79%
of Texas's 19 requirements are already met by California (CA). Here is what TDPSA adds, biggest gaps first.
ThresholdsWho it coversBig gap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
TDPSA adds3 Any business in Texas that processes or sells personal data and is not an SBA-defined small business; small businesses still need consent to sell sensitive data.
Tex. Bus. & Com. Code §§ 541.002(a), 541.107 · source ↗
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
TDPSA adds2 Internal appeal answered within 60 days; on denial, controller gives the AG online complaint mechanism.
Tex. Bus. & Com. Code § 541.053 · source ↗
Sensitive dataSensitive data and minorsGap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
TDPSA adds1 Opt-in consent to process sensitive data; COPPA rules for known children.
Tex. Bus. & Com. Code § 541.101(b)(4) · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
TDPSA adds3 Deidentified data needs public commitment and contracts; pseudonymous data exempt from certain rights if kept separate; oversight duty.
Tex. Bus. & Com. Code § 541.106 · source ↗
Already covered by CA: Exemptions, Children and teens, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means TDPSA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
