Texas Data Privacy and Security Act (TDPSA) Reference Guide

The TDPSA generally applies when a person conducts business in Texas or produces a product or service consumed by Texas residents, processes or engages in the sale of personal data, and is not a small business as defined by the United States Small Business Administration. Tex. Bus. & Com. Code § 541.002(a)

That is a different threshold model from state laws built around annual revenue or a fixed number of consumers. Whether an organization qualifies as a small business under federal standards can depend on its industry and other facts. Applicability should be assessed with qualified privacy counsel.

The law’s definition of “consumer” covers a Texas resident acting in an individual or household context. It does not include an individual acting in a commercial or employment context. “Personal data” generally means information linked or reasonably linkable to an identified or identifiable individual, but excludes deidentified data and publicly available information. Tex. Bus. & Com. Code § 541.001(7), (19)

An SBA-defined small business is generally outside the chapter’s main scope, but it may not sell a consumer’s sensitive personal data without the consumer’s prior consent. That rule applies even though most other TDPSA controller duties do not apply to the small business. Tex. Bus. & Com. Code §§ 541.002(a), 541.107

The statute excludes specified entities, including state agencies and political subdivisions, certain financial institutions and data subject to the Gramm-Leach-Bliley Act, HIPAA covered entities and business associates, nonprofit organizations, institutions of higher education, and specified utilities. It separately exempts categories of health, research, employment, credit, and other regulated data. These exemptions are detailed and fact-specific. Tex. Bus. & Com. Code §§ 541.002(b), 541.003

The law connects consumer rights to operational duties. A privacy notice alone is not enough. Covered controllers need working request methods, data governance, processor terms, and technical controls that carry choices into the systems processing the data.

Websites can disclose or transfer personal data before anyone submits a form. Advertising pixels, analytics tools, session replay, attribution platforms, embedded media, chat tools, and hard-coded scripts can transmit identifiers, page activity, device information, URLs, referrers, form events, or location signals to other companies.

Under the TDPSA, “targeted advertising” generally involves selecting an advertisement using personal data obtained from a consumer’s activities over time and across nonaffiliated websites or online applications. The definition excludes first-party advertising, contextual advertising, ads requested by the consumer, and processing solely to measure or report advertising performance, reach, or frequency. Tex. Bus. & Com. Code § 541.001(31)

A “sale” generally means sharing, disclosing, or transferring personal data for monetary or other valuable consideration, subject to statutory exceptions. A network request is therefore not automatically a sale. The answer depends on what data moves, why it moves, what each party does with it, the consideration involved, and whether an exception applies. Tex. Bus. & Com. Code § 541.001(28)

The TDPSA does not categorically prohibit Google, Meta, analytics, or other third-party tools. It requires covered organizations to classify their actual processing correctly, make required disclosures, obtain consent where required, and provide working opt-outs where the law applies.

A banner can record “Reject” while a tag in Google Tag Manager still fires. A hard-coded pixel can bypass the consent platform. A vendor can set or update a cookie after the visitor opts out. A Global Privacy Control signal can reach the page but never reach a downstream advertising rule.

That is why a visual review of the banner is incomplete. The decisive technical evidence is what the browser sends after the choice is applied.

The TDPSA does not name Global Privacy Control. It requires a controller to comply with a consumer request received through qualifying technology that indicates the consumer’s intent to opt out of targeted advertising, sale, or qualifying profiling. The statute includes a link, browser setting or extension, or global device setting used by the consumer or an authorized agent, subject to identity, authorization, usability, and choice requirements. This provision has been in force since January 1, 2025. Tex. Bus. & Com. Code § 541.055(e); H.B. 4, § 6

GPC is one browser-level signal that may serve this function when the statutory conditions are satisfied. The implementation question is end to end: can the site receive the signal, translate it into the correct consent state, suppress or alter the affected processing, and preserve that result across pages and downstream systems?

The Texas Attorney General has exclusive authority to enforce the TDPSA. Before bringing an action, the Attorney General must notify the person of the alleged violation and allow 30 days to cure it. A cure requires written confirmation that the violation was corrected, the consumer was notified when applicable, supporting documentation was provided, and internal policy changes were made to prevent recurrence. The statute authorizes injunctive relief, reasonable attorney’s fees, and civil penalties of up to $7,500 per violation for an uncured violation or breach of the written cure statement. Tex. Bus. & Com. Code §§ 541.151, 541.154–.155

The chapter does not create a private right of action. That does not remove exposure under other applicable laws or legal theories. Tex. Bus. & Com. Code § 541.156

The legal and technical layers should inform each other, but they are not the same job. A website scan cannot decide statutory applicability. A privacy policy cannot prove that tracking controls work.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, rights-request procedures, sensitive-data obligations, and organizational governance should be handled by qualified privacy counsel.

This page is written from primary Texas sources. Material legal statements link to the controlling code section, enacted bill text, or an official Texas Attorney General publication. Secondary sources are not treated as authority for the law.

Prepared by Etalon Editorial Team. Last reviewed September 26, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records the technical tracking layer: consent state, browser privacy signals, cookies, scripts, tags, network requests, and observable post-choice behavior. Your legal and privacy team remains responsible for legal interpretation, applicability and exemptions, policies and disclosures, contracts, consumer-rights operations, sensitive-data obligations, data protection assessments, and organizational governance.