Last updated: 27 October 2026
Quick answer: The Texas Data Privacy and Security Act (TDPSA) is Texas’s comprehensive consumer privacy law, in effect since July 1, 2024. It applies to most businesses that operate in Texas or target Texans and process personal data, with no revenue or volume threshold. It grants access, deletion and opt-out rights and carries penalties up to $7,500 per violation.
Texas has become one of the most actively enforced state privacy regimes in the US. The Texas Attorney General set up a dedicated privacy enforcement team in June 2024 and filed what it called the first state enforcement action under a comprehensive privacy law in January 2025.
This guide explains who the TDPSA applies to, what it requires from controllers and processors, how it compares with other state laws, and what a practical compliance program looks like. It ends with a checklist your privacy team can use.
What is the Texas Data Privacy and Security Act?
The Texas Data Privacy and Security Act is codified in Chapter 541 of the Texas Business and Commerce Code. It was enacted as House Bill 4 in 2023 and took effect on July 1, 2024, with the universal opt-out requirements following on January 1, 2025.
It follows the controller and processor model used by Virginia and other states rather than California’s model. The Texas Attorney General has exclusive enforcement authority, and there is no private right of action.
Who does the TDPSA apply to?
The TDPSA applies to a person that conducts business in Texas or produces products or services consumed by Texas residents, processes or sells personal data, and is not a small business as defined by the US Small Business Administration. Unlike most state laws, there is no minimum number of consumers or revenue threshold.
The small business rule
Small businesses are largely outside the law, with one important exception: under Section 541.107, even a small business may not sell sensitive data without the consumer’s prior consent. Because the SBA definition varies by industry, check the size standard for your NAICS code rather than assuming you qualify.
Entity-level exemptions
Section 541.002(b) excludes:
- state agencies and political subdivisions;
- financial institutions subject to Title V of the Gramm-Leach-Bliley Act;
- HIPAA covered entities and business associates;
- nonprofit organizations;
- institutions of higher education;
- electric utilities, power generation companies and retail electric providers.
Data-level exemptions also apply, for example to protected health information under HIPAA, data covered by the Fair Credit Reporting Act or FERPA, and data processed in an employment context.
Common mistake: Assuming a company with no Texas office is out of scope. The test is whether you conduct business in Texas or produce products or services consumed by Texans, so an out-of-state ecommerce or SaaS business can easily be covered.
What rights do Texas consumers have?
Texas consumers can confirm and access their data, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and certain profiling. They can also appeal a refusal.
| Right | What it means |
|---|---|
| Access and confirmation | Confirm whether you process their data and get access to it |
| Correction | Correct inaccuracies, taking into account the nature of the data and purposes |
| Deletion | Delete personal data provided by or obtained about the consumer |
| Portability | Obtain a copy in a portable, readily usable format where processing is automated |
| Opt-out | Opt out of targeted advertising, sale of personal data, and profiling in furtherance of decisions with legal or similarly significant effects |
| Appeal | Appeal a refusal to act on a request |
Response deadlines
Controllers must respond without undue delay and within 45 days of receiving a request, with one 45-day extension where reasonably necessary, according to the Texas Attorney General’s TDPSA guidance. Appeals must be decided within 60 days. Information must be provided free of charge at least twice a year per consumer.
Universal opt-out and authorized agents
Since January 1, 2025, consumers can designate an authorized agent, including technology such as a browser setting or extension, to opt out of targeted advertising and sales on their behalf. In practice, this means honoring signals such as Global Privacy Control where they meet the statutory conditions.
In practice: Build one intake route for every US state law rather than a Texas-only form. The rights overlap heavily, and a single workflow with state-specific deadlines is easier to evidence. Our explainer on what a DSAR is covers the basics of request handling.
What are the controller obligations under the Texas Data Privacy and Security Act?
Controllers must limit collection, secure data, get consent for sensitive data, publish a clear privacy notice, run data protection assessments for higher-risk processing and put contracts in place with processors.
Data minimization and security
Collection must be adequate, relevant and reasonably necessary for the disclosed purposes. Controllers must maintain reasonable administrative, technical and physical data security practices appropriate to the volume and nature of the data.
Sensitive data needs consent
Sensitive data includes data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, and citizenship or immigration status; genetic or biometric data processed to identify an individual; personal data from a known child under 13; and precise geolocation data. Processing it requires opt-in consent, and a known child’s data must be processed in line with COPPA.
Privacy notice and sale notices
Your privacy notice must describe the categories of personal data processed, the purposes, how consumers can exercise their rights and appeal, the categories of data shared with third parties and the categories of those third parties. If you sell sensitive or biometric data, the law requires specific wording: “NOTICE: We may sell your sensitive personal data.” or “NOTICE: We may sell your biometric personal data.”
Data protection assessments
A documented assessment is required for targeted advertising, sale of personal data, certain profiling, processing of sensitive data, and any processing that presents a heightened risk of harm. The Attorney General can request these assessments during an investigation, so they must be complete and current. A structured DPIA workflow can be reused for this purpose.
Processor contracts
Processors must follow controller instructions and assist with consumer requests, security and assessments. Contracts must set out the processing instructions, the nature, purpose and duration of processing, confidentiality, deletion or return of data, audit cooperation and flow-down to subcontractors. Legislation passed in 2025 as part of the Texas Responsible Artificial Intelligence Governance Act, effective January 1, 2026, clarified that processor assistance covers the security of personal data processed by an AI system.
If you are tracking these obligations across several state laws, you can start your 14-day free trial of Enactia’s AI-powered GRC platform and map one set of privacy controls to Texas, California and other state requirements.
How is the TDPSA enforced?
