Texas Data Privacy and Security Act

The Texas Data Privacy and Security Act (TDPSA) was enacted as House Bill 4 in the 88th Regular Session of the Texas Legislature and took effect on July 1, 2024. It is codified at Texas Business and Commerce Code Chapter 541. The statute is the seventh state consumer privacy law in the United States and the second largest by state population after California. Texas Attorney General Ken Paxton has exclusive enforcement authority under Section 541.155 and has stood up a dedicated Data Privacy and Security Initiative inside the Consumer Protection Division. The statute is unusual because it does not use a numeric threshold based on revenue or consumer count to define who is covered. Under Section 541.002, the TDPSA applies to a person who conducts business in Texas or produces a product or service consumed by Texas residents, processes or engages in the sale of personal data, and is not a small business as defined by the United States Small Business Administration. That structure pulls in vendors, processors, and out-of-state companies that touch Texas resident data, even when the company has no physical presence in Texas. The small business carve-out is narrow because Section 541.107 still requires those entities to obtain consent before selling sensitive data. The consumer rights model tracks the Virginia Consumer Data Protection Act. Texas residents have rights to confirm, access, correct, delete, obtain a portable copy, and opt out of sale, targeted advertising, and profiling for decisions that produce legal or similarly significant effects. Texas added a notable wrinkle in Section 541.052: any controller that sells sensitive personal data must post a specific consumer notice that says, in those words, 'NOTICE: We may sell your sensitive personal data.' Controllers selling biometric data must post a parallel notice. Sensitive data under Section 541.001 includes racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data processed to uniquely identify a person, precise geolocation, and data of a known child. Processing any sensitive category requires opt-in consent. The statute also requires data protection assessments under Section 541.105 for targeted advertising, sale of personal data, profiling that creates a heightened risk of harm, and any processing of sensitive data. Violations carry civil penalties up to $7,500 per violation under Section 541.155. The Attorney General must provide a 30-day cure notice before filing suit, and the cure period has no sunset, unlike the Connecticut Data Privacy Act. Texas filed its first public TDPSA enforcement action in 2025 against Allstate's data broker subsidiary Arity for selling driver location data without disclosure. The case signals that Texas will read 'sale' and 'sensitive data' broadly. The TDPSA's no-threshold design changes the compliance posture for mid-market companies. A 50-person SaaS company that previously sat below the California and Virginia thresholds may still owe a privacy notice, consent flows, data subject request handling, vendor data processing agreements, and a data protection assessment program if it touches Texas customer data. That makes the TDPSA the practical floor for any company selling into the United States.