Free whiteglove setup from a ConsentStack Concierge

TDPSA

Texas Data Privacy and Security Act

Flag of US
Texas, United StatesOpt-outUS State LawsState
Back to Regulations Guide

Key Facts

Effective Date
July 1, 2024
Enacted
June 18, 2023
Enforcing Authority
Texas Attorney General
Consent Model
Opt-out
Fulfillment Time
45 days
Applies To
Any non-small-business (SBA-defined) processing personal data of Texas residents, with no revenue or consumer volume thresholds

Overview

The TDPSA is the broadest US state privacy law in terms of applicability: it has no revenue thresholds and no minimum consumer data volume thresholds. Any non-small-business (as defined by the SBA) that processes personal data of Texas residents must comply, capturing far more businesses than any other state law.

What This Means for Your Website

  • GPC signals must be honored since January 2025
  • Opt-in consent is required for sensitive data
  • No revenue or consumer volume thresholds, so nearly all businesses are subject
  • Only SBA-defined small businesses are exempt (but cannot sell sensitive data)
  • A permanent 30-day cure period applies before enforcement
  • Consumer requests must be fulfilled within 45 days

Key Requirements

The Texas AG enforces the TDPSA with penalties up to $7,500 per violation. The law's breadth is unique: it applies to individuals as well as businesses, with only SBA-defined small businesses exempt. GPC/UOOM signal honoring has been mandatory since January 2025. Data protection assessments are required for high-risk processing.

How ConsentStack Handles This

ConsentStack detects Texas visitors, honors GPC signals automatically, and applies the TDPSA's opt-out model with opt-in for sensitive data, ensuring compliance with the broadest US state privacy law.

Penalties

Up to $7,500 per violation.

Maximum Fine
$7,500 per violation

Key Requirements

  • Honor GPC/universal opt-out signals since January 2025
  • Opt-in consent for sensitive data
  • Privacy notice with required disclosures
  • Consumer rights: access, correct, delete, portability, opt-out
  • Data protection assessments for high-risk processing

Notable Provisions

  • Broadest applicability: no revenue or consumer volume thresholds
  • GPC/UOOM honored since January 2025
  • Applies to individuals as well as businesses
  • Small businesses cannot sell sensitive data

US State Specifics

Cure Period
30 days
Private Right of Action
No
Global Opt-out Required
Yes
Sensitive Data Opt-in
Yes
Children Provisions
Under 13 data is sensitive requiring opt-in consent.

Other North America Regulations

CPRACalifornia, United States
The CPRA is the most comprehensive US state privacy law with a dedicated enforcement agency (CPPA). Cross-context behavioral advertising via cookies constitutes sharing personal information, triggering opt-out obligations. GPC signals must be honored as valid opt-out requests.
CCPACalifornia, United States
The CCPA was the first comprehensive consumer privacy law in the United States, giving California residents the right to know what personal information businesses collect and to opt out of its sale. It established the opt-out consent model that most subsequent US state privacy laws adopted.
PIPEDACanada
Canada's federal private-sector privacy law based on 10 fair information principles. Requires express consent for sensitive data and implied consent for less sensitive data. OPC guidance addresses cookies and online behavioral advertising. The CPPA replacement bill died January 2025; a new bill is expected.
CIPACalifornia, United States
CIPA is a 1967 California chapter covering wiretapping, eavesdropping, and other privacy invasions, not a website-specific law. Since 2022, courts have applied two of its sections to website chat, analytics, and ad tools, and any visitor can sue directly for at least $5,000 per violation, no revenue threshold.
Quebec Law 25Quebec, Canada
Quebec's Law 25 is the strictest privacy law in Canada and the closest North American equivalent to the GDPR. Consent must be clear, free, informed and requested for each purpose, and any technology that identifies, locates or profiles a visitor has to be disclosed. Its privacy-by-default rule carves out browser cookie settings, but non-essential cookies still need consent first.
CPAColorado, United States
Colorado's CPA features the highest per-violation penalties among US state privacy laws at $20,000. Must honor GPC signals since July 2024. Participated in a joint GPC enforcement sweep with California and Connecticut in September 2025. The cure period was eliminated in January 2025.

Frequently Asked Questions

TDPSA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.

Stay compliant with TDPSA

ConsentStack helps you implement Opt-out consent for Texas, United States automatically.

Get started free