State Guide
Texas Privacy & Data Security Laws
Every statute below can apply to a business handling Texas residents' data, depending on your revenue, the number of Texas consumers you process, and what kind of data you collect. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Comprehensive Privacy Law · 1
No numeric revenue/consumer thresholds — applies to any entity doing business in Texas that processes or sells personal data, unless it qualifies as a small business under SBA size standards. Texas Bus. & Com. Code § 541.003 reportedly carries a broad nonprofit exemption, though sources disagree on its exact scope — worth confirming directly if you're a nonprofit operating in Texas.
Data Security & Breach Notification · 1
Requires notifying affected residents (and often the state AG/regulator) after a breach of unencrypted personal information such as SSNs, driver's license/state ID numbers, or financial account numbers. Applies regardless of company size whenever you hold covered personal information about a resident of this state.
Biometric Privacy · 1
Requires consent before capturing biometric identifiers for a commercial purpose. Enforced only by the Texas Attorney General (no private right of action), which lowers litigation risk relative to Illinois but the compliance duty is similar.
Genetic Privacy · 1
Regulates direct-to-consumer genetic testing companies and/or genetic data generally — typically requiring express consent before collecting, using, or disclosing genetic data, and consent (or destruction) requirements for biological samples. Establishes an individual property right in genetic data, distinct from Texas's separate 2025 foreign-adversary genomic-data-storage law.
Children & Minors Online Safety · 1
Shifts age-verification and parental-consent duties to app stores. Challenged by NetChoice/CCIA; a preliminary injunction was granted Dec 23, 2025 but stayed by the 5th Circuit Jun 4, 2026, and SCOTUS denied an emergency stay in early July 2026 — the law is currently enforceable pending the merits appeal. (Distinct from Texas's separate SCOPE Act, HB 18, whose content-moderation requirement remains partially enjoined while its parental-oversight and targeted-ad provisions are enforceable.)