{ "jurisdiction_id": "US-TX", "jurisdiction": "United States – Texas", "url": "https://dataprotection.gi/jurisdictions/united-states-texas/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-05", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 45, "sub_modules": 57, "source_register": 20 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/united-states-texas/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "A clearly identified enforcer (OAG) and a stack of in-force statutes with defined material and territorial scope.", "claims": [ { "statement": "The Texas Data Privacy and Security Act is enforced exclusively by the Texas Attorney General's Office, with no dedicated Texas data protection authority.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/opinion/texas-comprehensive-look-data-privacy-and-security", "source_tier": null, "observed_at": null }, { "statement": "Texas enacted the Texas Data Privacy and Security Act (HB 4) on June 18, 2023, with compliance required from July 1, 2024.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/opinion/texas-comprehensive-look-data-privacy-and-security", "source_tier": null, "observed_at": null }, { "statement": "The Texas Responsible Artificial Intelligence Governance Act (TRAIGA) entered into force on January 1, 2026, one month before the Colorado AI Act.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/governor-signs-texas-responsible-artificial-intelligence-governance-act", "source_tier": null, "observed_at": null }, { "statement": "Texas maintains a standalone biometric statute, the Capture or Use of Biometric Identifier Act (CUBI), codified at Tex. Bus. & Com. Code §503.001, effective since April 1, 2009.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "U.S. Federal Trade Commission", "source_url": "https://www.ftc.gov/system/files/ftc_gov/pdf/p225402biometricpolicystatement.pdf", "source_tier": null, "observed_at": null }, { "statement": "TDPSA personal data is defined as information linked or reasonably linkable to an identified or identifiable individual, including pseudonymous data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/resource/texas-data-privacy-and-security-act-tdpsa-quick", "source_tier": null, "observed_at": null }, { "statement": "TDPSA applies to entities conducting business in Texas or producing products/services consumed by Texas residents that process or sell personal data and are not a small business under SBA guidelines — a unique three-factor threshold without revenue or volume stipulations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/texas-latest-to-add-comprehensive-state-privacy-law", "source_tier": null, "observed_at": null }, { "statement": "Texas maintains a mandatory data-broker registry under Business & Commerce Code Chapter 509, requiring registration with the Texas Secretary of State and authorizing civil penalties for noncompliance.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Texas Legislature", "source_url": "https://www.dataguidance.com/sites/default/files/sb02105f.pdf", "source_tier": null, "observed_at": null }, { "statement": "SB 1343 expanded data-broker registration-statement requirements (purchaser credentialing, children's-data handling, security-breach statistics) and mandates a conspicuous website notice, applicable to statements submitted on or after September 1, 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://www.dataguidance.com/news/texas-bill-data-broker-notice-requirements-signed-1343", "source_tier": null, "observed_at": null } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/united-states-texas/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Consent and special-category rules are confirmed; the absence of an enumerated lawful-basis list (unlike GDPR Art. 6) is a structural gap relative to omnibus regimes.", "claims": [ { "statement": "TDPSA, following the Virginia consumer-privacy model as its structural foundation, relies on a notice-and-consent/opt-out framework rather than an enumerated list of GDPR-style lawful bases for processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/texas-latest-to-add-comprehensive-state-privacy-law", "source_tier": null, "observed_at": null }, { "statement": "TDPSA requires opt-in consent for the collection and use of sensitive data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/texas-latest-to-add-comprehensive-state-privacy-law", "source_tier": null, "observed_at": null }, { "statement": "TDPSA's sensitive personal data categories include biometric data, children's data, and precise geolocation data, requiring heightened protection.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/resource/texas-data-privacy-and-security-act-tdpsa-quick", "source_tier": null, "observed_at": null }, { "statement": "CUBI prohibits capture of a person's biometric identifier for a commercial purpose without first informing the individual and obtaining consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://www.dataguidance.com/news/texas-ag-secures-14b-settlement-meta-over-unauthorized", "source_tier": null, "observed_at": null }, { "statement": "TDPSA's definition of personal data explicitly includes pseudonymous data, extending coverage beyond directly identifiable information.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/resource/texas-data-privacy-and-security-act-tdpsa-quick", "source_tier": null, "observed_at": null } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "amber", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/united-states-texas/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Core rights (access/correction/deletion/opt-out) are Confirmed; portability and exact deadline windows rest on Probable inference from the law's Virginia-model foundation rather than directly retrieved statutory text.", "claims": [ { "statement": "TDPSA grants consumers the right to confirm whether a business is processing their personal data and to access that personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/resource/texas-data-privacy-and-security-act-tdpsa-quick", "source_tier": null, "observed_at": null }, { "statement": "TDPSA grants consumers rights to correct inaccuracies in their personal data and to request deletion of personal data provided by or obtained about the consumer.