The Texas Data Privacy and Security Act (TDPSA) applies to almost any business that sells or processes Texans' personal data, because it has no revenue or volume threshold: only small businesses as the US Small Business Administration defines them are outside it, and even they need consent to sell sensitive data. Websites must offer an opt-out of targeted advertising and sales, honour universal opt-out signals such as Global Privacy Control (GPC) since 1 January 2025, and get opt-in consent for sensitive data. The Attorney General enforces it, with a permanent 30-day cure period and fines of up to $7,500 per violation.
Why the TDPSA stands apart from other US state privacy laws
The TDPSA took effect on 1 July 2024. On paper, it follows the same opt-out model seen in Virginia, Colorado, and Connecticut. In practice, two features set it apart: an unusually broad scope of applicability and an Attorney General who has moved quickly to enforce it. Nebraska, whose law took effect on 1 January 2025, later followed the same no-threshold approach.
Most US state privacy statutes gate applicability on revenue or data-processing volume. The TDPSA does neither. If a business conducts operations in Texas or produces a product or service consumed by Texas residents and processes or sells personal data, the law applies.
That breadth matters. Texas has one of the largest populations in the US and a vast range of online commerce. A mid-size e-commerce shop with no physical presence in Texas can still fall within the TDPSA's reach if it ships to Texan customers and drops a _fbp or _ga cookie along the way.
Scope and applicability: no revenue threshold
Under laws like the CCPA, a business must meet at least one of several thresholds: annual revenue above $26,625,000 (the figure set from 1 January 2025), buying, selling or sharing data of 100,000 or more consumers or households, or deriving 50% of revenue from selling or sharing personal information. The TDPSA drops all of these.
The only meaningful carve-out is for small businesses as defined by the US Small Business Administration. Even that exemption has a catch: if a small business sells sensitive data, it must still obtain opt-in consent from the consumer before doing so.
State agencies and political subdivisions in Texas are excluded. So are nonprofits, institutions of higher education, electric utilities, financial institutions and data subject to the Gramm-Leach-Bliley Act, and HIPAA covered entities and business associates. Unlike California, which exempts only the data, Texas exempts those financial and health organisations as a whole.
Who counts as a consumer under the TDPSA
A consumer is a Texas resident acting in an individual or household context. The law does not cover individuals acting in a commercial or employment context. Job applicants, employees, and business-to-business contacts fall outside its scope, much like the exemptions found in other state privacy frameworks.
Consumer rights and opt-out obligations
The TDPSA grants Texas consumers five core rights over their personal data.
| Right | Description | Deadline to respond |
|---|---|---|
| Access | Confirm whether data is being processed and obtain a copy | 45 days |
| Correction | Request correction of inaccurate personal data | 45 days |
| Deletion | Request deletion of personal data provided by the consumer | 45 days |
| Portability | Obtain data in a portable, readily usable format | 45 days |
| Opt-out | Opt out of sale, targeted advertising, or significant profiling | 45 days |
A controller can extend the 45 days once by another 45 days where reasonably necessary, if it tells the consumer within the first period. The opt-out right is where cookie consent becomes directly relevant. If your site uses tracking cookies for targeted advertising or sells data derived from them, you must provide a clear mechanism for Texan visitors to refuse that processing.
Universal opt-out mechanisms and GPC
From 1 January 2025, businesses subject to the TDPSA must recognise universal opt-out signals such as Global Privacy Control (GPC). Section 541.055(e) lets a consumer opt out through a browser setting, an extension or a global device setting, and section 7 of HB 4, the bill that created the act, set that subsection's start date at 1 January 2025. A visitor arriving with the Sec-GPC: 1 header should be treated as having opted out of the sale of personal data and targeted advertising.
The statute adds conditions: the signal must not be a default setting, it must reflect the consumer's own affirmative choice, and the controller must be able to verify with commercially reasonable effort that the consumer lives in Texas. If your cookie management platform does not detect and honour GPC signals, you have a gap Texas law can reach.
Sensitive data needs opt-in consent
While the TDPSA uses an opt-out model for most personal data, it switches to opt-in consent for sensitive categories. Sensitive data under the TDPSA includes:
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Sexuality, or citizenship or immigration status
- Genetic or biometric data processed to identify someone
- Precise geolocation (within 1,750 feet)
- Personal data of a known child (under 13)
Consent must be a "clear affirmative act" that is freely given, specific, informed, and unambiguous. The law explicitly excludes consent obtained through dark patterns or buried within broad terms of service.
This definition closely mirrors the GDPR standard. Pre-ticked boxes, implied consent through continued browsing, or bundled consent toggles will not satisfy it.
What counts as a sale under Texas law
A sale under the TDPSA is the sharing, disclosing or transferring of personal data by a controller to a third party for monetary or other valuable consideration. "Other valuable consideration" is what pulls many ad tags in: a pixel that sends visitor data to an ad platform in return for targeting or measurement can be a sale even when no money changes hands. Targeted advertising is a separate opt-out right, so a tag can trigger the opt-out duty under either heading.
Some disclosures are not sales: data passed to a processor acting on your behalf, data shared to provide a product or service the consumer asked for, transfers to an affiliate, information the consumer made public without restriction, and transfers in a merger or acquisition.
To check your own site, list every third-party script that receives data from your pages, then sort them into processors under a contract (hosting, payment, analytics configured only for you) and third parties that can use the data for their own purposes (ad networks, social pixels, data brokers). The second group is where the opt-out has to work. Other states define a sale in similar terms, though not identically.