The Texas Attorney General enforces the TDPSA exclusively. Before bringing an action, the Attorney General must give written notice and a 30-day period to cure; violations that are not cured can lead to civil penalties of up to $7,500 per violation and injunctive relief.
Unlike some states, the Texas cure period does not expire. That does not make enforcement toothless. In June 2024 the Attorney General launched a data privacy and security initiative with a dedicated team in the Consumer Protection Division. On January 13, 2025, it sued Allstate and its subsidiary Arity, alleging that driving and location data were collected through mobile app software without proper notice or consent and sold to insurers.
The allegations in that case map directly to TDPSA obligations: sensitive data consent, the required sale notice, accessible opt-out methods and complete privacy disclosures. They are a useful checklist of what the regulator looks at first.
How does the TDPSA compare with other privacy laws?
The TDPSA is closest to Virginia’s law but has a broader scope because it has no volume threshold. The table below compares key points with California and the EU GDPR for teams running multi-jurisdiction programs.
| Topic | Texas TDPSA | California CCPA/CPRA | EU GDPR |
|---|---|---|---|
| Applicability test | Business in Texas, not an SBA small business; no volume threshold | Revenue, volume or data-sale thresholds | Establishment in the EU or targeting/monitoring people in the EU |
| Sensitive data | Opt-in consent | Right to limit use | Prohibited unless an Article 9 condition applies |
| Response time | 45 days, plus 45-day extension | 45 days, plus 45-day extension | One month, extendable by two months |
| Enforcer | Texas Attorney General only | California Privacy Protection Agency and Attorney General | National data protection authorities |
| Private right of action | No | Limited, for certain data breaches | Yes, compensation for damage |
| Cure period | 30 days, no expiry | Discretionary | None |
For a wider view of state laws, see our guide to CCPA, CPRA and US state privacy law compliance and the CCPA framework page.
TDPSA compliance checklist
- Confirm scope. Check whether you conduct business in Texas, whether you meet the SBA small business definition, and whether any entity-level exemption applies.
- Map personal data. Record what you collect about Texans, the purposes, where it goes and whether any of it is sensitive. A record of processing activities gives you a reusable inventory.
- Fix consent for sensitive data. Make sure precise geolocation, health, biometric and children’s data is only processed with valid opt-in consent.
- Update the privacy notice. Include all required disclosures and, if relevant, the exact sale notice wording.
- Stand up rights handling. Provide at least two request methods, verify identity, track 45-day deadlines and run an appeals process.
- Honor opt-out signals. Configure your consent tools to respect qualifying universal opt-out signals.
- Complete assessments. Document data protection assessments for targeted advertising, sales, profiling and sensitive data.
- Review processor contracts. Add the Section 541.104 terms, including subcontractor flow-down and AI system security where relevant.
- Keep evidence. Retain records of requests, consents, assessments and contract reviews so you can respond to an Attorney General notice within the 30-day cure window.
Key takeaways
- The TDPSA has applied since July 1, 2024 and has no revenue or volume threshold; SBA small businesses are mostly exempt.
- Sensitive data requires opt-in consent, and selling sensitive or biometric data requires a specific notice.
- Controllers have 45 days to respond to requests and must honor universal opt-out signals since January 1, 2025.
- The Attorney General enforces exclusively, with a permanent 30-day cure period and penalties up to $7,500 per violation.
- Early enforcement has focused on sensitive data, notices and opt-out mechanisms.
Frequently asked questions
When did the Texas Data Privacy and Security Act take effect?
The TDPSA took effect on July 1, 2024. The provisions allowing consumers to use authorized agents, including technology such as browser-based universal opt-out signals, to opt out of targeted advertising and sales followed on January 1, 2025. An amendment to processor duties relating to AI systems took effect on January 1, 2026, as part of the Texas Responsible Artificial Intelligence Governance Act.
Does the TDPSA apply to small businesses?
Mostly no. Businesses that meet the US Small Business Administration definition of a small business are generally outside the law. However, Section 541.107 still prohibits them from selling sensitive data without the consumer’s prior consent. Because SBA size standards vary by industry, check the standard for your NAICS code before relying on the exemption.
What are the penalties under the TDPSA?
The Texas Attorney General can seek civil penalties of up to $7,500 per violation, plus injunctive relief and recovery of attorney’s fees and investigative costs. Before suing, the Attorney General must give written notice and allow 30 days to cure. Consumers cannot sue directly because the law contains no private right of action.
Does the TDPSA require data protection assessments?
Yes. Controllers must document assessments for targeted advertising, the sale of personal data, profiling that presents certain foreseeable risks, processing sensitive data, and any other processing that presents a heightened risk of harm to consumers. The Attorney General can request an assessment during an investigation, so keep assessments complete, dated and linked to the processing they cover.
Is the TDPSA the same as the CCPA?
No. Both give consumers access, deletion and opt-out rights with 45-day response times, but the TDPSA uses opt-in consent for sensitive data, has no revenue threshold, is enforced only by the Attorney General, and keeps a permanent cure period. The CCPA has its own regulator, the California Privacy Protection Agency, and a limited private right of action for breaches.
Conclusion: treat Texas as a baseline, not an exception
Because the Texas Data Privacy and Security Act has no volume threshold, many organizations that fall outside other state laws are covered here. Get scope right, fix sensitive data consent and notices, build a single rights-handling process for all states, and keep assessments and processor contracts current. That approach covers Texas and makes each new state law a smaller increment of work, especially when requests run through a consumer request management workflow.
If you want to see how one privacy program can cover Texas, California and other state laws together, contact us or book a demo or start your 14-day free trial.
This article is for general information and is not legal advice.
