Texas Data Law

Insight

Texas Privacy Developments Through October 2026

The principal enacted laws, court orders, and federal developments through October 2026.

Compliance · All industries · Event date: January to October 2026 · For general counsel, privacy leads, and business operators

Texas's 2025 enactments continued to affect compliance in 2026, and Texas data law moved through October. Laws passed in 2025 took effect, federal courts decided the immediate fate of the State's two children's statutes, and federal regulators reshaped the rules Texas businesses work under alongside state law. This account covers developments through October 2026.

Texas statutes that took hold

On January 1, 2026, the Texas Responsible Artificial Intelligence Governance Act (HB 149) took effect. Beyond its AI provisions, it amended the TDPSA to require processors to help controllers secure personal data processed by AI systems (§541.104(a)(2)) and amended CUBI on publicly available images and AI training. The same day, SB 1188's rule on electronic-health-record storage began to apply: the Act took effect September 1, 2025, but its transition provision applies §183.002 to storage on or after January 1, 2026, regardless of when the record was prepared.

The other 2025 privacy laws were already in force: the data broker amendments and the move to chapter 510, the Texas Genomic Act of 2025 (Health and Safety Code ch. 174), and the cybersecurity safe harbor (Bus. and Com. Code ch. 542), all effective September 1, 2025. In 2026 they became compliance work rather than news. The Genomic Act also requires an annual certification of compliance each December 31 (§174.008).

The courts sorted the children's laws

On July 24, 2026, in No. 24-50721, a divided Fifth Circuit panel kept the SCOPE Act's monitoring-and-filtering duty blocked under Section 230 but held that other challengers lacked standing, leaving most of the law enforceable. Separately, the Fifth Circuit stayed the district court's injunction of SB 2420, administratively on May 28 and pending appeal on June 4; in July the Supreme Court declined to vacate the stay. On August 4, 2026, the Fifth Circuit heard oral argument in the consolidated appeals, Nos. 25-51073 and 26-50001; no merits opinion appears in the sources reviewed as of October 13, 2026. The law may be enforced while the appeal is decided. The stay rulings are interim, not final judgments.

Federal developments affecting Texas businesses

DateDevelopment
January 13 to 14, 2026FTC issues (Jan. 13) and announces (Jan. 14) its final order against GM and OnStar over driving-data collection and sale
February 25, 2026FTC issues a conditional age-verification enforcement policy statement under COPPA; it does not amend the Rule and preserves enforcement discretion
April 21, 2026H.R. 8413, the SECURE Data Act, is introduced in Congress; it is introduced legislation, not enacted law
April 22, 2026Compliance deadline for the amended COPPA Rule
September 9, 2026FTC withdraws its 2021 policy statement on breaches by health apps and other connected devices, calling it obsolete after the 2024 Health Breach Notification Rule amendments; the rule itself remains in effect
September 17, 2026The Texas Attorney General issues a consumer alert about demand letters alleging website-tracking violations of California law
September 30, 2026California enacts SB 690, operative January 1, 2027, limiting specified pen-register civil actions against private actors to the Attorney General

Enforcement

The Attorney General's privacy docket, built in 2024 and 2025, remained active. The official Fifteenth Court of Appeals submitted-cases list identifies State of Texas v. Arity 875, LLC, Nos. 15-25-00082-CV and 15-25-00213-CV, submitted May 21, 2026. The filed Texas petitions state allegations; they do not establish liability. On October 31, 2025, the office announced that Google had signed a $1.375 billion settlement resolving its two Texas privacy actions. On September 17, 2026, it warned Texas businesses about CIPA demand letters.

Interim work and what's next

The House Committee on Delivery of Government Efficiency holds an interim charge to study the TDPSA's implementation and effectiveness (Charge 3, "Data Privacy and Security"), and its August 19, 2026 hearing took invited and public testimony on that charge. The 90th Legislature convenes January 12, 2027. The questions likely to recur are how far the children's laws reach, how AI and privacy statutes fit together, and whether Texas will answer federal preemption proposals.

Sources

Related