Texas Data, Privacy & AI

Texas insurers face overlapping breach-notification clocks: 60 days for consumers and 30 days for the Attorney General under chapter 521, plus TDI reporting guidance. This guide maps each clock to its trigger, recipient, and deadline.

The Lone Star Infrastructure Protection Act limits foreign-connected vendors' access to Texas critical infrastructure, with a warranty carveout and newer ERCOT attestation duties. This guide covers the statute, the 2023 and 2025 amendments, and vendor diligence.

Texas Education Code Chapter 32 restricts how EdTech operators collect, use, and sell student data, with duties for security, deletion, and advertising limits. This guide explains the operator definition, prohibitions, and contract terms districts should require.

When a third party assembles social-media information for hiring, the Fair Credit Reporting Act may apply, requiring standalone disclosure, written authorization, and a two-step adverse-action process. This guide walks through the compliant workflow.

Texas workplace monitoring sits at the intersection of Penal Code section 16.02, Civil Practice and Remedies Code Chapter 123, and federal wiretap law. This guide helps employers separate lawful security practices from risky surveillance and BYOD pitfalls.

Fingerprint and face-geometry timeclocks can trigger Texas CUBI duties: notice, consent, reasonable care, and destruction within a year after the purpose expires. This guide covers employer obligations and the $25,000-per-violation enforcement risk.

Data transfers in Texas mergers and acquisitions keep the conditions of original collection, even though the TDPSA excludes merger-or-acquisition asset transfers from its definition of sale. This guide covers diligence, representations, and integration planning for buyers and sellers.

Selling customer data in bankruptcy can require a court-appointed consumer privacy ombudsman under 11 U.S.C. sections 332 and 363. This guide explains when the ombudsman applies and how to structure privacy-protective sale terms.

AI training data remains subject to TDPSA sensitive-data consent, data-protection assessments, and the 2026 CUBI amendment's AI-training exception. This guide covers building a training-data register and allocating risk in enterprise terms.

Texas addresses synthetic media through targeted rules: election deepfakes, synthetic intimate imagery, misappropriation, and post-mortem rights. This guide maps each regime and the practical steps for permission, labeling, and takedown.

The federal Video Privacy Protection Act restricts disclosure of viewers' specific video choices, with consent rules that demand separation, time limits, and withdrawal rights. This guide covers when websites qualify and how to handle analytics tags.

Pixels, session-replay tools, and chat widgets can transmit URLs, keystrokes, and unsent drafts, creating risk under Texas interception theories. This guide explains the contested claims and how to audit tags, limit vendors, and honor opt-out signals.