Texas is one of the largest states to pass comprehensive consumer privacy legislation. The Texas Data Privacy and Security Act (TDPSA) took effect on July 1, 2024, and in 2026 it gives Texans real leverage over how businesses collect, use, and sell their personal information. Here's what every Texas resident should know.
What Is the Texas Data Privacy and Security Act?
The TDPSA is the main state law governing consumer data in Texas. It applies to any company that does business in Texas, collects personal data from Texas residents, and isn't a small business under the federal Small Business Administration definition. That means it covers a huge portion of the companies you interact with every day, from national retailers to major tech platforms.
The law is enforced exclusively by the Texas Attorney General, who has been increasingly active about privacy violations. Businesses that ignore consumer requests or sell data without proper disclosures can face civil penalties of up to $7,500 per violation.
Your Rights as a Texas Consumer
Under the TDPSA, Texas residents have five core rights when it comes to their personal data:
- The right to know: You can ask any covered business whether it is processing your personal data.
- The right to access: You can request a copy of the personal data a business holds about you.
- The right to correct: You can request that inaccurate data be fixed.
- The right to delete: You can ask a business to delete your personal data.
- The right to opt out: You can opt out of the sale of your data, targeted advertising, and certain forms of profiling.
Businesses must respond to your request within 45 days. They can extend the deadline once by another 45 days if your request is unusually complex, but they have to tell you they're doing that.
Sensitive Data Requires Consent
The TDPSA goes further than most state privacy laws when it comes to sensitive data. Businesses must get your explicit opt-in consent before processing sensitive information like precise geolocation, biometrics, health data, racial or ethnic origin, religious beliefs, or data from children under 13.
Universal Opt-Out: A Game Changer
Since January 1, 2025, the TDPSA requires businesses to honor universal opt-out mechanisms like Global Privacy Control (GPC). That means you can install a single browser setting and automatically tell every website you visit that you don't consent to data sales or targeted ads. Firefox, Brave, and DuckDuckGo all support GPC natively, and you can add it to Chrome through an extension.
This is one of the most powerful tools in the law because it removes the friction of opting out one site at a time. Flip the switch once and every covered Texas business has to listen.
How to Exercise Your Rights
- Find the business's privacy notice. Every covered company must publish a reasonably accessible privacy notice that describes what data they collect, how to submit rights requests, and how to appeal a denial.
- Submit a verifiable request. The company will typically ask you to verify your identity before processing a deletion or access request. This is a safeguard against impersonators.
- Wait for a response. The business has 45 days to answer.
- Appeal if denied. If a business refuses your request, you have the right to appeal. If the appeal is also denied, you can file a complaint with the Texas Attorney General's Consumer Protection Division.
What the TDPSA Doesn't Cover
The law has a number of carve-outs you should know about. It doesn't apply to state or local government entities, financial institutions already covered by the Gramm-Leach-Bliley Act, health information regulated by HIPAA, or nonprofits. Employment and B2B data are also largely excluded.
Most importantly, the TDPSA has no private right of action. You can't personally sue a company that violates the law. Enforcement is entirely up to the Texas Attorney General, which is why exercising your rights and filing complaints is so important.
The TDPSA Doesn't Directly Regulate Data Brokers
Unlike California's Delete Act, Texas does not have a centralized data broker registry or a one-click delete system. Texas residents still have to opt out of each people-search site and broker individually, or use a removal service to do it for them.
Removing Your Data From Texas Data Brokers
The TDPSA gives you rights against companies that hold your data, but people-search sites like TruePeopleSearch, Spokeo, and Whitepages will still publish your home address, phone number, and relatives unless you opt out of each one individually. That list runs into the hundreds, and most brokers re-scrape public records constantly, so a one-time opt-out isn't enough.
PrivacyOn handles this process end-to-end for Texas residents. We send opt-out requests to over 100 brokers, monitor them continuously, and re-file when your information reappears. Combined with enforcing your TDPSA rights against major companies, it gives you comprehensive coverage across both public and private data ecosystems.
Staying Ahead of the Law
Texas privacy law is still evolving. The Attorney General has signaled that enforcement will ramp up through 2026, and additional rulemaking could expand consumer protections further. The best approach is to exercise your rights regularly, use universal opt-out tools, and keep your footprint on people-search sites as small as possible. The TDPSA gives Texans real power, but only if you use it.