Texas Data Privacy and Security Act and What It Changes in Your Privacy Policy

Texas starts from a different coverage structure than many other omnibus statutes. The law generally applies to a person that conducts business in Texas or produces a product or service consumed by Texas residents, processes or engages in the sale of personal data, and falls outside the small business definition used by the United States Small Business Administration.

The small business carveout is important, and Texas separately addresses small businesses that sell sensitive personal data. A business that expects the carveout to settle the issue should review whether sensitive data sales create a distinct notice problem.

A Texas privacy notice has to do the familiar omnibus law work. It should describe the categories of personal data processed, the categories of personal data shared with third parties, the categories of third parties, and the way consumers can exercise and appeal their rights. That is the baseline.

Texas goes further when certain facts are present. If the controller sells sensitive personal data, the privacy notice has to include the statement NOTICE We may sell your sensitive personal data. If the controller sells biometric data, the notice has to include the statement NOTICE We may sell your biometric data. Those are specific Texas notice requirements that change the published language on the page.

Texas also requires a controller that sells personal data to third parties or processes personal data for targeted advertising to clearly and conspicuously disclose that fact and explain how a consumer may opt out. For online businesses, that means your privacy policy and the footer path need to be coordinated, because a visible opt out path belongs alongside the disclosure.

If your business uses pixels, audience building, ad network tags, remarketing tools, or off site behavioral advertising, Texas reaches the page, the footer, the privacy choices path, and the request workflow behind them.

Texas requires a method for consumers to appeal a controller's refusal to take action on a privacy request. That means the request path and the appeal path need to be documented in your privacy policy and supported in the actual workflow. A business cannot state that Texas residents may appeal and then improvise the method when a denial is issued.

The policy has to identify how requests are submitted, how appeals work, and what the consumer should do next. If your site publishes rights language without a real path behind it, your policy creates confusion instead of clarity.

Texas is broader, more likely to touch ordinary online operations, and more explicit about the notice text required when sensitive or biometric data is sold.

Texas merits separate review because the statute can require exact notice text in the privacy notice.

A Texas review should begin with scope, then move into the advertising stack, then move into the notice text itself. The business needs the facts before your policy can be trusted.