Overview
The Texas Data Privacy and Security Act (TDPSA) is a comprehensive data privacy law that strengthens consumer data protections while setting clear compliance requirements for businesses operating in Texas. Signed into law on June 18, 2023, TDPSA took effect on July 1, 2024, making Texas the second-largest U.S. state (after California) to enact a broad consumer privacy law.
TDPSA introduces strong consumer rights, limits data sales, and mandates security measures, though it remains more business-friendly than California’s CPRA.
Who Must Comply?
TDPSA applies to businesses that operate in Texas or target Texas consumers, with no revenue threshold. Unlike other state laws, Texas uses a broad business applicability test:
✔ Applies to businesses that process or sell personal data of Texas residents
✔ Covers companies that produce goods or services consumed by Texas residents
Exemptions:
The law does not apply to:
🚫 Small businesses (as defined by the U.S. Small Business Administration)
🚫 Government agencies
🚫 Nonprofits
🚫 Financial institutions subject to GLBA
🚫 HIPAA-covered entities
Key Consumer Rights Under TDPSA
✔ Right to Access – Consumers can request a copy of their personal data.
✔ Right to Correct – Consumers can request corrections to inaccurate personal data.
✔ Right to Delete – Consumers can request the deletion of personal data.
✔ Right to Data Portability – Consumers can receive their data in a portable format.
✔ Right to Opt-Out – Consumers can opt out of:
- Targeted advertising
- Sale of personal data
- Automated profiling that affects legal or financial decisions
Business Compliance Requirements
✔ Universal Opt-Out Mechanism (Starting January 1, 2025) – Businesses must recognize Global Privacy Control (GPC) signals.
✔ Opt-In Consent for Sensitive Data – Businesses must obtain explicit consent before processing:
📌 Racial/ethnic origin
📌 Religious beliefs
📌 Biometric data
📌 Health conditions
📌 Children’s data
✔ Privacy Policy & Transparency – Companies must publish clear privacy policies detailing data collection and use.
✔ Data Security Standards – Businesses must implement reasonable security measures to protect personal data.
✔ Data Protection Assessments (DPA) – Businesses must assess high-risk processing activities, such as:
📌 Targeted advertising
📌 Data sales
📌 AI-driven decision-making
Real-World Enforcement Cases
The Texas Attorney General is responsible for enforcing TDPSA, with penalties of up to $7,500 per violation.
Since the law took effect in July 2024, major enforcement cases are expected in 2025, likely targeting ad tech firms, data brokers, and companies that fail to honor consumer opt-out requests.
📌 Comparison with Other State Privacy Laws
The Texas TDPSA is more business-friendly than California’s CPRA but stronger than Virginia’s CDPA due to:
✅ Stronger Consumer Opt-Out Rights – Universal opt-out required by 2025.
✅ No Revenue Threshold for Businesses – Applies to all large-scale data processors.
✅ Longer Compliance Grace Period – Businesses have until 2025 to fully comply.
Future of TDPSA Regulation
📌 Expanded enforcement for AI-driven profiling and automated decision-making.
📌 Stronger penalties for non-compliance starting in 2025.
📌 Potential updates to align with federal privacy laws if passed.
Texas’s TDPSA is one of the strongest consumer privacy laws in the U.S. while still accommodating businesses with flexible compliance timelines and clear opt-out mechanisms.
