Texas Privacy Policy
Texas has a comprehensive privacy law, the Texas Data Privacy and Security Act, in force since July 1, 2024. Its reach is unusual: it has no revenue or data-volume threshold, only a carve-out for small businesses as the U.S. Small Business Administration defines them. Texas also regulates biometric identifiers under a separate statute with civil penalties of up to $25,000 per violation.
What Texas law does to this document
Who the Act covers
The Act applies to a person that conducts business in Texas or produces a product or service consumed by Texas residents, and that processes or sells personal data. A small business as defined by the U.S. Small Business Administration is outside most of the Act. Even so, a small business may not sell sensitive personal data without the consumer's prior consent. Nonprofits, state agencies and financial institutions subject to the Gramm-Leach-Bliley Act are among the entities exempt.
Tex. Bus. & Com. Code §§ 541.002, 541.107What the privacy notice must contain
A controller must give consumers a reasonably accessible and clear privacy notice. It must list the categories of personal data processed, the purposes of processing, and the categories of data shared with third parties and of the third parties themselves. It must also explain how consumers exercise their rights and how to appeal a refusal. A controller that sells sensitive data must post this exact sentence with the notice: "NOTICE: We may sell your sensitive personal data." A parallel sentence is required for the sale of biometric data.
Tex. Bus. & Com. Code § 541.102Consumer rights and response deadlines
Texas consumers may access, correct and delete their personal data. They may obtain a portable copy of data they provided and may opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. A controller must respond within 45 days, with one 45-day extension when reasonably necessary, and must decide an appeal within 60 days. Processing sensitive data requires the consumer's consent.
Tex. Bus. & Com. Code §§ 541.051, 541.052, 541.053, 541.101(b)(4)Request methods and browser opt-out signals
A controller must offer two or more secure and reliable methods for submitting requests and may not require a consumer to create a new account. Since January 1, 2025, a consumer may opt out of targeted advertising and sales through an authorized agent. The agent can be a technology such as a browser setting or a global device setting. The controller must honor such a request when it can verify the consumer and the agent's authority with commercially reasonable effort.
Tex. Bus. & Com. Code § 541.055Enforcement
The attorney general has exclusive authority to enforce the Act, and there is no private right of action. Before suing, the attorney general must give written notice and 30 days to cure. A person who fails to cure, or who breaches a written cure statement, is liable for a civil penalty of up to $7,500 for each violation.
Tex. Bus. & Com. Code §§ 541.151, 541.154, 541.155, 541.156Biometric identifiers
A separate statute bars capturing a biometric identifier for a commercial purpose unless the person is informed first and consents. The term covers a retina or iris scan, a fingerprint or voiceprint, and a record of hand or face geometry. The identifier must be destroyed within a reasonable time, and no later than the first anniversary of the date the purpose for collecting it expires. The civil penalty is up to $25,000 per violation, recoverable by the attorney general. The statute was amended effective January 1, 2026 to address artificial intelligence systems.
Tex. Bus. & Com. Code § 503.001Where people go wrong in Texas
- Assuming an out-of-state or small company is outside Texas law, when the Act reaches products consumed by Texas residents and bars even small businesses from selling sensitive data without consent.
- Selling sensitive or biometric data under the generator's policy as drafted: it does not include the sentences Tex. Bus. & Com. Code § 541.102(b) and (c) prescribe, "NOTICE: We may sell your sensitive personal data." and "NOTICE: We may sell your biometric personal data.", so a controller that sells such data has to add the one that applies.
- Offering a single request channel or no appeal process, when the Act requires at least two request methods and an appeal.
How the generator works
A single privacy policy that covers the ~20-state U.S. privacy patchwork, adds CCPA/CPRA specifics, and can extend to EU/UK visitors. Answer a short interview and the draft assembles as you go, with Texas already set as the governing state. Download it as PDF or Word. No fee. No account.