Texas Data Privacy Act (TDPSA): The Profiling Opt-Out and What It Means for Your AI

In effect Primary law: TDPSA · Tex. Bus. & Com. Code ch. 541 (HB 4, 2023)

Texas's comprehensive privacy law — the Texas Data Privacy and Security Act (TDPSA) — has been in effect since July 1, 2024, and it carries a provision that directly touches AI: Texans can opt out of profiling used in furtherance of decisions that produce a legal or similarly significant effect, such as jobs, housing, or credit. If your business uses automated profiling to make or inform those kinds of decisions about Texans, the TDPSA opt-out is a duty you have to honor — and it sits alongside the newer TRAIGA AI law.

What the law requires

Honor the profiling opt-out. Consumers can opt out of profiling in furtherance of decisions that produce a legal or similarly significant effect (employment, housing, credit, insurance, and similar). Businesses must provide and honor that opt-out.
Honor the core consumer rights. Texans can access, correct, delete, and obtain a portable copy of their personal data, and opt out of targeted advertising and the sale of personal data.
Get consent for sensitive data. Processing sensitive data — including biometric data — requires consent.
Run data protection assessments. Covered businesses must conduct data protection assessments for higher-risk processing such as profiling that presents a heightened risk of harm.

Who must comply

Businesses that conduct business in Texas or produce products/services consumed by Texas residents, process or sell personal data, and are not small businesses (as defined by the U.S. Small Business Administration), with limited exceptions. The TDPSA's small-business framing makes its threshold different from most state privacy laws, but if you profile Texans for significant decisions you should assume coverage and confirm.

Penalties & enforcement

The Texas Attorney General has exclusive enforcement. Civil penalties are up to $7,500 per violation, after a 30-day cure period. There is no private right of action under the TDPSA.

How to comply: a practical checklist

Identify every place you use automated profiling to make or inform decisions with legal/significant effects on Texans (hiring, lending, housing, insurance).
Stand up a clear, accessible opt-out for profiling and the other TDPSA rights (targeted ads, sale, access, correction, deletion, portability).
Add consent capture for sensitive data, including biometrics.
Conduct and document data protection assessments for profiling and other heightened-risk processing.
Build a 30-day cure workflow so you can fix issues before AG penalties attach.
Coordinate TDPSA compliance with TRAIGA (HB 149): the privacy opt-out and the AI-use prohibitions are separate regimes that both apply to AI in Texas.

Get an alert the moment this changes

AI law moves fast — effective dates shift, rules get repealed and replaced, new bills pass. Create a free AI Laws USA account, watch the laws on this page, and get an email the moment one of them moves, takes effect, or is challenged. Free for the public, journalists, and students.

Create a free account & set alerts → See team plans

The laws this guide is built on

Every claim above traces to one of these verified entries in our index. Each links to its full record and its official source. Status labels reflect the live dataset as of 2026-06-17.

In effect Limited protection

TDPSA

Texas · Effective 2024-07-01 · Tex. Bus. & Com. Code ch. 541 (HB 4, 2023)

Texans can access, correct, delete, and obtain copies of personal data held by covered businesses, and can opt out of targeted advertising, data sales, and profiling used for decisions with significant effects (like jobs, housing, or credit). Businesses must get consent for sensitive data, including biometrics.

View full entry → · Official source ↗
In effect Limited protection

TRAIGA

Texas · Effective 2026-01-01 · Tex. HB 149 (2025), TRAIGA

Texas's AI law bans specific harmful uses of AI — intentional discrimination, behavioral manipulation encouraging self-harm or crime, social scoring by government, and certain biometric identification without consent — and requires government agencies to disclose AI interactions to consumers. It includes a regulatory sandbox and preempts local AI ordinances.

View full entry → · Official source ↗

Browse all Texas AI laws in the directory → · See the privacy topic → · Texas jurisdiction overview →

Frequently asked questions

Does the Texas privacy law let people opt out of AI profiling?

Yes. The TDPSA lets Texans opt out of profiling in furtherance of decisions that produce a legal or similarly significant effect — like employment, housing, or credit decisions. See the official bill history.

Who has to comply with the TDPSA?

Businesses operating in Texas or serving Texas residents that process or sell personal data and aren't small businesses (per the SBA definition), with limited exceptions.

What are the TDPSA penalties?

Up to $7,500 per violation, enforced exclusively by the Texas Attorney General after a 30-day cure period. There's no private right of action.

Does the TDPSA require consent for biometric data?

Yes — biometric data is sensitive data under the TDPSA, and processing it requires consent.

How does the TDPSA relate to TRAIGA?

They're separate. The TDPSA is a data-privacy law with a profiling opt-out; TRAIGA (HB 149) is an AI-specific law banning certain harmful uses. Both can apply to your AI in Texas.