language: en · status: in-force · last checked: 2026-09-07

Texas CUBI — capture or use of biometric identifier

Chapter 503 of the Texas Business & Commerce Code, a single section, is the Texas biometric-privacy statute. A person may not capture a biometric identifier of an individual for a commercial purpose unless the person informs the individual beforehand and receives their consent; a person who possesses such an identifier owes duties of non-disclosure, reasonable care in storage and destruction within a set period. The civil penalty is up to $25,000 per violation, recoverable by the Attorney General — there is no private right of action, which is the sharpest practical difference from Illinois BIPA.

The text in this folder is the version as amended by the Texas Responsible Artificial Intelligence Governance Act (H.B. 149, 89th Legislature, 2025), in force 1 January 2026, which added subsection (b-1) on publicly available media and the artificial-intelligence carve-outs in (e) and (f).

Applicability to EdTech

• A "biometric identifier" expressly includes "a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry" (BIOMETRIC-IDENTIFIERS.md#sec-503-001, (a)(2)). Headset eye tracking, hand tracking and camera-based face or voice features are squarely within the defined terms — the statute's own list, not an inference.
• The gate is capture "for a commercial purpose" with prior notice and consent, and the consent must be genuine: (b-1) provides that the mere existence of media containing an individual's biometric identifiers on the Internet is not notice or consent unless the individual themselves made it publicly available.
• Destruction is on a clock: within a reasonable time and not later than the first anniversary of the date the purpose for collecting the identifier expires ((c)(3)), with a longer period only where another law requires the associated document to be retained ((c-1)).
• The 2025 amendments matter for AI features: training, processing or storage of biometric identifiers for developing or offering AI models is outside the section unless a system is used or deployed for the purpose of uniquely identifying a specific individual ((e)(2)) — and if identifiers captured for training are later used for a commercial purpose outside those carve-outs, the possession, destruction and penalty provisions apply ((f)).
• CUBI does not stand alone from 1 January 2026: a violation of §503.001 is also a violation of TRAIGA Chapter 552 (TRAIGA §552.054(c)), which carries its own, higher penalties.

Contents

Key obligations at a glance

• Notice before capture, and consent to capture, for any commercial-purpose capture — §503.001(b).
• No sale, lease or disclosure except in the four listed cases — §503.001(c)(1).
• Storage protection at least as protective as for the possessor's other confidential information — §503.001(c)(2).
• Destruction within a reasonable time, no later than one year after the collection purpose expires — §503.001(c)(3).

Enforcement

Attorney General only, by an action to recover the civil penalty of not more than $25,000 for each violation (§503.001(d)). The statute creates no private right of action and no class mechanism.

Licence

The reproduced text is Tex. Bus. & Com. Code §503.001, enacted by the Texas Legislature and served by the Texas Legislative Council on statutes.capitol.texas.gov. No copyright subsists in this text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It went on: "judges—and, we now confirm, legislators—may not be considered the 'authors' of the works they produce in the course of their official duties as judges and legislators. That rule applies regardless of whether a given material carries the force of law." (slip opinion, pp. 1 and 5–6, read 2026-10-01.)

The reproduced pages carry no copyright notice or terms of use (checked 2026-10-01 against the live pages or the builder's cached copies).

Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup and anchors only). Nothing here suggests that the Texas Legislature endorses the corpus.

Related

• Texas TRAIGA — §552.054(c) makes a CUBI violation a violation of that chapter; the same Act wrote CUBI's AI carve-outs
• Texas TDPSA — biometric data processed to uniquely identify an individual is "sensitive data" there, requiring consent
• Washington biometric identifiers (RCW 19.375) — the closest sibling regime: irises and retinas in scope, AG-enforced, commercial-purpose gate
• Florida education records — §1002.222 bans school collection of retina/iris scans outright
• Illinois BIPA (740 ILCS 14) — the private-right-of-action biometric regime and the largest US exposure; unlike CUBI, enforcement does not run through the Attorney General

Sources

• Texas Constitution and Statutes — Business & Commerce Code §503.001
• H.B. 149, 89th Legislature, R.S. (2025) — enrolled text (§1 cites the Act as the Texas Responsible Artificial Intelligence Governance Act; §2 amends §503.001)