Texas privacy law takes effect in 2024, adding another state consumer data regime

A Davis Wright Tremaine overview says the Texas Data Privacy and Security Act became law on June 16, 2023, and will generally take effect on July 1, 2024. The firm said separate global opt-out technology provisions take effect on Jan. 1, 2025.

The overview says Texas is the 11th state to enact a comprehensive consumer privacy law, after California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana and Florida. It also says Oregon is expected to become the 12th if its own measure is enacted.

The article says Texas, with a population above 30 million, is the second-largest state after California to adopt a broad consumer privacy law. It adds that close to 40% of the U.S. population will have access to new state consumer rights across the 11 states with such laws.

The overview says the Texas law is broadly similar to privacy statutes in Virginia, Utah and Iowa, and generally more business-friendly than laws in California and Colorado. It also says the statute does not set annual revenue or personal-data-processing thresholds for coverage.

Instead, the law applies to controllers and processors and includes entity-level, data-specific and employment-related exemptions, according to the overview. It says the law protects consumers only when they act in an individual or household capacity, not in business-to-business settings.

The article describes consumer rights under the law, including the right to confirm whether processing is happening, access personal data, correct inaccuracies, delete personal data and obtain portable copies of data previously provided to a controller. It also says covered businesses must offer at least two secure and accessible ways for authenticated consumer requests and generally respond within 45 days, with a possible 45-day extension.

On scope, the overview says consent is defined as a clear affirmative act that shows a consumer’s freely given, specific, informed and unambiguous agreement. It says biometric data includes information from automatic measurements of biological characteristics, but excludes photographs, video, audio recordings and data generated from them. The article says sensitive data includes racial or ethnic origin, religious beliefs, health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used to uniquely identify a person, known-child data and precise geolocation.

The overview also says the law bars collection and processing of sensitive data without consumer consent, or parental consent if the person is under 13. It defines sale of personal data as sharing, disclosing or transferring personal data for monetary or other valuable consideration, subject to listed exclusions such as disclosures to affiliates, processors, mergers or acquisitions, and information intentionally made public through mass media.

For compliance, the article says controllers must conduct and document data protection assessments for certain high-risk processing. It says those assessments must weigh the benefits of the processing against risks to consumers and consider safeguards, and that assessments done to satisfy comparable legal requirements can meet the Texas standard. The overview says controllers and processors must also use contracts with standard privacy-law terms covering instructions, duration, confidentiality, sub-processors, deletion or return of data and cooperation with assessments.

What officials said: the overview says the Texas attorney general has exclusive enforcement authority. It says Texas does not give rulemaking power under the law, unlike California, Colorado and Florida, and that civil penalties can reach $7,500 per violation. The article also says the attorney general may seek injunctive relief, attorney’s fees and investigation and litigation expenses.

The overview says there is no private right of action. It also says the attorney general must give notice of the specific alleged violations before enforcement, followed by a 30-day cure period. If the violation is cured, the article says, no enforcement action may be brought. The cure process includes written confirmation, consumer notice when available, supporting documentation and internal policy changes if needed.

What happens next: the law’s general effective date is July 1, 2024, with the global opt-out technology provisions set for Jan. 1, 2025. The overview says the cure right has no sunset provision.

Sources

• Davis Wright Tremaine overview of the Texas Data Privacy and Security Act
• Davis Wright Tremaine canonical article

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.