Texas Data Privacy and Security Act: cookie rules for Texas visitors

What is the Texas Data Privacy and Security Act?

The Texas Data Privacy and Security Act (TDPSA) was enacted as House Bill 4 in 2023 and added Chapter 541 to the Texas Business and Commerce Code. It took effect on 1 July 2024, except for the provision on opt-out signals, section 541.055(e), which took effect on 1 January 2025. Its rights and duties follow the Virginia model, but its scope is much wider, and Texas was the first state whose attorney general sued under a comprehensive privacy law. For the overall picture, see US state privacy laws.

Who does the TDPSA apply to?

Section 541.002 applies the Act to a person that:

• conducts business in Texas or produces a product or service consumed by Texas residents,
• processes or engages in the sale of personal data, and
• is not a small business as defined by the US Small Business Administration.

There is no minimum number of Texas consumers and no revenue threshold. The SBA definition depends on the industry and is usually based on annual receipts or the number of employees, so a mid-sized company with a modest Texas audience can be covered while it would fall below the 100,000-consumer threshold in Virginia or Colorado. Even an exempt small business may not sell sensitive data without the consumer's prior consent (section 541.107).

The Act exempts state agencies and political subdivisions, financial institutions governed by the Gramm-Leach-Bliley Act, entities governed by HIPAA, non-profit organizations and institutions of higher education, as well as data covered by laws such as FCRA and FERPA, and employment data.

What does the TDPSA require for cookies and trackers?

The Act regulates the use of personal data, which includes pseudonymous data such as cookie identifiers when it can reasonably be linked to a person. For a website the key points are:

• Opt-out of targeted advertising. Targeted advertising means showing ads selected on the basis of personal data obtained from a consumer's activities over time across non-affiliated websites or apps. Ad network cookies and retargeting pixels fall here.
• Opt-out of sale. A sale is the sharing, disclosing or transferring of personal data for monetary or other valuable consideration, so data passed to ad tech partners for a service or a share of revenue can count.
• Opt-out of profiling that leads to decisions about financial or lending services, housing, insurance, health care, education, employment, criminal justice or access to basic necessities.
• Consent for sensitive data: data revealing racial or ethnic origin, religious beliefs, mental or physical health, sexuality, citizenship or immigration status, genetic or biometric data used to identify a person, the personal data of a known child under 13, and precise geolocation data. Consent must be freely given, informed and unambiguous, and does not include acceptance of broad terms, hovering over, pausing or closing content, or agreement obtained through dark patterns.

The privacy notice. It must list the categories of personal data processed, including sensitive data, the purposes, the categories shared with third parties and the categories of those third parties, and how to exercise and appeal rights. A controller that sells personal data or uses it for targeted advertising must clearly and conspicuously disclose that and how to opt out. Texas also prescribes two notices word for word: a controller that sells sensitive personal data must post "NOTICE: We may sell your sensitive personal data.", and one that sells biometric data "NOTICE: We may sell your biometric personal data."

Requests. Controllers need at least two methods for consumers to submit requests; a business that operates only online and has a direct relationship with the consumer may offer just an email address. Responses are due within 45 days, extendable once by 45 days. Data protection assessments are required for targeted advertising, sales, certain profiling and sensitive data.

Must I honor Global Privacy Control in Texas?

Yes, in most cases. Texas frames the rule as an authorized agent provision: since 1 January 2025 a consumer may designate an agent to opt out of targeted advertising and sales using a technology such as a link to a website, a browser setting or extension, or a global setting on a device. The technology must require an affirmative, freely given choice rather than a default. A controller must comply with such a request unless it is not clear and unambiguous, the controller cannot verify with commercially reasonable effort that the consumer lives in Texas, the controller cannot process it, or the controller does not process similar requests it receives under other states' laws. A business that already honors GPC for Colorado, Connecticut or California visitors therefore cannot rely on the last exception. The Global Privacy Control guide shows how to read the signal.

Enforcement and penalties

The Attorney General has exclusive authority. Before suing, the office must send a written notice identifying the violations; the business has 30 days to cure them and must send a written statement that it cured the violation, notified the consumer where possible, documented the fix and changed internal policies if needed. This cure period has no expiry date. A business that does not cure, or breaches its statement, faces civil penalties of up to $7,500 per violation, injunctions, and the state's attorney's fees and costs. There is no private right of action.

On 13 January 2025 the Attorney General sued Allstate and its subsidiary Arity, alleging that software secretly embedded in mobile apps such as Life360 collected the location and movement data of Texans, part of a database covering over 45 million consumers nationwide, and that the companies sold it to insurers without the notice and consent the TDPSA requires for precise geolocation, which is sensitive data. The office described it as the first enforcement action filed by a state attorney general under a comprehensive data privacy law.

How Cookiequiet handles Texas

Because Texas has no visitor threshold, many sites with Texan customers are covered. With geo-targeting, free on every plan, Cookiequiet can show Texas visitors an opt-out notice with a "Do not sell or share my personal information" link, while visitors from the EEA or the UK see the opt-in banner, and it honors Global Privacy Control as an opt-out. Run the free cookie scanner to see which advertising tags would be affected. The policy templates do not add Texas's sensitive data notice, so add it yourself if you sell such data.