Regulations › US states › Texas
TDPSA
Texas Data Privacy and Security Act
WhenIn effect since 1 July 2024
Who enforces itTexas Attorney General
Who it applies toBusinesses that do business in Texas or produce products or services Texas residents use, and process or sell personal data, unless they are small businesses as defined by the US Small Business Administration. Small businesses may still not sell sensitive data without consent.
ThresholdsAny business in Texas that processes or sells personal data and is not an SBA-defined small bu…
Universal opt-outMust honor browser or device global opt-out signals for targeted ads and sales since January 1…
Cure periodPermanent 30-day cure period after AG notice, with a written cure statement
Request deadline45 days, extendable once by 45 days with notice
Maximum penaltyUp to $7,500 per violation, plus attorney fees and investigation costs
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
3
Any business in Texas that processes or sells personal data and is not an SBA-defined small business; small businesses still need consent to sell sensitive data.Tex. Bus. & Com. Code §§ 541.002(a), 541.107 · source ↗
Read from enrolled HB 4 (88th Leg.) bill text; no 2025 or 2026 TDPSA amendment confirmed.
Exemptions
0
Entity-level exemptions for GLBA financial institutions, HIPAA covered entities and business associates, nonprofits, higher education and utilities.Tex. Bus. & Com. Code § 541.002(b) · source ↗
Sensitive data and minors
Sensitive data
1
Opt-in consent to process sensitive data; COPPA rules for known children.Tex. Bus. & Com. Code § 541.101(b)(4) · source ↗
Children and teens
1
Child under 13; known child data needs COPPA parental consent. No teen provisions in this law.Tex. Bus. & Com. Code §§ 541.001(5), 541.101 · source ↗
Separate SCOPE Act (HB 18) covers minors online.
Data minimization
1
Collection limited to what is adequate, relevant and reasonably necessary for disclosed purposes.Tex. Bus. & Com. Code § 541.101(a) · source ↗
Consumers' rights
Rights
2
Access, correct, delete, portability, and opt out of targeted advertising, sale and significant profiling.Tex. Bus. & Com. Code § 541.051 · source ↗
Request deadline
2
45 days, extendable once by 45 days with notice.Tex. Bus. & Com. Code § 541.052 · source ↗
Appeals
2
Internal appeal answered within 60 days; on denial, controller gives the AG online complaint mechanism.Tex. Bus. & Com. Code § 541.053 · source ↗
Universal opt-out
2
Must honor browser or device global opt-out signals for targeted ads and sales since January 1, 2025.Tex. Bus. & Com. Code § 541.055(e) · source ↗
Business duties
Assessments
2
Assessments for targeted ads, sale, risky profiling, sensitive data and heightened-risk processing; AG may request them.Tex. Bus. & Com. Code § 541.105 · source ↗
Processor contracts
3
Contract with instructions, confidentiality, deletion, compliance info, assessments or independent report, and written subcontractor flow-down.Tex. Bus. & Com. Code § 541.104 · source ↗
Privacy notice
3
Standard notice plus prescribed text: 'NOTICE: We may sell your sensitive personal data' and a matching biometric data notice.Tex. Bus. & Com. Code §§ 541.102, 541.103 · source ↗
Loyalty programs
1
Different prices allowed for voluntary participation in bona fide loyalty, rewards or discount programs.Tex. Bus. & Com. Code § 541.101(c) · source ↗
De-identified data
3
Deidentified data needs public commitment and contracts; pseudonymous data exempt from certain rights if kept separate; oversight duty.Tex. Bus. & Com. Code § 541.106 · source ↗
Enforcement
Who enforces
1
Attorney General has exclusive enforcement authority.Tex. Bus. & Com. Code § 541.151 · source ↗
Cure period
0
Permanent 30-day cure period after AG notice, with a written cure statement.Tex. Bus. & Com. Code § 541.154 · source ↗
Maximum penalty
2
Up to $7,500 per violation, plus attorney fees and investigation costs.Tex. Bus. & Com. Code § 541.155 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws