Texas's primary website law is the Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024 — a comprehensive privacy law modeled on Virginia's VCDPA but with a notably lower applicability threshold. Texas also has one of the country's strictest biometric statutes and a 2025 AI governance law.
Last reviewed 2026-06-01 · Risk rating rationale: The TDPSA threshold (processing data of any Texas resident, with limited carve-outs for small businesses) catches far more sites than California's CCPA. The Texas AG has been actively staffing privacy enforcement since 2024.
Find out in 10 seconds whether your site meets Texas's requirements
Scantra runs a free, no-account, 9-check audit of your homepage covering privacy policy, contact info, CCPA-style opt-out, security headers, accessibility, and SEO basics. Most Texas sites we scan fail at least three.
No credit card · Email required so we can send you the full results.
Key Texas laws affecting websites
The statutes most likely to apply to a commercial website serving Texas residents. Click a citation to read the official text where available.
TDPSA
— Texas Data Privacy and Security Act· Effective 2024
Applies to: Any person who conducts business in Texas OR produces a product or service consumed by Texas residents, AND processes personal data — with a small-business exemption for entities with fewer than 250 employees and gross revenue under $30M (subject to caveats).
What your website must do
Publish a reasonably accessible, clear, and meaningful privacy notice
Provide consumer rights: access, correction, deletion, portability, opt-out of sale + targeted advertising + profiling
Honor universal opt-out signals (Global Privacy Control) by January 1, 2025
For sensitive personal data, obtain opt-in consent before processing
Disclose if you sell sensitive personal data — must say so in capital letters
— Capture or Use of Biometric Identifier Act· Effective 2009
Applies to: Anyone who captures a biometric identifier (retina/iris scan, fingerprint, voiceprint, hand or face geometry) of a Texas resident for a commercial purpose.
What your website must do
Provide notice before capturing the biometric identifier
Obtain consent to the capture
Do not sell, lease, or otherwise disclose the identifier except in narrow exceptions
Destroy the identifier within a reasonable time, not to exceed one year after the purpose ends
Citation: Tex. Bus. & Com. Code § 503.001
TRAIGA
— Texas Responsible AI Governance Act· Effective 2026
Applies to: Developers and deployers of high-risk AI systems used to make consequential decisions (housing, employment, financial services, healthcare, education, government services) about Texas residents.
What your website must do
Disclose to the consumer when a high-risk AI system makes a consequential decision about them
Provide an explanation of the principal factors used and their relative importance
Offer a path to human review for adverse decisions
What your site has to disclose, ask consent for, and allow consumers to do with their personal information.
The TDPSA gives Texas residents the standard set of modern privacy rights — access, correction, deletion, portability, opt-out. The notable feature is the broad applicability: unlike Virginia or Colorado, Texas doesn't require a high revenue threshold, so the small-business exemption is the only relief and it's narrower than it sounds.
Practical requirements for your website
Publish a clear privacy notice with the TDPSA-required categories
Provide a Texas-resident-accessible mechanism to exercise their rights
Respond to rights requests within 45 days (one 45-day extension allowed)
Use the specific capitalized disclosure if you sell sensitive personal data
Honor opt-out preference signals (GPC) by January 1, 2025
Obtain opt-in consent before processing sensitive data (precise geolocation, biometric, health, race/ethnicity, sexual orientation, immigration status, religious beliefs, kids' data)
Cookies and tracking
State-specific rule applies
When you need consent, opt-outs, or universal-signal honor for cookies and analytics scripts.
Texas treats most analytics, advertising, and cross-site tracking cookies as falling under the TDPSA's 'targeted advertising' and 'sale' definitions. Users get to opt out, and the universal opt-out (Global Privacy Control) must be honored from January 1, 2025.
Practical requirements for your website
Offer a website opt-out from cookies used for targeted advertising
Honor the Global Privacy Control browser signal
Disclose third-party cookie sharing in the privacy notice
Do not deploy advertising or analytics cookies for users who have opted out
Accessibility (ADA + state)
Federal law applies
WCAG conformance expectations and how the state's accessibility cases tend to be litigated.
Texas doesn't have a state-specific website accessibility statute beyond the federal ADA. Title III ADA actions against websites are filed regularly in the Southern and Northern Districts of Texas. The Texas Disabilities Act (Tex. Hum. Res. Code Ch. 121) tracks federal protections.
Practical requirements for your website
Comply with WCAG 2.1 Level AA as the federal-ADA-compliance benchmark
Provide text alternatives for non-text content
Ensure keyboard navigability
Maintain a documented accessibility statement and remediation route
Cybersecurity and breach response
State-specific rule applies
What 'reasonable security' looks like under state law and how fast you have to notify after a breach.
Texas requires businesses that own or license sensitive personal information to implement and maintain reasonable security measures (Tex. Bus. & Com. Code § 521.052). Breach notification under § 521.053 requires notice within 60 days; breaches affecting 250+ residents must also be reported to the Texas AG.
Practical requirements for your website
Implement reasonable security procedures and practices to protect sensitive personal information
Notify affected residents within 60 days of breach discovery
Notify the Texas AG within 60 days for breaches affecting 250+ residents
Maintain documented incident-response procedures
Email and SMS marketing
State-specific rule applies
How federal CAN-SPAM and TCPA interact with state-level marketing rules in this jurisdiction.
Texas's Bus. & Com. Code Ch. 321 (Electronic Mail Solicitation Act) supplements federal CAN-SPAM with state-level enforcement. Texas residents can sue for $10 per email or $25,000 per day for unsolicited commercial email with falsified headers.
Practical requirements for your website
Use truthful sender information and subject lines
Include a working unsubscribe mechanism that's honored within 10 business days
Include a valid physical postal address in every commercial email
Don't send to recipients who've opted out
AI regulation
State-specific rule applies
Which AI uses the state has chosen to regulate, who's covered, and what the website has to disclose.
The Texas Responsible AI Governance Act (TRAIGA), effective January 1, 2026, requires deployers of 'high-risk AI systems' to disclose AI use, explain decisions, and provide human review. Applicable categories include employment, housing, financial services, healthcare, education, and government services.
Practical requirements for your website
If you deploy AI for consequential decisions about Texas residents: disclose the AI use to the consumer
Provide the principal factors used in the decision
Offer human review of adverse decisions
Conduct and document impact assessments
Frequently asked questions about Texas website compliance
Does my e-commerce site comply with the Texas Data Privacy and Security Act?
If you sell products or services to Texas residents and you don't qualify for the small-business exemption (under 250 employees AND under $30M revenue), you're subject to the TDPSA. Most US e-commerce stores with national reach satisfy the consumer-base requirement automatically. Scantra's free scan checks the visible portion of TDPSA compliance — privacy notice presence, opt-out mechanism, sensitive-data disclosure language.
Do I need a 'Do Not Sell' link if I'm based in Texas?
Yes if you sell personal data of Texas residents, and effectively yes if you share data with advertising or analytics vendors (the TDPSA's 'targeted advertising' definition is broad). You also need the capitalized disclosure 'NOTICE: We may sell your sensitive personal data' when applicable. The capitalized format is a statutory requirement, not a recommendation.
What about Texas biometric privacy?
Tex. Bus. & Com. Code § 503.001 requires informed consent before capturing biometric identifiers and prohibits sale or disclosure with limited exceptions. The statute applies to face geometry — which means face-recognition login, ID verification photos, and photo-tagging features in social products all need consent flows. Violations carry up to $25,000 per occurrence.
When does the Texas AI law affect my business?
TRAIGA takes effect January 1, 2026, and applies if you deploy a 'high-risk' AI system to make consequential decisions about Texans in housing, employment, financial services, healthcare, education, or government services. If your business is in any of those verticals and uses automated decisioning, the TRAIGA disclosure and human-review obligations apply.
What's the difference between TDPSA and California's CCPA?
Three big differences. First: TDPSA has a much lower applicability threshold — California's $25M/100k-resident triggers don't appear in TDPSA, so smaller businesses are caught. Second: TDPSA requires opt-IN consent for sensitive data, where CCPA only requires the option to opt OUT. Third: TDPSA's enforcement is solely with the Texas AG; CCPA has both the AG and the CPPA agency, plus a private right of action for breaches.
Ready to check your own site against Texas's requirements?
The same free 9-rule scan, no signup needed. Two of the findings include drafted fixes you can copy/paste; full results (and ongoing monitoring) come with a free account.
Important: Scantra is a software tool and a non-profit publisher, not a law firm. The summaries on this page are written for general business orientation and reflect the editors' reading of the statutes as of 2026-06-01. They are not legal advice and should not be the only source you rely on for compliance decisions. For your specific situation, consult a licensed attorney in Texas.