The Attorney General enforces it, and moved early
The Texas Attorney General holds exclusive enforcement authority over the TDPSA. There is no private right of action. Unlike the CCPA, consumers cannot sue businesses directly for violations.
That single-enforcer model has not slowed things down. On 13 January 2025, the Texas AG sued the Allstate Corporation and its subsidiary Arity, describing it as the first enforcement action filed by a state Attorney General under a comprehensive data privacy law. The AG alleged that Allstate paid app developers to embed software that collected the location and movement data of Texans' phones, used it to justify higher insurance premiums and sold it, without the notice and consent the TDPSA requires for sensitive data such as precise geolocation.
Each violation after the cure period can cost up to 7,500 USD under section 541.155, and the Attorney General can also seek an injunction and its legal costs.
The 30-day cure period is permanent
Before filing an enforcement action, the AG must send a written notice of the alleged violation at least 30 days in advance (section 541.154). If the business cures the violation within that time and sends a written statement that it fixed the problem, told the affected consumer where possible, provided supporting documents and changed its policies, the AG may not sue.
Unlike the cure periods in Colorado and several other states, this one has no end date in the statute. Virginia's 30-day cure in section 59.1-584 of its code works the same way. It does not make the law toothless: a business that breaks its written statement, or repeats the violation after the cure period, faces the full penalty.
Other privacy cases
The AG's office has been active on privacy beyond the TDPSA. In May 2026, it announced a settlement with LG Electronics under which LG's smart TVs stop collecting viewing data through automated content recognition without informed consent. As of October 2026, the Allstate case remains the TDPSA's headline action.
TDPSA compared with other state privacy laws
The table below highlights how the TDPSA differs from peer statutes on key compliance points.
| Feature | TDPSA (Texas) | CCPA (California) | VCDPA (Virginia) |
|---|---|---|---|
| Revenue threshold | None | 26,625,000 USD | None (volume-based) |
| Data volume threshold | None | 100,000 consumers or households | 100,000 consumers or 25,000 with 50% revenue from sale |
| Small business exemption | Yes (SBA definition), except for sensitive data sales | No general SMB exemption | No general SMB exemption |
| Private right of action | No | Yes (data breaches only) | No |
| Cure period | 30 days, no end date | No right to cure | 30 days, no end date |
| GPC/universal opt-out | Required from 1 Jan 2025 | Required | Not mandated |
| Sensitive data consent | Opt-in | Opt-out with right to limit | Opt-in |
What this means for your website
If your website sets cookies that enable targeted advertising, tracks visitors with tools like Google Analytics 4 or the Meta Pixel, or sells personal data to third parties, the TDPSA applies to you whenever a Texas resident visits.
Practical steps to reduce enforcement risk:
- Run a cookie scan to identify every cookie and tracking script on your site, including those injected by third-party tags.
- Check that your cookie banner provides a genuine opt-out for sale and targeted advertising - not a link that redirects visitors elsewhere.
- Detect and honour the GPC signal. If a visitor's browser sends
Sec-GPC: 1, suppress targeted advertising and data sale cookies automatically. - Collect opt-in consent before processing any sensitive data categories, including precise geolocation.
- Publish a clear privacy notice that discloses what personal data you process, the purposes, and how consumers can exercise their rights.
- Respond to consumer rights requests, opt-outs included, within 45 days.
The Allstate complaint underscores a specific risk: sensitive data, such as precise location, collected and passed on without notice and consent.
Short answers on the Texas privacy law
Does the TDPSA apply to businesses outside Texas?
Yes. The law applies to any entity that conducts business in Texas or produces a product or service consumed by Texas residents, provided it processes or sells personal data and is not a small business as the SBA defines it. Physical presence in the state is not required.
Is there a revenue threshold for the TDPSA?
No. Unlike the CCPA, the TDPSA does not set a minimum annual revenue. The only general size exemption is for small businesses as defined by the US Small Business Administration, and even they must obtain consent before selling sensitive data.
Do I need a cookie banner for Texas visitors?
If your site uses cookies for targeted advertising, profiling, or selling personal data, you must offer Texas visitors a way to opt out. A cookie banner with a clear opt-out choice is the most practical way to provide it.
Does the TDPSA require opt-in consent for cookies?
Only when cookies process sensitive data, such as precise geolocation or health information. For standard analytics and advertising cookies, the model is opt-out. The opt-out mechanism must genuinely stop the tracking, not merely log a preference.
What are the penalties for TDPSA violations?
The Texas Attorney General can seek civil penalties of up to 7,500 USD per violation, an injunction, and its attorney fees and investigation costs. Before suing, it must give 30 days' written notice, and a business that cures the violation in that time cannot be sued for it.
Does the TDPSA require recognising Global Privacy Control?
Yes. Since 1 January 2025, a consumer can opt out through a browser setting or extension such as GPC, and businesses must honour it as an opt-out of the sale of personal data and targeted advertising. The signal must reflect the consumer's own choice rather than a default setting.
Check what your site sells before a Texas visitor opts out
If you are not sure which cookies your site sets or whether your opt-out actually stops tracking scripts, start with a scan. Kukie.io detects and categorises the cookies on your site, can show an opt-out choice in the regions you set, and can treat a GPC signal as an automatic opt-out. The overview of global privacy laws covers the other states and countries your visitors may come from.
