The Texas privacy law: what online businesses must do

The Texas Data Privacy and Security Act gives consumers rights over their data and puts duties on companies that collect it.

Texas has had its own consumer privacy law since July 2024. It reaches many companies that have never thought of themselves as data businesses.

Who it covers

Companies that do business in Texas or sell to Texas residents, and that process or sell personal data. Small businesses, as the federal Small Business Administration defines them, are largely exempt, though they still need consent before selling sensitive data.

What consumers can ask for

Confirmation of what data you hold and a copy of it
Correction of errors
Deletion
An opt out from the sale of their data, from targeted advertising and from certain profiling

You generally have 45 days to respond, and you must offer a way to appeal a refusal.

What you must do

Publish a clear privacy notice. Collect only what you need. Get consent before processing sensitive data such as precise location, health details or data about children. Keep reasonable security. Carry out data protection assessments for higher risk uses.

Enforcement

Only the Texas Attorney General can enforce the law. There is a 30-day period to fix a violation after notice. Penalties can reach $7,500 per violation.

Where to start

Map what personal data you collect and who you share it with. Most gaps show up in that exercise.