Texas Data Privacy and Security Act

What it is

The Texas Data Privacy and Security Act, effective 1 July 2024. Grants Texas residents access, correction, deletion, portability, and opt-out rights, plus opt-in for sensitive data and recognition of Universal Opt-Out Mechanisms (effective 1 January 2025). Notable for replacing the consumer-count threshold with an SBA-small-business carve-out, making the scope significantly broader than Virginia's or Colorado's.

Why it matters

Civil penalties up to $7,500 per violation, with a 30-day cure period. The Texas AG has been one of the more visibly active state AGs on privacy, with public investigations of car-data collection and AdTech. Broader applicability than the other state laws — most commercial sites with U.S. traffic are in scope.

Who it applies to

Texas residents — applies to anyone conducting business in Texas or producing products/services consumed by Texas residents that processes personal data and is not an SBA-defined small business.

• Jurisdictions: United States

How WQI scores it

Web Quality Index considers this standard satisfied when all of the 4 supporting factors pass.

0 of 4 supporting factors are currently collected. Sites where the remaining 4 haven't been measured will show as partial or unknown on this standard until the data lands.

Related standards

See also

CCPA , VCDPA , CPA , CTDPA , UCPA , OCPA

Standards that share factors with this one

Auto-computed from overlapping factor tickets in satisfiedBy, excluding standards already listed under "See also" above. Strong overlap suggests these standards rise and fall together when sites are scored.

• Australian Privacy Act + APPs 3 shared factors Privacy Australia's federal privacy law, anchored on the 13 Australian Privacy Principles. The 2024 reforms added a statutory tort for serious privacy invasions and direct OAIC penalty powers.
• COPPA 3 shared factors Privacy If your site is directed at U.S. children under 13 — or you knowingly collect from them — you need verifiable parental consent before any data collection. The 2025 amendments tightened this further around third-party advertising.
• GDPR 3 shared factors Privacy If a single EU resident can see your site, GDPR can apply. Cookie consent, a real privacy policy, and not silently tracking by default are the visible signs of compliance.
• HIPAA 3 shared factors Privacy If your site collects, displays, or transmits protected health information, HIPAA applies. A privacy policy plus an explicit Notice of Privacy Practices and a clear consent flow are the minimum visible signals.
• LGPD 3 shared factors Privacy Brazil's GDPR analogue. If you serve Brazilian residents, treat it like GDPR-lite: lawful basis, consent for cookies, a real privacy policy, and ANPD-shaped data subject rights.

Other references

• regulation Texas HB 4 enrolled bill text