Enforcement and Litigation

This hub covers how Texas privacy law is enforced and how disputes are litigated. At its center is the Attorney General's data privacy and security enforcement program: civil investigative demands under Business and Commerce Code § 17.61, notices, cure provisions, penalties, and the practical response workflow for a company that receives an inquiry, including preservation, response workflow, and scope management. It tracks the major matters as the research describes them: the Meta biometric settlement, the Google settlement, the General Motors driving-data action, the Allstate and Arity action, the smart-TV proceedings, the children's-data and platform actions, and the Texas v. HHS matter, with complaints described as allegations and settlements described by their actual terms and admission provisions. It also explains the Deceptive Trade Practices Act as a parallel enforcement vehicle, mapping privacy notices, marketing claims, setup screens, encryption claims, and security promises to the actual data flows that support or undermine them. Tracking technologies get their own treatment: pixels, SDKs, session replay, automated content recognition, website interception theories, Penal Code § 16.02, and the 2026 Texas developments on tracking demand letters and personalized pricing. Finally, the hub addresses privacy litigation mechanics: standing and injury, class certification, arbitration and mass arbitration, and privilege in incident investigations, with ordinary business records distinguished from privileged communications and work product.

Key questions

• How can a privacy or encryption promise create litigation risk
• What does an Attorney General investigation require a company to preserve
• How does the Deceptive Trade Practices Act apply to privacy representations
• When does website tracking create Texas liability
• Which statutes carry a private right of action, and which are Attorney General only

Controlling authorities

Business and Commerce Code chapter 17 (DTPA), including § 17.61 (civil investigative demands); Business and Commerce Code chapter 541 (TDPSA enforcement, cure, penalties); Penal Code § 16.02 (interception); class-action procedure under Tex. R. Civ. P. 42 and federal Rule 23 (pinpoints are a research lead for drafting).

Guides in this hub

• LG06: Attorney General Enforcement and Investigations
  How the Texas Attorney General investigates and enforces data laws, how to respond to a CID, and what the enforcement record shows.
• LG07: Privacy Representations and the DTPA
  When a privacy promise becomes a DTPA case: how Texas maps representations to data flows and what remedies follow.
• LG08: Tracking Technologies Advertising and Personalized Pricing
  Which tracking technologies reach Texas liability, how interception theories work, and what personalized pricing faces.
• LG09: Privacy Litigation Standing Class Actions and Arbitration
  How privacy cases survive standing, certification, and arbitration in Texas courts, and which statutes carry a private action.
• LG10: Privilege in Incident Investigations
  How to structure an incident investigation so privilege claims hold up: counsel direction, vendors, work product, and holds.

Planned insights

• I04 What the Texas Google Settlement Actually Resolved (claims, agreed obligations, disposition, and limits of what a settlement establishes)
• I07 SCOPE and App Stores Have Different Litigation Histories (provision-level statutory and court status, where the litigation posture overlaps platform enforcement); candidates from the bank: privacy representations and current AG platform cases; smart-TV consent and ACR; the website-tracking alert and SB 690 with operative terms described only to the extent supported; privilege and actual primary-source incident decisions.

Tracker records

• K25 Texas AG Meta biometric settlement
• K26 Texas AG Google privacy settlement
• K27 Texas AG Allstate and Arity driving-data action
• K28 Texas AG General Motors driving-data action
• K29 Texas AG smart-TV data actions
• K30 Texas AG children's-data and platform actions
• K31 FTC Act Section 5 privacy and security enforcement
• RK021 Meta biometric (CUBI and DTPA) settlement
• RK022 Google settlement
• RK023 General Motors and OnStar
• RK024 Allstate and Arity
• RK025 TikTok
• RK026 Texas AG December 2024 platform investigations
• RK029 DeepSeek privacy investigation
• RK031 through RK035 Texas AG smart-TV proceedings (Sony, Samsung, LG, Hisense, TCL, kept as distinct records)
• RK037 Shein
• RK038 Netflix
• RK039 Meta and WhatsApp
• RK040 Discord
• RK041 Roblox
• RK047 consumer alert on CIPA website-tracking demand letters (September 17, 2026)
• RK048 Texas v. HHS dismissal and docket
• RK050 the Attorney General's data privacy and security enforcement team (announced June 2024)
• RK051 FTC Act Section 5 (15 U.S.C. § 45), including the final General Motors and OnStar order
• RK062 FTC proposed policy statement on personalized pricing.

Companion links

• https://texasailaw.com/guides/privilege-and-ai-tools/`