Key Facts
Overview
The TDPSA is the broadest US state privacy law in terms of applicability: it has no revenue thresholds and no minimum consumer data volume thresholds. Any non-small-business (as defined by the SBA) that processes personal data of Texas residents must comply, capturing far more businesses than any other state law.
What This Means for Your Website
- GPC signals must be honored since January 2025
- Opt-in consent is required for sensitive data
- No revenue or consumer volume thresholds, so nearly all businesses are subject
- Only SBA-defined small businesses are exempt (but cannot sell sensitive data)
- A permanent 30-day cure period applies before enforcement
- Consumer requests must be fulfilled within 45 days
Key Requirements
The Texas AG enforces the TDPSA with penalties up to $7,500 per violation. The law's breadth is unique: it applies to individuals as well as businesses, with only SBA-defined small businesses exempt. GPC/UOOM signal honoring has been mandatory since January 2025. Data protection assessments are required for high-risk processing.
How ConsentStack Handles This
ConsentStack detects Texas visitors, honors GPC signals automatically, and applies the TDPSA's opt-out model with opt-in for sensitive data, ensuring compliance with the broadest US state privacy law.
Penalties
Up to $7,500 per violation.
Key Requirements
- Honor GPC/universal opt-out signals since January 2025
- Opt-in consent for sensitive data
- Privacy notice with required disclosures
- Consumer rights: access, correct, delete, portability, opt-out
- Data protection assessments for high-risk processing
Notable Provisions
- Broadest applicability: no revenue or consumer volume thresholds
- GPC/UOOM honored since January 2025
- Applies to individuals as well as businesses
- Small businesses cannot sell sensitive data
Data Subject Rights
Confirm whether a controller is processing your personal data and access that data.
Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
Have a controller delete personal data you provided or that it obtained about you.
If the data is available in a digital format, obtain a copy of the personal data you previously provided in a portable and, where technically feasible, readily usable format you can transmit to another controller.
Opt out of the processing of your personal data for targeted advertising, meaning ads selected from your activity over time across nonaffiliated websites or online applications.
Opt out of the sale of your personal data, meaning its sharing, disclosure or transfer by the controller to a third party for monetary or other valuable consideration.
Opt out of solely automated profiling in furtherance of decisions that produce legal or similarly significant effects, such as decisions about financial or lending services, housing, insurance, health care, education enrollment, employment, criminal justice or basic necessities.
Appeal a controller's refusal to act on your request, within a reasonable period after you receive the decision, through a process that is conspicuously available and similar to the request process.
Submit a complaint to the Attorney General through its online complaint mechanism, which the controller must provide to you if it denies your appeal.
Designate an authorized agent, including through a link, browser setting or extension, or global device setting, to opt out of targeted advertising or the sale of your personal data for you; this agent right does not extend to profiling or other requests.
A controller may not discriminate against you for exercising your rights, such as by denying goods or services or charging different prices, but it may offer a different price, rate, level, quality or selection if you opted out, or through a bona fide loyalty, rewards, premium features, discount or club card program.
US State Specifics
Other North America Regulations
Frequently Asked Questions
TDPSA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.
Stay compliant with TDPSA
ConsentStack helps you implement Opt-out consent for Texas, United States automatically.