Topic
Texas Privacy Statutes
This hub explains the Texas statutes that create the everyday privacy duties of a Texas organization, with the Texas Data Privacy and Security Act as the center of gravity. It maps who the Act reaches and who it leaves alone: the threshold structure with no general revenue floor, entity and data exemptions, the residual sensitive-data duties that still reach smaller businesses, and the boundaries around employees and business-to-business contexts. It then covers the duties themselves: consumer rights and the request workflow, controller responsibilities, data protection assessments, processor obligations under the HB 149 amendments, universal opt-out signals and their staged dates, consent rules for sensitive data and sales, privacy notices and dark-pattern prohibitions, loyalty programs and automatic renewals, and the enforcement architecture of Attorney General authority, cure provisions, and civil penalties, with no private cause of action under the Act. Alongside the Act, the hub covers the Texas data broker law in Business and Commerce Code chapter 510: registration, security duties, prohibited uses, and the 2025 amendments. Throughout, the hub distinguishes enacted duties from voluntary frameworks, contracts, and agency guidance, and treats federal, other-state, and international rules only where their nexus reaches a Texas organization.
Key questions
- Does the Texas privacy law apply to a business without a revenue threshold
- Which rights does the TDPSA give consumers
- When is sensitive-data consent required for a sale
- What does the data broker law require a Texas company to register and disclose
- Which privacy notices must a business publish, and how must it handle opt-out signals
Controlling authorities
Business and Commerce Code chapter 541 (TDPSA), including §§ 541.101 to 541.107 as cited in the house style; Business and Commerce Code chapter 510 (data brokers); HB 149 (TDPSA amendments, including § 541.104(a)(2)); HB 4 (88th Legislature, 2023) at first use.
Guides in this hub
- LG01: Which Data Laws Apply to a Texas Organization
Which of the many data laws that touch a Texas business actually reach yours, and in what order to read them. - LG02: TDPSA Duties and Data Protection Assessments
The Texas Data Privacy and Security Act in one reference: who is covered, what controllers and processors owe, and how it is enforced. - LG03: Consumer Rights Requests and Opt Out Signals
How a Texas organization receives, verifies, fulfills, and documents consumer rights requests and opt-out signals. - LG04: Privacy Notices Consent and Loyalty Programs
What Texas law requires privacy notices to say, how consent must be designed and evidenced, and how loyalty and renewal programs change the analysis. - LG05: Texas Data Brokers and Their Supply Chains
Who counts as a data broker in Texas, what chapter 510 requires, and how broker data flows through supply chains.
Planned insights
- I02 The Texas Data Broker Code Number Has Changed (redesignation, amendments, and the risk of linking a citation to the wrong chapter)
- I16 What a Governance Audit Must Be Able to Reconstruct (historical source, permissions, rule version, recipients, and evidence of the decision, applied to TDPSA program evidence).
Tracker records
- K01 Texas TDPSA and operative amendments
- K02 Texas universal opt-out provisions and their delayed effective date
- K03 Texas TDPSA assessment and processor provisions
- K07 Texas data-broker registration and registry
- K08 Texas broker restrictions and 2025 amendments
- K09 Texas broker information-security duties and remedies
- K17 Texas TDPSA changes made by HB 149
- RK001 Texas Data Privacy and Security Act (TDPSA)
- RK002 Texas Data Broker Law.