Precise Geolocation Data (Texas Data Privacy and Security Act)

Precise geolocation data is sensitive data in Texas. That single classification does more compliance damage to app-based businesses than any other provision of Chapter 541, because it turns a routine product feature into processing that requires consent before it happens.

The 1,750-foot line

Section 541.001 defines precise geolocation data as information derived from technology, including global positioning system level latitude and longitude coordinates, that directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet. The definition excludes the content of communications and data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.

Roughly a third of a mile. Standard mobile location APIs return coordinates far more precise than that. So do Bluetooth beacon proximity, most Wi-Fi triangulation, and any vehicle telematics feed. Coarse IP-based city-level geolocation generally does not, though that is a factual question rather than an automatic answer, and a coarse signal combined with other data can land inside the radius.

Consent, not notice

Because precise geolocation data falls within sensitive data under § 541.001, § 541.101(b)(4) forbids processing it without the consumer's consent. Consent carries its own statutory definition: a clear affirmative act signifying freely given, specific, informed and unambiguous agreement. An operating system permission prompt granting an app access to location is a step, but it is permission granted to the platform, not necessarily informed consent to the controller's stated processing purposes. The gap is widest where location collected to make a navigation or delivery feature work is later monetized.

Section 541.105 adds a documented data protection assessment for processing sensitive data, and the attorney general may reach that document through the investigative authority in § 541.153.

Where enforcement started

The attorney general's first TDPSA action, filed in January 2025 against Allstate and its data analytics affiliate Arity, was built on driving and location data gathered through mobile applications, including applications published by unrelated developers that had integrated the analytics software development kit. The pleaded theories tracked the statute closely: no adequate privacy notice describing the collection, no consent for processing precise geolocation data, no working opt-out for sale and targeted advertising, and no posting of the notice required by § 541.102(b) for the sale of sensitive personal data. The case is State of Texas v. Allstate Corp., Cause No. 25-01-00561, in the 457th Judicial District Court of Montgomery County. It has not been a straight line: in April 2025 the court granted special appearances and dismissed The Allstate Corporation and Arity 875, LLC for want of personal jurisdiction, and the action continues against the remaining entities.

Two lessons follow for any Texas business collecting location. The sensitive-data sale notice is a fixed string, "NOTICE: We may sell your sensitive personal data.", and it must appear in the same location and manner as the privacy notice. And while disclosure or transfer of personal data to an affiliate of the controller is excluded from the definition of sale under § 541.001, that exclusion protects the transfer and not what the affiliate then does. Routing collection through a sister entity does not launder a downstream sale.

If a product genuinely needs location, ask whether it needs this much. Truncating coordinates to a coarser grid at the point of collection, rather than storing full precision and restricting access later, can move the data outside the definition entirely and take the consent and assessment obligations with it.