are excluded |
| Targeted advertising | Ads selected from activity over time across nonaffiliated websites or apps | First-party and contextual ads and ad measurement are outside it |
| Precise geolocation | Location within a radius of 1,750 feet | Mobile SDKs, telematics and store visit analytics usually collect it |
| Biometric data | Automatic measurement of biological characteristics, such as fingerprint, voiceprint, retina or iris, used to identify a specific individual | Photographs, video and audio recordings and data derived from them are excluded |
| Child | Younger than 13 | Known child data is sensitive and must be processed in line with COPPA |
| Dark pattern | An interface designed to substantially subvert or impair user autonomy, decision-making or choice | Consent obtained through one is not valid consent |
Consumer rights and response deadlines
Section 541.051 gives five rights on an authenticated request: confirm and access, correct, delete, portability for data the consumer provided in digital form, and opt out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects. A parent or guardian acts for a known child.
| Step | Rule | Section |
|---|---|---|
| Request channels | Two or more secure and reliable methods; a website must offer a request mechanism; no new account may be required | 541.055 |
| Response | Without undue delay and within 45 days; one 45-day extension with notice and reasons inside the first 45 days | 541.052 |
| Charges | Free at least twice a year per consumer; fee or refusal only for manifestly unfounded, excessive or repetitive requests, with the burden on the controller | 541.052 |
| Authentication failure | No duty to comply; may ask for more information | 541.052 |
| Refusal | Explain the justification and how to appeal, within the 45 days | 541.052 |
| Appeal decision | In writing with reasons within 60 days of receiving the appeal; if denied, give an online way to complain to the Attorney General | 541.053 |
| Authorised agents and opt-out signals | An agent may opt a consumer out of targeted advertising and sale, including by a browser setting, extension or global device setting; the signal must not be a default and must reflect an affirmative, freely given choice | 541.055(e), (f) |
The agent rule has narrow exceptions: a controller need not honour an agent's request it cannot verify as coming from a Texas resident, cannot process, or that is unclear, or where it does not honour similar requests under other states' laws. Building one opt-out pipeline that honours browser signals for all states is simpler than relying on those exceptions. See the Consent Management Guide: Cookies, CMPs and GPC.
Controller duties and the sensitive data rules
Section 541.101 sets the core duties:
- Minimisation: collect only what is adequate, relevant and reasonably necessary for the disclosed purposes. See the Data Minimisation Guide.
- Purpose limitation: no processing for purposes neither reasonably necessary to nor compatible with the disclosed ones without consent.
- Security: reasonable administrative, technical and physical data security practices appropriate to the volume and nature of the data.
- Sensitive data: no processing without consent; known child data only in line with COPPA.
- No retaliation: no different prices or service levels for exercising rights, with exceptions for loyalty, rewards and discount programmes.
The privacy notice
Section 541.102 requires a reasonably accessible and clear notice listing the categories of personal data processed (including sensitive data), the purposes, how to exercise rights and appeal, categories shared with third parties and the categories of those third parties, and the request methods. The two sale notices must appear in the same place and manner as the privacy notice.
Sensitive data in real systems
| Sensitive category | Where it hides | Control |
|---|---|---|
| Precise geolocation | Mobile SDKs, telematics, connected vehicles, store footfall analytics | SDK inventory, consent gate before location permission is used for any secondary purpose |
| Biometric data | Voice authentication, face match in identity verification, workforce time clocks (employees are outside TDPSA but inside CUBI) | Separate consent flow; check the Biometric Privacy Laws Map |
| Health diagnosis | Wellness apps, pharmacy and appointment flows, support tickets | Field-level tagging; consent before use beyond the service |
| Known child data | Family accounts, education products, games | COPPA-aligned parental consent |
| Inferred race, religion or orientation | Marketing segments and lookalike models | Ban inferred sensitive segments or treat as sensitive data |
Data protection assessments and processor contracts
Section 541.105 requires a documented assessment for targeted advertising, sale, profiling with a reasonably foreseeable risk of unfair or deceptive treatment, disparate impact, financial, physical or reputational injury or intrusion on seclusion, processing sensitive data, and any processing with heightened risk of harm. The assessment weighs benefits to the controller, consumer, stakeholders and public against risks to the consumer, as reduced by safeguards, and must consider deidentified data, reasonable expectations, context and the relationship. One assessment can cover comparable processing, and one done for another law counts if reasonably comparable in scope and effect. It is confidential and exempt from the Texas Public Information Act, and giving it to the Attorney General does not waive privilege. See the DPIA Guide.
