Texas Data Law

What Is

What Is the DTPA

The Deceptive Trade Practices-Consumer Protection Act (DTPA), Business and Commerce Code chapter 17, subchapter E (§17.41 and following), is Texas's general consumer protection law. It is not a privacy statute, but it is the Attorney General's main tool in privacy cases, because it reaches false, misleading, or deceptive acts in trade and commerce (§17.46(a)). Its list of deceptive acts includes representing that goods or services have characteristics or benefits they do not have and failing to disclose information to induce a transaction (§17.46(b)(5), (b)(24)). A privacy notice, an encryption promise, or a data practice a company does not disclose can fall within those terms.

The Attorney General uses the DTPA in three ways:

  • Investigation. The Consumer Protection Division may serve a civil investigative demand requiring a person to produce documentary material relevant to a possible violation. The recipient may petition a district court to extend the return date or to modify or set aside the demand, but must do so before the return date or within 20 days after service, whichever period is shorter (§17.61(g)). In OAG v. PFLAG, Inc., decided March 13, 2026, the Texas Supreme Court treated the demand as closely analogous to civil discovery: the Attorney General needs only a reasonable belief that the recipient may have relevant material, while the demand remains subject to the usual discovery objections, including privilege and burden, constitutional limits, and judicial tailoring of the categories to be produced.
  • Lawsuits. The Division may seek injunctions, civil penalties of up to $10,000 per violation plus up to $250,000 more if the conduct targeted consumers 65 or older, and restitution (§17.47).
  • Privacy statutes. Several Texas data laws make their violations DTPA violations, including the data broker law's security-program duty (§510.009), the identity theft prohibition in chapter 521 (§521.152), the SCOPE Act, whose violations are actionable under the DTPA solely as an enforcement action by the Consumer Protection Division of the Attorney General's office (§509.151), and the App Store Accountability Act (§121.101). Section 509.152 separately allows the parent or guardian of a known minor affected by a SCOPE Act violation to seek a declaratory judgment or an injunction against the digital service provider, but not a class action.

For ordinary private claims, the plaintiff generally must qualify as a consumer: an individual, partnership, corporation, the state, or a state subdivision or agency seeking or acquiring goods or services by purchase or lease. A business consumer is excluded if it has assets of $25 million or more or is owned or controlled by an entity with assets of $25 million or more (§17.45(4)). Other statutory exemptions and claim-specific rules also apply. A consumer may maintain an action where a listed deceptive act, relied on by the consumer, was a producing cause of economic damages or mental anguish (§17.50(a)). If the conduct was knowing, the consumer may recover mental anguish damages and up to three times economic damages; if it was intentional, up to three times mental anguish and economic damages; a prevailing consumer also recovers court costs and reasonable attorney's fees (§17.50(b), (d)). A consumer seeking damages ordinarily must provide 60 days' written pre-suit notice, subject to §17.505(b)'s counterclaim and limitations-related exceptions. Section 17.565 generally measures the two-year period from the act or its discovery, including when reasonable diligence should have led to discovery; it provides a limited 180-day extension for specified conduct inducing delay. The Texas Data Privacy and Security Act, by contrast, gives consumers no private right of action.

The Attorney General has relied on the DTPA in its largest privacy matters, including the $1.375 billion Google settlement and the suits over driving data, smart TV viewing data, and children's platforms tracked on this site.

Pinpoint: Tex. Bus. & Com. Code ch. 17, subch. E.

Related