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/resource/texas-data-privacy-and-security-act-tdpsa-quick", "source_tier": null, "observed_at": null }, { "statement": "Texas's universal opt-out mechanism (UOOM) recognition requirement under TDPSA took effect January 1, 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/there-s-no-opting-out-of-universal-opt-outs", "source_tier": null, "observed_at": null }, { "statement": "TDPSA is understood to include a data-portability right consistent with the Virginia consumer-privacy framework that forms its structural foundation.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/texas-latest-to-add-comprehensive-state-privacy-law", "source_tier": null, "observed_at": null }, { "statement": "As a Virginia-model comprehensive privacy law, TDPSA is understood to require controllers to respond to consumer-rights requests within 45 days, extendable once by a further 45 days.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/texas-latest-to-add-comprehensive-state-privacy-law", "source_tier": null, "observed_at": null } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/united-states-texas/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Breach notification and DPIA-style assessment duties are Confirmed and materially significant; DPO, ROPA, joint-controller, and retention-limitation provisions are either absent or unconfirmed, warranting an amber rating.", "claims": [ { "statement": "TDPSA requires organizations to conduct data-protection (risk) assessments in specified circumstances to identify potential vulnerabilities and ensure compliance.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/resource/texas-data-privacy-and-security-act-tdpsa-quick", "source_tier": null, "observed_at": null }, { "statement": "As with other comprehensive state privacy laws, TDPSA-era obligations are generally understood to encompass data minimization, purpose limitation, and reasonable security safeguards for personal-data processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/resources/article/us-state-privacy-laws-overview", "source_tier": null, "observed_at": null }, { "statement": "HB 4390 requires breach disclosure without unreasonable delay and not later than the 60th day after the date a person determines a breach occurred, replacing the prior 'quickly as possible' TITEPA standard.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/texas-consumer-privacy-bills-become-breach-notification-updates-and-a-new-privacy-council", "source_tier": null, "observed_at": null }, { "statement": "HB 4390 requires disclosure of breach details (nature/circumstances, number of Texas residents affected, remedial measures taken and planned, and law-enforcement involvement) to the Texas Attorney General for breaches affecting at least 250 Texas residents.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/texas-consumer-privacy-bills-become-breach-notification-updates-and-a-new-privacy-council", "source_tier": null, "observed_at": null } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "red", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/united-states-texas/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "No comprehensive cross-border transfer/adequacy framework exists under TDPSA or any other reviewed Texas instrument.", "claims": [] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/united-states-texas/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Financial, health, credit, education, and employment carve-outs are Confirmed; telecoms/ePrivacy and insurance-sector overlays are absent from the evidence gathered.", "claims": [ { "statement": "TDPSA exempts financial institutions and data subject to the Gramm-Leach-Bliley Act (GLBA).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/opinion/texas-comprehensive-look-data-privacy-and-security", "source_tier": null, "observed_at": null }, { "statement": "TDPSA exempts covered entities and business associates subject to HIPAA, and data regulated under HIPAA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/opinion/texas-comprehensive-look-data-privacy-and-security", "source_tier": null, "observed_at": null }, { "statement": "TDPSA excludes data processed solely in the employment context from its scope of covered personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/opinion/texas-comprehensive-look-data-privacy-and-security", "source_tier": null, "observed_at": null }, { "statement": "TDPSA exempts data subject to the Fair Credit Reporting Act (FCRA).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/opinion/texas-comprehensive-look-data-privacy-and-security", "source_tier": null, "observed_at": null }, { "statement": "TDPSA exempts institutions of higher education and data subject to the Family Educational Rights and Privacy Act (FERPA).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/opinion/texas-comprehensive-look-data-privacy-and-security", "source_tier": null, "observed_at": null } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "amber", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/united-states-texas/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "UOOM, dark-patterns, and targeted-advertising opt-out are Confirmed; cookie-specific, direct-marketing, and clean-room provisions are absent from the evidence gathered.", "claims": [ { "statement": "TDPSA includes provisions addressing 'dark patterns' in connection with obtaining valid consumer consent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/texas-latest-to-add-comprehensive-state-privacy-law", "source_tier": null, "observed_at": null }, { "statement": "Texas is among the states where universal opt-out mechanism (UOOM) requirements are already in effect, with Texas's obligation taking effect January 1, 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/there-s-no-opting-out-of-universal-opt-outs", "source_tier": null, "observed_at": null }, { "statement": "TDPSA grants consumers the right to opt out of the processing of personal data for purposes of targeted advertising and the sale of personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/texas-latest-to-add-comprehensive-state-privacy-law", "source_tier": null, "observed_at": null } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/united-states-texas/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "TRAIGA and CUBI are robust, Confirmed frameworks; profiling-restriction language and genetic-data regulation are unconfirmed/absent.", "claims": [ { "statement": "TDPSA is understood to grant consumers an opt-out right against profiling in furtherance of decisions producing legal or similarly significant effects, consistent with its Virginia-model foundation.