Tracker record · Texas · Statute
Texas Data Privacy and Security Act
The Texas Data Privacy and Security Act is the state's comprehensive consumer privacy law. It applies to a person that conducts business in Texas or produces a product or service consumed by Texas residents, processes or engages in the sale of personal data, and is not a small business as defined by the United States Small Business Administration (sec. 541.002(a)); a small business otherwise outside the chapter may not sell sensitive personal data without prior consumer consent (sec. 541.107). Consumers may request confirmation and access, correction, deletion, and portability, and may opt out of processing for purposes of (1) the sale of personal data, (2) targeted advertising, or (3) profiling in furtherance of a decision producing a legal or similarly significant effect (sec. 541.051(b)(5)). The chapter imposes controller duties including privacy notices, data protection assessments, and reasonable data security. Enforcement rests with the Attorney General, with a right to cure and civil penalties; the Act creates no private cause of action. Operative amendments include the 2025 HB 149 amendments: section 3 amends the processor-assistance provision (section 541.104(a), including subsection (a)(2)) and section 2 amends the biometric-identifier provisions (section 503.001); neither rewrites the general controller duties or the assessment framework. The staged universal opt-out mechanism provisions remain operative.
Status
- Legal status
- In effect; amended by HB 149, effective January 1, 2026 (ยง541.104(a)(2))
- Allegation or finding
- Operative law
- Applicability
- Applies to a person that (1) conducts business in Texas or produces a product or service consumed by Texas residents, (2) processes or engages in the sale of personal data, and (3) is not a small business as defined by the U.S. Small Business Administration; a small business otherwise excluded may not sell sensitive personal data without prior consumer consent (secs. 541.002(a), 541.107). The chapter sets no general revenue threshold.
- Enforceability
- Binding on parties within scope
- Effective date
- Signed June 18, 2023; effective July 1, 2024
- Law checked through
- October 13, 2026
- Primary-source pinpoint
- ch. 541
- Primary source
- https://tcss.legis.texas.gov/resources/BC/htm/BC.541.htm
- Citation
- Bus. & Com. Code ch. 541 (HB 4, 2023)
- Source
- Tex. Bus. & Com. Code ch. 541; HB 149 enrolled act, Texas Legislature Online
Procedural events
- 2023-06-18: Signed as HB 4, 88th Legislature
- 2024-07-01: Act takes effect
- 2025-01-01: Universal opt-out mechanism recognition provisions operative
- 2025-06-22: HB 149, 89th Legislature (Texas Responsible Artificial Intelligence Governance Act) signed by the Governor; amends Business and Commerce Code Sec. 541.104(a) (processor duties) and Sec. 503.001 (biometric identifier provisions)
- 2026-01-01: HB 149 (89th Legislature) takes effect
Related guides
- Which Data Laws Apply to a Texas Organization
- Consumer Rights Requests and Opt-Out Signals
- Privacy Notices, Consent, and Loyalty Programs
- Attorney General Enforcement and Investigations
- Processors, Data Sharing, Vendor Contracts, and Diligence