Texas Data Privacy & Security Act Compliance with ConsentX

The Texas Data Privacy and Security Act (TDPSA) is Texas's comprehensive consumer privacy law. It regulates the collection, use, processing, and treatment of consumers' personal data and became effective on July 1, 2024.

Texas consumers generally have the right to confirm whether a controller is processing their personal data, access their personal data, correct inaccuracies in their personal data, delete personal data provided by or obtained about them, obtain a portable copy of their personal data, opt out of targeted advertising, opt out of the sale of personal data and opt out of certain profiling activities that produce legal or similarly significant effects.

The TDPSA does not require consent for every type of personal-data processing. However, controllers must obtain consent before processing sensitive data, and additional consent requirements can apply in specific circumstances.

Sensitive data includes certain information revealing racial or ethnic origin, religious beliefs, mental or physical health conditions or diagnoses, sexuality, citizenship or immigration status, genetic or biometric data used for unique identification, personal data of children under 13, and precise geolocation data.

Yes. Consumers have the right to opt out of the processing of their personal data for targeted advertising.

Yes. The TDPSA provides consumers with the right to opt out of the sale of their personal data.

Yes. Consumers can opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.

The TDPSA provides specific mechanisms for consumers to exercise opt-out rights, including through authorized agents and technology that meets statutory requirements. Organizations should assess their implementation of universal or browser-based privacy signals alongside requirements under other applicable state privacy laws.

The TDPSA regulates personal-data processing rather than cookies as a standalone technology. Cookies, pixels, advertising tags, SDKs, and other tracking technologies may nevertheless process personal data or support targeted advertising. For this reason, discovering trackers and enforcing consumer privacy choices can form an important part of a TDPSA compliance program.

Yes. Controllers must provide a reasonably accessible and clear privacy notice describing relevant categories and purposes of personal-data processing, applicable third-party disclosures, and how consumers can exercise their rights.

Yes. Controllers must conduct and document data protection assessments for specified processing activities, including targeted advertising, sale of personal data, certain profiling, sensitive-data processing, and other processing activities presenting a heightened risk of harm to consumers.

Controllers generally must respond to consumer requests within 45 days of receiving the request. The period may be extended by an additional 45 days when reasonably necessary, subject to applicable requirements.

Generally, controllers must provide information in response to a consumer request without charge at least twice annually. Certain fees may be permitted for requests that are manifestly unfounded, excessive, or repetitive, subject to the requirements of the Act.

Yes. The TDPSA provides heightened protections for known children's data, including requirements relating to parental consent. The Act also treats the personal data of a child under 13 as sensitive data.

The Texas Attorney General has exclusive authority to enforce the TDPSA. The Act does not create a private right of action for violations.

ConsentX can help operationalize important privacy controls such as consent management, tracker discovery, prior-script blocking, consumer opt-out management, rights-request workflows, and audit evidence. However, no software can independently guarantee legal compliance. Organizations should assess their complete privacy program against the TDPSA and all other applicable laws.