Texas Data Privacy and Security Act
Texas's comprehensive consumer data privacy law, effective July 1, 2024 (with universal opt-out provisions effective January 1, 2025). Imposes transparency, purpose-limitation, security, and consumer-rights obligations on controllers processing the personal data of Texas residents. Enforced exclusively by the Texas Attorney General; no private right of action.
The Texas Data Privacy and Security Act (TDPSA) is Texas's comprehensive consumer data privacy law. Signed by Governor Abbott on June 18, 2023, it took effect July 1, 2024, with universal opt-out (Global Privacy Control) provisions taking effect January 1, 2025. The TDPSA imposes transparency, purpose-limitation, security, and consumer-rights obligations on businesses that process the personal data of Texas residents.
Applicability
The TDPSA applies to any person who (1) conducts business in Texas or produces products or services consumed by Texas residents; (2) processes or engages in the sale of personal data; and (3) is not a small business as defined by the U.S. Small Business Administration. Notably, the TDPSA contains no revenue threshold and no minimum-consumer-count threshold, distinguishing it from California, Colorado, and most other state privacy laws. Small businesses are exempt from most obligations except the requirement to obtain consumer consent before selling sensitive data.
Controller obligations
A controller, the entity determining the purpose and means of processing personal data, must (1) limit personal data collection to what is reasonably necessary for the disclosed purpose; (2) provide a clear privacy notice describing categories of data, purposes, sharing practices, and consumer rights; (3) obtain explicit opt-in consent before processing sensitive data (precise geolocation, health, biometrics, race, religion, sexual orientation, immigration status, children's data); (4) honor consumer-rights requests within 45 days; and (5) maintain reasonable administrative, technical, and physical security measures.
Consumer rights
Texas residents acting in an individual or household context (excluding employment and commercial contexts) have rights to (1) know whether their data is being processed; (2) access the data; (3) correct inaccurate data; (4) delete data; (5) obtain a portable copy; and (6) opt out of (a) sale of personal data, (b) targeted advertising, and (c) profiling that produces legal or similarly significant effects. Since January 1, 2025, controllers must honor universal opt-out signals such as Global Privacy Control transmitted via the consumer's browser.
Enforcement
The Texas Attorney General has exclusive enforcement authority. The AG must provide written notice of a violation and a 30-day cure period before initiating an enforcement action. Civil penalties may reach $7,500 per violation; treble damages are available for willful violations. The TDPSA does not provide a private right of action, consumers cannot sue businesses directly under the statute. The Attorney General has been actively investigating major technology platforms for TDPSA compliance since enforcement began.
Texas businesses operating any consumer-facing website or app should treat TDPSA compliance as table stakes. Minimum compliance posture: (1) update the privacy notice to TDPSA standards; (2) implement a consumer-rights request intake process; (3) execute DPAs with all processors handling personal data; (4) deploy a Global Privacy Control honor mechanism on all customer-facing properties; (5) conduct data protection assessments for sensitive-data processing and targeted advertising; and (6) ensure incident-response procedures meet both TDPSA security obligations and Chapter 521 breach-notification requirements.
Companion article: Data Breach Response: The First 72 Hours