Key Facts
Overview
The TDPSA is the broadest US state privacy law in terms of applicability — it has no revenue thresholds and no minimum consumer data volume thresholds. Any non-small-business (as defined by the SBA) that processes personal data of Texas residents must comply, capturing far more businesses than any other state law.
What This Means for Your Website
- GPC signals must be honored since January 2025
- Opt-in consent is required for sensitive data
- No revenue or consumer volume thresholds — nearly all businesses are subject
- Only SBA-defined small businesses are exempt (but cannot sell sensitive data)
- A permanent 30-day cure period applies before enforcement
- Consumer requests must be fulfilled within 45 days
Key Requirements
The Texas AG enforces the TDPSA with penalties up to $7,500 per violation. The law's breadth is unique — it applies to individuals as well as businesses, with only SBA-defined small businesses exempt. GPC/UOOM signal honoring has been mandatory since January 2025. Data protection assessments are required for high-risk processing.
How ConsentStack Handles This
ConsentStack detects Texas visitors, honors GPC signals automatically, and applies the TDPSA's opt-out model with opt-in for sensitive data — ensuring compliance with the broadest US state privacy law.
Penalties
Up to $7,500 per violation.
Key Requirements
- Honor GPC/universal opt-out signals since January 2025
- Opt-in consent for sensitive data
- Privacy notice with required disclosures
- Consumer rights: access, correct, delete, portability, opt-out
- Data protection assessments for high-risk processing
Notable Provisions
- Broadest applicability — no revenue or consumer volume thresholds
- GPC/UOOM honored since January 2025
- Applies to individuals as well as businesses
- Small businesses cannot sell sensitive data
US State Specifics
Other North America Regulations
Frequently Asked Questions
Why is the TDPSA considered the broadest US state privacy law?
The TDPSA has no revenue or consumer volume thresholds — any non-small-business processing Texas residents' data must comply, capturing far more businesses than any other state.
Must websites honor GPC signals in Texas?
Yes, since January 2025. ConsentStack automatically detects and honors GPC signals for Texas visitors.
Does the TDPSA have a cure period?
Yes. A permanent 30-day cure period applies, giving businesses time to fix violations before enforcement action.
What are the TDPSA penalties?
Up to $7,500 per violation, enforced by the Texas Attorney General.
Stay compliant with TDPSA
ConsentStack helps you implement Opt-out consent for Texas, United States automatically.