Texas Data Privacy and Security Act (H.B. 4, 88th Leg., ch. 995; Tex. Bus. & Com. Code ch. 541): profiling opt-out and data protection assessments

Summary

Texas's comprehensive consumer privacy law, passed as H.B. 4 in 2023 and codified as chapter 541 of the Business and Commerce Code, in force since July 1, 2024. Unlike most state privacy laws it has no numeric threshold: it applies to anyone doing business in Texas (or producing products or services consumed by Texans) that processes or sells personal data and is not a small business as defined by the U.S. Small Business Administration; small businesses must still obtain consent before selling sensitive data. Consumers may opt out of profiling in furtherance of a decision that produces a legal or similarly significant effect, defined to include decisions on the provision or denial of financial and lending services, housing, insurance, health care, education, employment, criminal justice and basic necessities. Profiling is defined as solely automated processing to evaluate or predict personal aspects such as economic situation and reliability. Controllers must conduct and document a data protection assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury, and the Attorney General may demand it in an investigation. Financial institutions and data subject to Title V of the Gramm-Leach-Bliley Act are outside the chapter. The Attorney General enforces it exclusively, after a 30-day notice and cure step, with civil penalties of up to $7,500 per violation; there is no private right of action. The 2025 Texas Responsible AI Governance Act (H.B. 149, see state-067) amended the processor duties in section 541.104 to cover personal data processed by an AI system.

Key dates

1. June 18, 2023Enacted
2. October 16, 2026Checked against sources
3. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. TDPSA was passed as House Bill 4 during the regular session of the 88th Texas Legislature. The law became effective July 1, 2024.

   Supports: Name, bill number and effective date

   Section 541.055(e) , will go into effect January 1, 2025.

   Supports: Later effective date for 541.055(e)

   Texas Data Privacy and Security Act (Spotlight, July 2024) Texas State Law Library Reporting or analysis

2. E Signed by the Governor 06/18/2023

   Supports: Signing date

   88(R) HB 4 bill history Texas Legislature Online Primary source

3. Added by Acts 2023, 88th Leg., R.S., Ch. 995 (H.B. 4 ), Sec. 2, eff. July 1, 2024.

   Supports: Session-law chapter and effective date

   opt out of the processing of the personal data for purposes of: (A) targeted advertising; (B) the sale of personal data; or (C) profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer.

   Supports: Profiling opt-out

   "Profiling" means any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation

   Supports: Profiling definition (solely automated)

   means a decision made by the controller that results in the provision or denial by the controller of: (A) financial and lending services; (B) housing, insurance, or health care services

   Supports: Legal or similarly significant effect includes financial and lending services

   (3) the processing of personal data for purposes of profiling, if the profiling presents a reasonably foreseeable risk of: (A) unfair or deceptive treatment of or unlawful disparate impact on consumers; (B) financial, physical, or reputational injury to consumers

   Supports: Data protection assessment for risky profiling

   is not a small business as defined by the United States Small Business Administration, except to the extent that Section 541.107 applies

   Supports: Applicability (no numeric threshold)

   a financial institution or data subject to Title V, Gramm-Leach-Bliley Act (15 U.S.C. Section 6801 et seq.)

   Supports: GLBA exclusion

   The attorney general has exclusive authority to enforce this chapter.

   Supports: Exclusive Attorney General enforcement

   the attorney general shall notify a person in writing, not later than the 30th day before bringing the action

   Supports: Notice and cure step

   is liable for a civil penalty in an amount not to exceed $7,500 for each violation

   Supports: Penalty

   This chapter may not be construed as providing a basis for, or being subject to, a private right of action

   Supports: No private right of action

   the personal data collected, stored, and processed by an artificial intelligence system, as that term is defined by Section 551.001

   Supports: H.B. 149 amendment to processor duties

   Amended by: Acts 2025, 89th Leg., R.S., Ch. 1174 (H.B. 149 ), Sec. 3, eff. January 1, 2026.

   Supports: Amendment citation and date

   Tex. Bus. & Com. Code ch. 541, Consumer Data Protection Texas Legislature (Texas Constitution and Statutes) Primary source