Who it applies to
Businesses that conduct business in Texas or produce products or services consumed by Texas residents, process or sell personal data, and are not classified as a “small business” under SBA size standards. There is no fixed revenue or record-volume threshold, so smaller companies are in scope more often than under California's law.
What it requires
- A clear privacy notice describing data categories collected, purposes, and third parties
- Honoring opt-outs for targeted advertising, sale of data, and certain profiling
- Recognition of a universal opt-out signal, such as Global Privacy Control
- Data protection assessments for higher-risk processing, including targeted ads, sale of data, and profiling
What's changed recently
Enforcement sits with the Texas Attorney General, who has been actively pursuing privacy and data-security cases against companies for undisclosed data collection practices, signaling an active enforcement posture heading into 2026, even without the volume of published fines California has produced.
Informational summary, not legal advice. Reviewed for accuracy as of August 2026; laws and enforcement priorities change, so verify current requirements against the official regulator text before relying on this page.