Texas Data Privacy and Security Act
The Texas Data Privacy and Security Act (TDPSA), effective July 1, 2024, gives Texas residents rights to access, correct, delete, and obtain a copy of their personal data, plus an opt-out of targeted advertising, sale, and certain profiling. Unusually it ties applicability to whether a business is a 'small business' (per the SBA) rather than a numeric record threshold. Ad-linked analytics is the main contact point. This is educational, not legal advice.
What this means
The TDPSA applies to persons doing business in Texas that process or sell personal data, with applicability turning notably on whether the entity qualifies as a small business under the US Small Business Administration definition rather than a fixed number of consumers. It follows the now-common state model of controller and processor roles, consumer rights, opt-outs, and required consent for processing sensitive data.
Rights and the small-business twist
Texas residents can access, correct, delete, and obtain a copy of their data, and opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. The TDPSA also requires recognising universal opt-out preference signals. Because applicability hinges on the small-business test, the threshold analysis differs from numeric-record states. For analytics, the practical line is whether identifiers flow into targeted advertising or sale.
- Access, correct, delete, portability, and opt-out rights
- Small-business (SBA) applicability test, not a record count
- Must recognise universal opt-out preference signals
How it appears in analytics and logs
If analytics shares Texas residents' data for targeted advertising, sale, or certain profiling, the TDPSA's opt-out rights apply to that processing.
Diagnostic use case
Check whether analytics feeds targeted advertising, sale, or profiling of Texas residents, since the TDPSA grants opt-out rights over those activities.
What WebmasterID can help detect
WebmasterID is first-party and does not share identifiers for targeted advertising, sale, or profiling, the activities the TDPSA's opt-outs cover.
Common mistakes
- Assuming a numeric record threshold like other state laws.
- Ignoring the duty to honour universal opt-out signals.
- Overlooking sensitive-data consent requirements.
Privacy and accuracy notes
This page is educational, not legal advice. First-party, non-shared analytics keeps you away from the TDPSA's targeted-advertising and sale opt-outs.
Related pages
- US state privacy laws overview
In the absence of a single federal privacy statute, several US states have enacted comprehensive consumer privacy laws with overlapping but non-identical rules. Most grant access, deletion, and correction rights and require opt-outs for targeted advertising and 'sale'. This page gives an educational overview of the common pattern and how it touches analytics.
- Utah Consumer Privacy Act (UCPA)
The Utah Consumer Privacy Act (UCPA), effective December 31, 2023, gives Utah consumers rights to access, delete, and obtain a copy of their data, and to opt out of targeted advertising and the sale of personal data. It is widely seen as the most business-leaning of the US state laws — for example it does not provide a right to correct. Analytics tied to targeted advertising or sale is the main contact point. This is educational, not legal advice.
- The Global Privacy Platform (GPP)
The Global Privacy Platform (GPP) is an IAB Tech Lab specification that transmits a user's consent and privacy choices across the digital advertising supply chain using a single, extensible container. Instead of separate strings per regulation, GPP bundles section-specific signals — for example US state strings and the EU TCF — into one encoded value. This page explains the container model.
- Privacy-first analytics
First-party measurement avoids targeted-ad and sale triggers.
Sources and verification notes
- Texas Legislature — Data Privacy and Security Act (HB 4)Official bill history and text. Educational, not legal advice.
Last reviewed 2026-06-24. Facts are checked against primary/official sources where available; uncertain specifics are marked “Data not yet verified” rather than guessed.