Section 541.104 makes processors follow the controller's instructions, help with consumer requests, security and breach notification, and supply what the controller needs for assessments. The contract must set instructions, nature and purpose, data types, duration and each party's rights, and must bind the processor to:
- Confidentiality: a duty of confidentiality for every person processing the data.
- End of service: delete or return all personal data at the controller's direction unless law requires retention.
- Evidence: make available information showing compliance.
- Assessments: allow reasonable assessments by the controller or its assessor, or commission an independent assessor and provide the report.
- Subprocessors: written contracts imposing the same obligations.
How the Attorney General enforces it
There is no private right of action. The Attorney General has exclusive authority, can issue civil investigative demands, and sues for civil penalties, injunctions, attorney's fees and investigation costs.
| Stage | Rule | Section |
|---|---|---|
| Notice | Written notice at least 30 days before suit, identifying the provisions allegedly violated | 541.154 |
| Cure | No suit if within 30 days the business cures and gives a written statement that it cured, notified the consumer where it has contact details, supplies supporting documentation and updated internal policies if needed | 541.154 |
| Penalty | Up to $7,500 per violation after the cure period or for breaching the written statement | 541.155 |
| Other relief | Injunction; reasonable attorney's fees and investigation expenses | 541.155 |
Enforcement record
- June 2024: the Consumer Protection Division set up a team dedicated to privacy enforcement, which the office described as the largest such unit in the US, covering the TDPSA, the data broker law, the biometric identifier law (CUBI), the Deceptive Trade Practices Act and federal COPPA and HIPAA.
- July 2024: according to Herbert Smith Freehills Kramer, Meta agreed to pay $1.4 billion to settle the Attorney General's CUBI and DTPA case over facial recognition, which shows the scale of biometric exposure in Texas even outside the TDPSA.
- August 2024: the same firm reports that General Motors was sued under the DTPA, not the TDPSA, over driving data from more than 1.5 million Texans.
- 13 January 2025: the Attorney General announced suit against Allstate and its subsidiary Arity, which Hunton Andrews Kurth describes as the first enforcement action by any state Attorney General under a comprehensive state privacy law. The suit concerned the collection of driving and location data, which the TDPSA treats as sensitive data.
The pattern is clear: connected vehicles, mobile SDKs and location data are the priority, and the office stacks the TDPSA with older laws. Data brokers face a second regime: Senate Bill 1343, effective 1 September 2025, requires them to tell consumers how to use their TDPSA rights in their website or app notice and in the registration filed with the Secretary of State.
Where identity fits
Two parts of the Act depend on identity controls. Authentication of rights requests must be strong enough to stop an attacker using an access or deletion request to steal or destroy someone's data, yet not so heavy that it blocks real consumers; see the Data Subject Request Verification Procedure Template. And the section 541.101 security duty is mostly met through access control over the stores that hold sensitive data, including the service accounts, API keys and SDK credentials that move location and biometric data to processors and partners. An inventory of those machine identities doubles as a map of where sales and processor disclosures happen.
Implementation sequence
- Confirm applicability: record the SBA size result by NAICS code and any entity-level exemption; if small, still apply section 541.107.
- Map data and sales: inventory personal data, sensitive categories and every third-party disclosure, then classify each as processor, affiliate, requested service or sale. See the Data Mapping and ROPA Guide.
- Gate sensitive data: add opt-in consent before collecting or using each sensitive category; remove dark patterns from consent screens.
- Publish notices: update the privacy notice to section 541.102, including the exact sale sentences where they apply.
- Build the rights workflow: two channels, 45-day clock with extension tracking, appeals with a 60-day clock and the Attorney General complaint link, and an opt-out signal handler.
