Texas TDPSA
In force Texas · In force Jul 1, 2024 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Jan 1, 20251 year ago | Universal opt-out mechanism requirement applies | 21 months ago |
| Jul 1, 20242 years ago | TDPSA takes effect | 2.2 years ago |
Summaries for reference, not legal advice. Check the official text.
What it does
Comprehensive consumer privacy law with access, correction, deletion, portability and opt-out rights, opt-in consent for sensitive data, data protection assessments and a universal opt-out signal requirement. Scope turns on the SBA small-business definition instead of consumer-count thresholds, so it reaches most non-small businesses.
- Who it applies to
- Persons conducting business in Texas or producing products/services consumed by Texas residents that process or sell personal data and are not a small business as defined by the U.S. Small Business Administration (no consumer-count threshold). Small businesses may not sell sensitive data without consent. Exempts state agencies, GLBA financial institutions, HIPAA entities, nonprofits, higher education, utilities.
- Penalties
- Civil penalty up to $7,500 per violation, plus injunctive relief and AG fees/expenses. Mandatory 30-day notice-and-cure period before any action; it does not sunset. No private right of action.
- Enforced by
- Texas Attorney General (exclusive)
- Official name
- Texas Data Privacy and Security Act (HB 4, 2023)
- Citation
- Tex. Bus. & Com. Code ch. 541 (Acts 2023, 88th Leg., R.S., HB 4)
- Topics
- privacy
Research notes
The penalty ($7,500) and cure terms are from the enrolled statute. They were not re-read from the official statute site on Sept 22, 2026 because that site renders via JavaScript. No amendments to ch. 541 found through Sept 2026. The Texas AG has brought TDPSA enforcement actions (e.g. against Allstate/Arity, Jan 2025).
Related
Questions about Texas TDPSA
- What are the Texas TDPSA compliance deadlines?
- Jul 1, 2024: TDPSA takes effect. Jan 1, 2025: Universal opt-out mechanism requirement applies.
- When does Texas TDPSA take effect?
- Texas TDPSA took effect on Jul 1, 2024.
- Who does Texas TDPSA apply to?
- Persons conducting business in Texas or producing products/services consumed by Texas residents that process or sell personal data and are not a small business as defined by the U.S. Small Business Administration (no consumer-count threshold). Small businesses may not sell sensitive data without consent. Exempts state agencies, GLBA financial institutions, HIPAA entities, nonprofits, higher education, utilities.
- What are the penalties under Texas TDPSA?
- Civil penalty up to $7,500 per violation, plus injunctive relief and AG fees/expenses. Mandatory 30-day notice-and-cure period before any action; it does not sunset. No private right of action.