language: en · status: in-force · last checked: 2026-09-07

Texas Data Privacy and Security Act — Business & Commerce Code Chapter 541

H.B. 4 (88th Legislature, 2023), in force 1 July 2024: the Texas comprehensive consumer-privacy act. It follows the familiar controller/processor structure — consumer rights of access, correction, portability and deletion with opt-outs from sale, targeted advertising and profiling; controller duties of data minimisation, security and transparency; mandatory processor contract terms; and data protection assessments for higher-risk processing. Enforcement is exclusively by the Attorney General.

Texas's distinctive design choice is its applicability test: instead of thresholds counted in consumers or revenue, Chapter 541 applies to any person who conducts business in Texas or produces a product or service consumed by Texas residents, processes or sells personal data, and is not a small business as defined by the U.S. Small Business Administration (§541.002(a)).

Applicability to EdTech

• School districts are out; we are in. §541.002(b)(1) excludes a state agency or a political subdivision of Texas, and (b)(5) excludes institutions of higher education (§541.002(b)). A Texas school district is therefore not a controller under this chapter — but a vendor selling into it is, on the (a) test.
• The FERPA exemption is at the level of the data, not the entity: §541.003(13) exempts "personal data regulated by the Family Educational Rights and Privacy Act of 1974" (§541.003). Student data handled as education records falls out; a vendor's other personal data (teacher accounts, consumer users, marketing contacts, telemetry not covered by FERPA) does not. This is the join to watch, and it is the reason TDPSA is not answered by "we're an EdTech company".
• Biometric data is sensitive data. "Biometric data" covers data generated by automatic measurements of biological characteristics, expressly including an eye retina or iris and any other unique biological pattern used to identify a specific individual, while excluding photographs and video/audio recordings and data generated from them (§541.001(3)). Where such data is "processed for the purpose of uniquely identifying an individual" it is sensitive data (§541.001(29)(B)), and so is any personal data collected from a known child ((29)(C)) and precise geolocation ((29)(D)).
• Sensitive data requires consent — and for a known child, compliance with COPPA in place of consent (§541.101(b)(4)).
• §541.104 is the procurement-relevant section: the terms a contract between controller and processor must contain (confidentiality, deletion or return, demonstrating compliance, assessments, sub-processor flow-down). Districts' own agreements — typically the NDPA — sit on top of this. Note it was amended by TRAIGA (H.B. 149) with effect from 1 January 2026, so processor terms written against the 2024 text need re-checking against §541.104 as it now stands.
• Data protection assessments are required for the listed processing, including targeted advertising, sale of personal data, certain profiling and processing sensitive data (§541.105).
• Even a small business, otherwise outside the chapter, may not sell sensitive personal data without prior consent (§541.107).

Contents

Key obligations at a glance

• Data minimisation and reasonable security practices appropriate to the data — §541.101(a).
• No processing of sensitive data without consent (COPPA compliance for a known child) — §541.101(b)(4).
• Privacy notice with the enumerated content — §541.102(a).
• Verbatim posted notices where the controller sells sensitive data ("NOTICE: We may sell your sensitive personal data.") or biometric data ("NOTICE: We may sell your biometric personal data.") — §541.102(b)–(c).
• Clear and conspicuous disclosure of any sale of personal data or processing for targeted advertising, with the opt-out method — §541.103.
• Consumer requests answered within 45 days, extendable once by a further 45 — §541.052(b).
• A conspicuous appeal process for refused requests, answered within 60 days, with a route to the Attorney General on denial — §541.053.
• Processor contract terms — §541.104.
• Data protection assessments for the listed processing — §541.105.

Enforcement

The Attorney General has exclusive enforcement authority (§541.151) and there is no private right of action (§541.156). The AG must give written notice identifying the provisions alleged to be violated and may not sue for 30 days, during which cure and a written statement of cure bars the action (§541.154); thereafter the civil penalty is up to $7,500 per violation, plus injunctive relief and the AG's reasonable attorney's fees and expenses (§541.155).

Licence

The reproduced text is Tex. Bus. & Com. Code ch. 541, enacted by the Texas Legislature and served by the Texas Legislative Council on statutes.capitol.texas.gov. No copyright subsists in this text. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It went on: "judges—and, we now confirm, legislators—may not be considered the 'authors' of the works they produce in the course of their official duties as judges and legislators. That rule applies regardless of whether a given material carries the force of law." (slip opinion, pp. 1 and 5–6, read 2026-10-01.)

The reproduced pages carry no copyright notice or terms of use (checked 2026-10-01 against the live pages or the builder's cached copies).

Public-domain text carries no conditions. The corpus attributes it all the same: the {.meta} provenance line on each section names the publisher, the Sources section links the official text, and the Meta section describes what the builder changed (markup and anchors only). Nothing here suggests that the Texas Legislature endorses the corpus.

Related

• Texas Education Code Subchapter D — the student-data regime that governs the FERPA-exempt data
• Texas CUBI — the notice-and-consent gate on capturing biometric identifiers
• Texas TRAIGA — §552.051 borrows this chapter's "dark pattern" definition
• California CCPA/CPRA (minors) — the comprehensive-act sibling with the under-16 opt-in
• EU GDPR — the controller/processor vocabulary this chapter adopts
• SDPC NDPA — the district agreement layered on §541.104's required terms

Sources

• Texas Constitution and Statutes — Business & Commerce Code Chapter 541