Texas
Texas privacy law: what your website has to do
Texas covers businesses by size, not by a consumer count you can count on your own site. If you are not a small business under the federal Small Business Administration definition, and you process or sell personal data of Texans, the TDPSA likely applies.
At a glance
- Applies if
- You conduct business in Texas or supply products or services consumed by Texas residents, process or sell personal data, and are not a small business as defined by the U.S. Small Business Administration (§541.002(a)). There is no fixed consumer-count, revenue, or share-of-revenue threshold. Small businesses still need consent before selling sensitive data (§541.107).
- Opt-out signal
- Conditional. Technology-based authorized agents can submit sale and targeted-advertising opt-out requests, and you must process them, subject to listed exceptions such as an inability to process the request or not processing comparable requests under another state's law (§541.055(e)–(f)). The statute examined names no officially recognized signal list.
- Response deadline
- 45 calendar days, extendable by 45 additional days (§541.052(b)). An appeals process is required, with a decision not later than the 60th day after an appeal is received (§541.053).
- Right to cure
- Permanent statutory right to cure: the Attorney General must give notice not later than the 30th day before suing, and you have 30 days to cure, certify the cure in writing, notify affected consumers where possible, and make the necessary policy changes (§541.154).
- Max penalty
- Up to $7,500 per violation, enforced exclusively by the Attorney General (§§541.151, 541.155(a)).
- Consumer rights
- access · correction · deletion · portability · opt out of sale · opt out of targeted advertising · opt out of profiling with legal or similarly significant effects · opt-in consent for sensitive data
Texas Data Privacy and Security Act, Tex. Bus. & Com. Code §541.001 et seq. — in force July 1, 2024.
The size test is the trigger, not your traffic
Most state laws count consumers. Texas instead asks whether you are a small business under the federal Small Business Administration definition. That means a business with no obvious privacy program can be covered while assuming it is too small, and a business that is genuinely small still cannot sell sensitive data without consent (§541.107).
What a covered Texas website has to handle
Employment and commercial-context individuals are outside the definition of consumer (§541.001(7)), and financial institutions covered by GLBA have their own exemption (§541.002(b)(2)).
- A way for consumers to request access, correction, deletion, and portability (§541.051(b)).
- A way to opt out of sale, targeted advertising, and profiling that produces legal or similarly significant decisions (§541.051(b)).
- Opt-in consent before collecting sensitive data (§541.101(b)(4)).
- Conspicuous notices before selling sensitive or biometric data (§541.102(b)).
- Handling authorized-agent requests, with your exceptions documented (§541.055(e)–(f)).
Where Texas sites usually break
A dealership's online lead forms may sit inside a GLBA-exempt financing flow, while its retail and loyalty traffic does not (§§541.002(b)(2), 541.051). Applicant screening is generally outside consumer scope, but e-commerce ad pixels and lead sales trigger the advertising and sale opt-outs and the risk-assessment duty (§§541.001(7), 541.051(b)(5), 541.105).
Why a dated record matters
The cure right is the practical safety net, and it runs on evidence: you must certify that you cured and tell affected consumers where you can (§541.154). A dated monthly record of what was tested and what was found is what that certification is built on.
Primary sources
Everproof provides compliance software and operations support. It is not a law firm and does not provide legal advice. Using Everproof does not guarantee compliance or prevent fines.