Last verified: September 2026.
Texas has one of the broadest consumer privacy laws in the country — and one of the most aggressive enforcement offices behind it. The Texas Data Privacy and Security Act (TDPSA, Texas Business & Commerce Code Chapter 541) has been in effect since July 1, 2024, and since January 2025 businesses must even honor automatic opt-out signals from your browser. Here's what the law gives you, who has to comply, and how to turn legal rights into actual removals.
Your rights under the TDPSA
If you're a Texas resident acting in a personal (not commercial or employment) context, you have these rights against covered businesses:
| Right | What it lets you do |
|---|---|
| Access / confirm | Confirm whether a business is processing your personal data and get access to it |
| Correct | Fix inaccuracies in your personal data |
| Delete | Require deletion of personal data the business holds about you |
| Portability | Get a copy of your data in a portable, readily usable format |
| Opt out | Stop processing for targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects |
| Sensitive-data consent | Businesses need your opt-in consent before processing sensitive data (precise geolocation, biometrics, health, children's data) |
A standout feature: since January 1, 2025, covered businesses must recognize universal opt-out mechanisms — browser-level signals like Global Privacy Control (GPC). Turn GPC on in a supported browser or extension, and every covered Texas-facing site must treat it as an opt-out of sale and targeted advertising, no banner-clicking required.
Who must comply
The TDPSA is unusually broad. It applies to any company that (1) conducts business in Texas or produces products or services consumed by Texas residents, (2) processes or sells personal data, and (3) isn't a small business under US Small Business Administration definitions. Critically, there is no revenue threshold and no minimum data-volume threshold — unlike most state laws, a mid-size company handling a handful of Texans' data is covered. And even SBA-defined small businesses may not sell your sensitive data without your consent.
Separately, Texas runs a data-broker registration law (Chapter 510, Business & Commerce Code, enacted as SB 2105, effective September 1, 2023 and broadened by 2025 amendments). Data brokers must register annually with the Texas Secretary of State ($300 fee) or face penalties of at least $100/day plus unpaid fees. The Secretary of State maintains a searchable public Data Broker Registry — a useful way to check whether a company selling your information is even operating legally in Texas.
How to opt out yourself
- Enable Global Privacy Control. It's the single highest-leverage step: one browser setting that every covered business must honor automatically.
- Find the privacy controls. Look for "Your Privacy Choices" or "Do Not Sell My Personal Information" links in website footers and privacy policies. For the biggest people-search sites, use our free step-by-step guides — Spokeo, Whitepages, BeenVerified — or the full 47-site opt-out index.
- Submit a rights request citing the TDPSA: ask for deletion and opt out of sale, targeted advertising, and profiling. Companies can verify your identity, but can't make it unreasonably hard — see what to share and what to refuse during verification.
- Appeal if denied. The TDPSA provides for an appeal process. If the appeal fails, file a complaint with the Texas Attorney General's consumer protection division.
- Document everything. Keep confirmation emails and screenshots — our opt-out proof log guide shows exactly what to track.
Timelines & enforcement
| Item | Rule |
|---|---|
| Response to your request | 45 days, extendable once by another 45 days |
| Appeal decision | 60 days |
| Enforcement | Texas Attorney General only — no private right to sue |
| Cure period | 30 days after written notice — and unlike most states, it never sunsets |
| Civil penalty | Up to $7,500 per violation (each affected consumer can count separately) |
Texas isn't bluffing. In January 2025 the AG brought the TDPSA's first enforcement action — against Allstate and its subsidiary Arity over the covert collection and sale of geolocation and driving data — the first case any state filed under a comprehensive privacy law. The AG has also secured major privacy settlements outside the TDPSA (including $1.4 billion from Meta in 2024 and $1.375 billion from Google in 2025), and runs a dedicated data privacy team with an online complaint portal.
Why brokers come back
Here's the part the law can't fix for you: a deletion request covers the data a broker holds today. Brokers continuously re-ingest data from public records, marketing lists, and other brokers — so a profile you deleted in March can reappear in June from a fresh source. This is why people-search sites keep bringing you back even after a successful opt-out. Legal rights are per-request; exposure is continuous. Any real removal strategy needs re-checks built in.
Getting proof
Neither the TDPSA nor the Texas broker registry gives you evidence that a specific listing actually disappeared — a confirmation email proves a request was accepted, not that your listing is gone. The only reliable standard is re-opening the listing page later and confirming it's no longer there. That's the core of how MyPrivacyAgent works: our agents file eligible opt-outs (including with brokers that have no usable self-service form), hand you the steps only you can do, and never mark a record removed until a re-check supports it — with the proof kept in your report. Patrol ($19.99/month, see pricing) adds monthly re-checks that flag listings that come back so they can be re-filed. Start with the free exposure scan to see where you're listed, or see how we stack up in our best data removal services comparison. California resident? Read the California DELETE Act guide.
FAQ
Does the TDPSA apply to small businesses? Mostly, yes — there's no revenue threshold. The main exemption is for SBA-defined small businesses, but even they can't sell your sensitive data without consent.
How do I file a TDPSA complaint? Through the Texas Attorney General's consumer protection portal at texasattorneygeneral.gov. The AG has exclusive enforcement authority; you can't sue a business yourself under the TDPSA.
What is Global Privacy Control and do Texas businesses have to honor it? GPC is a browser-level signal that automatically communicates your opt-out of data sales and targeted advertising. Since January 1, 2025, covered businesses must recognize it — you never have to click a cookie banner to be opted out.
How long does a company have to delete my data in Texas? 45 days, with one 45-day extension allowed. Denials can be appealed within the company's process, and unresolved complaints go to the Texas AG.
Is there a Texas version of California's DROP platform? No. Texas has a data-broker registry (publicly searchable via the Secretary of State) but no centralized deletion platform. Each opt-out must be filed individually — or handled by a removal service.
Will my data stay deleted after a TDPSA request? Not necessarily. Brokers constantly re-acquire data from new sources, so re-check your listings regularly or use a monitoring service that re-files automatically.