- Run assessments: document assessments for targeted advertising, sale, profiling and sensitive data before launch, written on the assumption that the Attorney General will read them.
- Paper processors: update contracts to section 541.104 terms.
- Prepare for a notice: name who responds, and keep a cure-statement template ready so a 30-day window can be met.
Decision guidance
- Already CCPA compliant: keep the rights tooling, but add opt-in consent for sensitive data, since California's right to limit does not satisfy Texas.
- Small business: the Act mostly does not apply, but never sell sensitive data without consent.
- App publisher using third-party SDKs: treat SDK data flows as potential sales and sensitive data collection; this is the Allstate fact pattern.
- B2B only: commercial-context data is excluded, but marketing lists and website visitors acting as individuals may not be.
Measurement and framework mapping
- Request timeliness: share of requests closed within 45 days and appeals within 60.
- Sensitive data consent coverage: share of sensitive data fields with a recorded consent basis.
- SDK and partner inventory: share of third-party data flows classified as processor, affiliate or sale.
- Assessment coverage: share of in-scope processing activities with a current assessment.
- Contract coverage: share of processors on section 541.104-compliant terms.
| TDPSA requirement | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Applicability and legal tracking | GV.OC-03 | PT-2 |
| Data inventory and sensitive categories | ID.AM-07 | PT-7 |
| Purpose limitation and minimisation | GV.OC-03 | PT-3 |
| Sensitive data consent | GV.OC-03 | PT-4 |
| Privacy notice and sale sentences | GV.OC-03 | PT-5 |
| Data protection assessments | GV.OC-03 | RA-8 |
| Processor contracts | GV.SC-05 | SA-9 |
| Reasonable security practices | PR.DS-01 | AC-3 |
Common failure patterns
- Assuming a revenue threshold: businesses below the CCPA thresholds assume Texas does not apply, when the test is SBA size.
- Unmanaged SDKs: location and device data leaves through third-party code nobody classified as a sale.
- Opt-out where opt-in is needed: treating sensitive data like general personal data with only an opt-out.
- Missing exact sentences: paraphrasing the statutory sale notices instead of using the required wording.
- Assessments written for the drawer: thin documents that become evidence once requested by civil investigative demand.
- Weak request authentication: access requests honoured on an email match alone, handing data to impostors.
Practitioner checklist
- Record the SBA size decision and any section 541.002(b) exemption.
- Inventory sensitive data, including precise geolocation within 1,750 feet and biometric identifiers.
- Classify every third-party disclosure, including SDKs, as processor, affiliate or sale.
- Gate sensitive data behind opt-in consent free of dark patterns.
- Publish the section 541.102 notice with the exact sale sentences where relevant.
- Run 45-day request and 60-day appeal clocks with the Attorney General complaint link.
- Honour opt-out signals and authorised agents.
- Document assessments for targeted advertising, sale, profiling and sensitive data.
- Update processor contracts to section 541.104.
- Keep a 30-day cure response plan.
Standards and references
- Texas Attorney General: Texas Data Privacy and Security Act
- Public.Law: Texas Business and Commerce Code section 541.155 Civil Penalty
- Public.Law: Texas Business and Commerce Code section 541.001 Definitions
- Public.Law: Texas Business and Commerce Code section 541.002 Applicability
- Public.Law: Texas Business and Commerce Code section 541.105 Data Protection Assessments
- Hunton Andrews Kurth: Texas AG sues Allstate in first enforcement action under a state comprehensive privacy law
- Herbert Smith Freehills Kramer: Texas positions itself as a privacy enforcement leader
- Hunton Andrews Kurth: Texas legislature amends data broker law
Related NHI Mgmt Group resources: US State Privacy Laws Guide · CCPA and CPRA · Texas Responsible AI Governance Act (TRAIGA) Guide · US State Privacy and Security Laws Quick Reference. This guide summarises the Texas Data Privacy and Security Act and is not legal advice. Source note: statute sections were read on Public.Law reproductions of the official code and the Attorney General's guidance page. Confirm against the official text before relying on it.