What Is
What Is CUBI
The Capture or Use of Biometric Identifier Act (CUBI), Business and Commerce Code §503.001, governs biometric identifiers collected for a commercial purpose. A biometric identifier is a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry (§503.001(a)). A person may not capture one for a commercial purpose without first informing the individual and receiving the individual's consent (§503.001(b)). Since January 1, 2026, an image or other media posted online does not by itself supply that consent unless the individual made it public (§503.001(b-1)). A person holding a biometric identifier may not sell, lease, or otherwise disclose it except in four listed cases, must protect it with reasonable care, and must destroy it within a reasonable time, no later than one year after the purpose for collecting it expires (§503.001(c)); special rules apply to records another law requires to be kept and to employer security systems (§503.001(c-1), (c-2)).
The section does not apply to (1) voiceprint data retained by a financial institution or an affiliate of a financial institution, as those terms are defined by 15 U.S.C. Section 6809; (2) the training, processing, or storage of biometric identifiers involved in developing, training, evaluating, disseminating, or otherwise offering artificial intelligence models or systems, unless a system is used or deployed to uniquely identify a specific individual; or (3) the development or deployment of an AI model or system to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or other illegal activity, to preserve system integrity, or to investigate or prosecute those responsible (§503.001(e)). If a biometric identifier captured for AI training is later used for a commercial purpose not described by §503.001(e), its possessor becomes subject to the section's possession and destruction provisions and associated penalties (§503.001(f)). CUBI's regime is separate from the TDPSA, which treats biometric processing to uniquely identify a person as sensitive-data processing with its own consent rule.
The Attorney General enforces the law and may recover civil penalties of up to $25,000 per violation (§503.001(d)); the statute provides no private right of action. The biometric-capture provisions were codified as §503.001 by HB 2278 (80th Legislature, 2007), a nonsubstantive statutory revision, effective April 1, 2009, and were last amended by HB 149, effective January 1, 2026. The Attorney General's two largest privacy settlements resolved CUBI claims: $1.4 billion with Meta (announced July 30, 2024) and $1.375 billion with Google (a signed agreement announced October 31, 2025, though the announcement does not establish the agreement's signature date; that settlement also resolved geolocation and incognito-mode DTPA claims).
Pinpoint: Tex. Bus. & Com. Code §503.001. Related term: Biometric identifier under CUBI (CUBI).