Texas Privacy Law (TDPSA): Compliance Guide
The Texas Data Privacy and Security Act, effective July 1, 2024, gave the second-largest state a law with real teeth: biometric data protections, health data restrictions, and a universal opt-out signal requirement in force since January 1, 2025. Coverage requires clearing two gates — a $25 million revenue floor plus a consumer-volume prong — and violations carry up to $7,500 each, enforced by a notably active Attorney General's office.
- Effective
- July 1, 2024
- GPC / universal opt-out
- Required since January 1, 2025
- Required link text
- “Your Privacy Choices”
Last reviewed July 19, 2026 · Texas Data Privacy and Security Act (TDPSA)
Applicability
Who must comply with the TDPSA
The Texas Data Privacy and Security Act applies to businesses that meet the following criteria:
- Conducts business in Texas, and:
- Has annual revenue above $25 million, and:
- Processes the personal data of 100,000 or more Texas consumers, or
- Derives 50% or more of revenue from the sale of personal data and processes the data of 25,000 or more Texas consumers
Consumer rights
What Texas consumers can demand
- Right to access personal data
- Right to correct inaccuracies
- Right to delete personal data
- Right to data portability
- Right to opt out of the sale of personal data, targeted advertising, and profiling in furtherance of decisions with legal effects
Opt-out mechanics
Texas opt-out & GPC requirements
Like every US state privacy law, the TDPSA uses an opt-out model: you do not need a GDPR-style cookie banner, but you must provide a clear and conspicuous opt-out link. The accepted text for Texas is “Your Privacy Choices”.
Global Privacy Control: Required since January 1, 2025
Texas requires covered businesses to honor browser-level opt-out signals such as Global Privacy Control. The requirement has been in force since January 1, 2025.
Enforcement
TDPSA penalties & enforcement
- Up to $7,500 per violation
- Enforced by the Texas Attorney General
Cure period: Our reference lists no specific cure period for Texas; violations carry up to $7,500 each, enforced by the Texas Attorney General.
State quirks
What makes Texas different
Texas stands out on substance rather than structure. Its thresholds look conventional — $25 million in revenue plus 100,000 consumers, or 25,000 with 50% of revenue from data sales — but the law adds biometric data protections and health data restrictions beyond the standard framework, and it made browser-level opt-out signals mandatory from January 1, 2025. For businesses handling health-adjacent or biometric data, Texas demands more than a footer link.
Biometric data protections
Additional protections for biometric data beyond the standard framework.
Health data restrictions
Restrictions on health-related personal data that reach beyond the baseline state model.
Universal opt-out from 2025
Browser-level opt-out signals must be honored since January 1, 2025.
Automation
How ConsentKit handles Texas
- ConsentKit's widget is served from Cloudflare's edge and receives the visitor's US state server-side, so Texas visitors are identified before any consent UI renders — no client-side geo-lookup delay.
- Texas visitors see a persistent “Your Privacy Choices” link — the exact statutory text — available to new and returning visitors alike.
- Because Texas requires universal opt-out signals, ConsentKit automatically honors Global Privacy Control for Texas visitors: when the browser broadcasts GPC, the widget applies the opt-out and denies analytics and marketing categories with no click required.
- Every opt-out is recorded server-side with a timestamp and jurisdiction metadata, reviewable and exportable (CSV) from the dashboard — the audit trail regulators ask for.
- Google Consent Mode v2 stays in sync: analytics and advertising tags update the moment a Texas visitor makes a choice.
Texas GPC honoring has been live in ConsentKit since before the January 1, 2025 deadline — the signal is detected and the opt-out recorded with no visitor click.
FAQ
Texas TDPSA FAQ
Does the TDPSA apply to my business?
It applies if you conduct business in Texas, have annual revenue above $25 million, and either process the personal data of 100,000 or more Texas consumers or derive 50% or more of revenue from data sales while processing 25,000 or more. Both the revenue gate and a volume prong must be met.
Is Global Privacy Control required in Texas?
Yes — since January 1, 2025, covered businesses must honor browser-level opt-out signals such as Global Privacy Control for Texas visitors.
What special data does Texas protect?
The TDPSA adds biometric data protections and health data restrictions beyond the standard state framework. Businesses handling health-adjacent or biometric information face duties that go well past a basic opt-out link.
What are the penalties under the TDPSA?
Up to $7,500 per violation, enforced by the Texas Attorney General. Our reference lists no specific cure period for Texas.
This guide is for informational purposes and is not legal advice. Work with qualified counsel to confirm your obligations under the TDPSA.
Comply with Texas's TDPSA — and the other 19 state laws
ConsentKit detects each visitor's state at the Cloudflare edge, renders the exact opt-out link their law requires, honors GPC automatically where mandated, and records every choice for your audit trail.