What Is the Texas Data Privacy and Security Act?
The TDPSA applies to any business that conducts business in Texas or targets Texas residents, processes personal data of 100,000+ Texans annually, or derives 50%+ of revenue from selling personal data. Consumers have rights to access, delete, correct, port, and opt out of targeted advertising, sale, or profiling. Businesses have 45 days (extendable once by 45) to respond. The Texas AG enforces with civil penalties up to $7,500 per violation after a 30-day cure period.
At a glance
- Full name
- Texas Data Privacy and Security Act
- Short code
- TDPSA
- Effective date
- July 1, 2024
- Response deadline
- 45 days
- Cure period
- 30 days
- Private right of action
- No
- Enforcement
- Texas Attorney General — Consumer Protection Division
- Maximum penalty
- Up to $7,500 per violation
- Statutory citation
- Tex. Bus. & Com. Code Ch. 541
Who TDPSA applies to
A business is covered if it meets the applicability thresholds set out in Tex. Bus. & Com. Code Ch. 541. Most state laws use an “or” framework — any one of the thresholds triggers coverage unless otherwise noted.
- Conducts business in Texas or produces products/services targeted at Texas residents
- Processes or engages in the sale of personal data
- Is not a small business as defined by the SBA (exempt unless selling sensitive data without consent)
Consumer rights under TDPSA
Right to delete personal data (§ 541.051)
Right to opt out of targeted advertising and sale
Right to data portability
Right to appeal a denied request
Enforcement by AG; civil penalties up to $7,500 per violation
Notable features (vs. CCPA)
TDPSA is one of the few state privacy laws that uses the US Small Business Administration's definition to exempt small businesses outright — a significant difference from CCPA, which applies revenue/volume thresholds. The law also mandates opt-in consent before processing sensitive personal data (a higher bar than CCPA's opt-out default).
Enforcement & penalties
Enforcing agency: Texas Attorney General — Consumer Protection Division
Maximum penalty: Up to $7,500 per violation
Cure period: Businesses have 30 days after notice from the Attorney General to cure a violation before penalties can be assessed.
Private right of action: TDPSA is enforced exclusively by the Texas Attorney General. Consumers cannot sue businesses directly; the enforcement path is filing a complaint with the AG Consumer Protection Division.
Where to file a complaint: Texas Attorney General — Consumer Protection Division
How to exercise your TDPSA rights
- 1
Identify the business that holds your data (or use OfflistMe, which pre-targets 300+ known brokers and applies TDPSA citations automatically).
- 2
Submit a verifiable consumer request to the business's designated contact. Include enough identifying data that the business can verify you as a Texas resident (e.g., ZIP code, email associated with your record).
- 3
Under TDPSA, businesses have 45 days to respond. Extensions are permitted with written notice under most state laws.
- 4
If the business fails to respond or denies the request without legal basis, file a complaint with the Texas Attorney General — Consumer Protection Division at https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint.
Use your rights
TDPSA-compliant deletion emails, $5 one-time
OfflistMe drafts TDPSA-compliant deletion emails for 300+ data brokers. Citations included. You send from your own inbox. No account, no ID upload.
Start for $5 →FAQ
Does the Texas TDPSA apply to out-of-state data brokers?+
Yes. The law applies to any business that targets Texas residents, regardless of where the broker is located. A broker in New York that sells data on Texans is subject to TDPSA requests.
What is the "cure period" under Texas law?+
Before the AG can fine a business for a TDPSA violation, the business gets 30 days to cure the violation after receiving notice. This means: send your deletion request, wait 45 days, then file an AG complaint if ignored — the cure period begins at that point.
Can Texas residents sue data brokers directly?+
No. TDPSA has no private right of action. Enforcement is exclusive to the Attorney General. Filing a complaint with the AG's Consumer Protection Division is the enforcement path.
What Texas-specific brokers should I target?+
Texas court records (especially Harris and Dallas County) are heavily scraped by national people-search sites. Start with Whitepages, Spokeo, and TruePeopleSearch, then add state-specific aggregators like PublicDataUSA.
Official sources & citations
Compare with sibling state laws
TDPSA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date — useful when tracking how this law influenced or was influenced by neighbouring legislation: