AI Training Data and Texas Privacy Law

Training an artificial intelligence system on personal data does not escape Texas privacy law. The Texas Data Privacy and Security Act's consent and assessment rules apply, and the 2026 amendments to the Texas biometric statute added a narrow exception for AI training. This guide explains how to keep a training-data register and allocate risk in contracts.

What the law requires

TDPSA. Sensitive data includes data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis, sexuality, or citizenship or immigration status; genetic or biometric data processed to uniquely identify a person; personal data collected from a known child; and precise geolocation data (§541.001(29)). A controller needs the consumer's consent before processing sensitive data (§541.101(b)(4)). It must also conduct and document a data protection assessment before processing personal data for targeted advertising, selling it, profiling that presents a reasonably foreseeable risk of harm, processing sensitive data, or any other processing that presents a heightened risk of harm (§541.105).

CUBI. HB 149 amended the Capture or Use of Biometric Identifier Act effective January 1, 2026. The statute does not apply to biometric identifiers used to develop, train, evaluate, disseminate, or offer AI systems unless a system is used to uniquely identify a specific individual, or to AI used to prevent or investigate security incidents, fraud, and other illegal activity (Bus. & Com. Code §503.001(e)(2), (e)(3)). An identifier captured for AI training and later used for another commercial purpose becomes subject to the statute's possession, destruction, and penalty provisions (§503.001(f)). Where CUBI applies, an image posted online does not by itself supply notice or consent unless the person made it public (§503.001(b-1)).

TRAIGA. The Texas Responsible Artificial Intelligence Governance Act, also enacted as HB 149 and effective January 1, 2026, bars developing or deploying AI with intent to manipulate people into self-harm, harm to others, or crime; with the sole intent of infringing constitutional rights; with intent to discriminate unlawfully against a protected class; or with the sole intent of producing child sexual abuse material or unlawful sexual deepfakes. The Attorney General enforces it.

Trade secrets. Under the Texas Uniform Trade Secrets Act, information is a trade secret only if its owner takes reasonable measures to keep it secret (Civ. Prac. & Rem. Code §134A.002(6)). Uploading source code, client data, or proprietary methods to a public AI model can breach confidentiality agreements and defeat trade secret protection.

Sources and legal update

Current through October 12, 2026.

This material is for general information and is not legal advice. Law and enforcement practice change. Consult counsel about specific facts.

AI Training Data, Texas Privacy, and Trade Secrets

What the law requires

Related topics

Sources and legal update