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/texas-latest-to-add-comprehensive-state-privacy-law", "source_tier": null, "observed_at": null }, { "statement": "TRAIGA imposes disclosure requirements for state agencies when citizens interact with AI tools the agency uses, bans capturing biometric identifiers without consent, and prohibits AI developers from creating systems designed to manipulate human behavior, make discriminatory decisions, or produce deepfakes exploiting children.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/governor-signs-texas-responsible-artificial-intelligence-governance-act", "source_tier": null, "observed_at": null }, { "statement": "TRAIGA is enforced exclusively by the Texas Attorney General, who may assess administrative fines of not less than USD80,000 and not more than USD200,000 per violation if a covered entity fails to cure within 60 days, and the statute provides no private right of action.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/governor-signs-texas-responsible-artificial-intelligence-governance-act", "source_tier": null, "observed_at": null }, { "statement": "The Texas Attorney General secured a $1.4 billion settlement with Meta Platforms Inc. over unauthorized capture and use of Texans' biometric data under CUBI.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://www.dataguidance.com/news/texas-ag-secures-14b-settlement-meta-over-unauthorized", "source_tier": null, "observed_at": null }, { "statement": "TDPSA includes exemptions for government agencies, carving state and local government processing out of its general obligations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/resource/texas-data-privacy-and-security-act-tdpsa-quick", "source_tier": null, "observed_at": null } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/united-states-texas/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Multiple enacted statutes and active AG enforcement are Confirmed, but significant portions of the regime (SCOPE Act, App Store Accountability Act) are currently enjoined and subject to ongoing appellate litigation, materially affecting operative status.", "claims": [ { "statement": "Texas HB 1181 mandates that websites with at least one-third content deemed sexual material harmful to minors implement robust age-verification systems, often requiring government-issued identification, third-party verification, or biometric data; the law was upheld by the U.S. Supreme Court in Free Speech Coalition v. Paxton (June 27, 2025).", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/what-the-supreme-court-s-decision-upholding-texas-law-means-for-data-privacy", "source_tier": null, "observed_at": null }, { "statement": "Texas HB 1181 imposes fines of up to USD10,000 per day plus USD250,000 per instance of minor access for noncompliance with its age-verification mandate.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/what-the-supreme-court-s-decision-upholding-texas-law-means-for-data-privacy", "source_tier": null, "observed_at": null }, { "statement": "The Texas Attorney General has brought enforcement action against Snap alleging violation of the Securing Children Online Through Parental Empowerment Act by collecting and sharing minors' personal information with third parties without required safeguards.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/the-state-of-enforcement-part-ii-kids-and-teens-privacy", "source_tier": null, "observed_at": null }, { "statement": "Texas HB 18 (SCOPE Act) imposes duties on digital service providers regarding minors, including making algorithm code available to independent security researchers, but portions of HB 18 remain partially enjoined pending Fifth Circuit review.", "regulatory_stage": "enacted_not_yet_effective", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/kids-and-teens-online-privacy-and-safety-8-compliance-considerations", "source_tier": null, "observed_at": null } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "green", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/united-states-texas/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "AG powers, penalty caps, and a substantial, escalating enforcement record are all Confirmed with specific, recent examples.", "claims": [ { "statement": "TDPSA violations are subject to civil penalties of up to $7,500 per violation, enforced exclusively by the Texas Attorney General, with a 30-day statutory cure period before penalties attach.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/resource/texas-data-privacy-and-security-act-tdpsa-quick", "source_tier": null, "observed_at": null }, { "statement": "In December 2025, the Texas Attorney General filed lawsuits against five smart-TV manufacturers (Sony, Samsung, LG, Hisense, and TCL) over automated content recognition technology allegedly used to unlawfully collect and monetize consumers' viewing data, obtaining temporary restraining orders against Hisense and Samsung.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/automated-content-recognition-technology-takes-privacy-enforcement-spotlight", "source_tier": null, "observed_at": null }, { "statement": "The Texas Attorney General secured a $1.4 billion settlement with Meta Platforms Inc. in July 2024 over unauthorized biometric-data capture under CUBI.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://www.dataguidance.com/news/texas-ag-secures-14b-settlement-meta-over-unauthorized", "source_tier": null, "observed_at": null }, { "statement": "The Texas Attorney General has invoked the general Texas Deceptive Trade Practices Act (DTPA) catch-all provision in privacy-adjacent enforcement, such as its suit against General Motors over data-sharing practices.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/a-view-from-dc-bracing-for-the-state-privacy-consumer-protection-one-two-enforcement-punch", "source_tier": null, "observed_at": null }, { "statement": "TDPSA does not grant individuals a private right of action; enforcement is reserved to the Texas Attorney General.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance (OneTrust)", "source_url": "https://legacy.dataguidance.com/opinion/texas-comprehensive-look-data-privacy-and-security", "source_tier": null, "observed_at": null }, { "statement": "TRAIGA entered into force January 1, 2026, and the Texas Attorney General has continued a broad privacy-enforcement crackdown into 2026, including the December 2025 ACR lawsuits against smart-TV manufacturers.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/governor-signs-texas-responsible-artificial-intelligence-governance-act", "source_tier": null, "observed_at": null } ] } ] }