Who it covers
The TDPSA applies to a person or business that (1) conducts business in Texas or produces products or services consumed by Texas residents, (2) processes or sells personal data, and (3) is not a small business as defined by the U.S. Small Business Administration. Unlike many state privacy laws, there's no revenue or data-volume threshold.
One rule reaches even exempt small businesses: they may not sell a consumer's sensitive data without that consumer's consent.
What it means for marketing
- Opt-outs. Consumers can opt out of the processing of their personal data for targeted advertising, sale, and certain profiling. Plan how those requests reach your ad platforms, CRM and sending tools.
- Sensitive data needs consent. Covered businesses must obtain consent before processing sensitive data (categories include health information, precise geolocation, and data about known children, among others).
- Privacy notice. You need a reasonably accessible, clear notice of what you collect, why, what you share, and how consumers exercise their rights. Selling sensitive or biometric data triggers specific required disclosures.
- Data protection assessments. Processing for targeted advertising, sale of personal data, and processing of sensitive data are among the activities that require a documented assessment.
- Vendors. Processors (agencies and platforms acting on your instructions) need contracts with required terms and must help you respond to consumer requests.
Enforcement
There's no private right of action. The Texas Attorney General has exclusive enforcement authority, must give notice and a 30-day opportunity to cure before suing, and can seek civil penalties of up to $7,500 per violation. Unlike some states, the Texas cure period does not sunset.
A marketer's checklist
- Confirm whether you're covered (or are a small business still bound by the sensitive-data sale rule).
- List every place personal data is used for targeted advertising, sale or profiling.
- Make sure opt-out requests propagate to every system and vendor involved.
- Identify any sensitive data and confirm consent before processing it.
- Update the privacy notice to match what marketing actually does.
- Complete and keep data protection assessments for targeted advertising and other covered activities.
Zielit's privacy assessment and privacy governance work is built around exactly these questions.
This article is general information about marketing operations, not legal advice. Laws and agency rules change; confirm how they apply to your business with qualified counsel.
Frequently asked questions
When did the Texas Data Privacy and Security Act take effect?
Most of the Act took effect July 1, 2024. It was signed into law in June 2023.
Does the TDPSA have a revenue threshold?
No. It applies to businesses that operate in Texas or serve Texas residents, process or sell personal data, and are not small businesses under the SBA definition.
Are small businesses exempt from the TDPSA?
Mostly, but not entirely: a small business may not sell a consumer's sensitive data without that consumer's consent.
Is there a private right of action under the TDPSA?
No. The Texas Attorney General enforces the Act, with a 30-day cure period and civil penalties up to $7,500 per violation.
Does the TDPSA cover targeted advertising?
Yes. Consumers can opt out of processing for targeted advertising, and that processing is among the activities requiring a data protection assessment.