Texas Data Privacy and Security Act: Your Rights
Texans can ask companies what they hold, correct it, delete it and opt out of sales and targeted ads.
By Siddharth ShankarUpdated October 22, 2026The Texas Data Privacy and Security Act took effect on July 1, 2024. Texans can ask whether a company processes their personal data, get a copy, correct inaccuracies, delete data and opt out of targeted advertising, sales and certain profiling. Companies must respond within 45 days, with a possible 45-day extension, and must offer two or more request methods. The attorney general enforces the law, with penalties of up to $7,500 per violation and a 30-day cure period, and there is no private right of action.
Before you start opt-outs, see which known data breaches already include your email.
Free · About 30 seconds · No sign-up · Email not stored
Texas has a general consumer privacy law. This guide follows the Texas Attorney General’s own summary.
When it applies
The Texas Data Privacy and Security Act, or TDPSA, took effect on July 1, 2024. It applies to companies that conduct business in Texas or produce a product or service consumed by Texas residents, and that process consumers’ personal data.
Small businesses, as defined by the federal Small Business Administration, are generally exempt, but must obtain consent before selling a consumer’s sensitive data. Six types of entity are exempt, including state agencies, nonprofits, institutions of higher education, and certain financial institutions and HIPAA-regulated entities.
Your rights
Texans may:
- ask whether a company processes their personal data and get a copy in a readable format,
- correct inaccuracies,
- delete their data,
- opt out of targeted advertising, data sales or certain profiling.
Consumers are also protected from retaliation or discrimination for exercising these rights.
Removal is one half of the job. Check whether your email has leaked as well.
Free · About 30 seconds · No sign-up · Email not stored
How requests work
Controllers must offer two or more secure and reliable methods for submitting requests. A company that operates exclusively online and has a direct consumer relationship needs to provide only an email address.
They must respond to an authenticated request without undue delay and no later than 45 days after receiving it. The deadline can be extended by another 45 days if the company responds within the first 45 days and explains why. Responses are free up to twice a year per consumer, unless a request is unfounded, excessive or repetitive.
Enforcement
The Texas Attorney General has exclusive enforcement authority and can seek civil penalties, injunctive relief, attorney’s fees and costs. The page says the Act does not provide a private right of action. Violations carry a civil penalty of up to $7,500 per violation.
Before filing an action, the AG must issue written notice and allow the company 30 days to cure the noticed violations. The company must then provide a written statement and supporting documentation of the cure.
How to file a complaint
Consumers can complain through the Attorney General’s consumer protection website at consumerprotection.texasattorneygeneral.gov. If a company denies a consumer’s appeal, it must tell the consumer how to file a complaint with the Attorney General. The AG’s office cannot provide legal advice to individuals.
A practical way to use your rights
- Find the company’s privacy request page or email address.
- Say that you are a Texas resident, and name the right you want to use.
- Note the date. The 45-day clock starts when the company receives an authenticated request.
- If you are refused, use the appeal route, then complain to the AG.
What the page does not say
The AG’s page does not mention a universal opt-out mechanism or a date for one, so do not rely on a browser signal alone. Use the company’s own form too, and see Global Privacy Control.
Limits
Exemptions are wide. Listings on people-search sites often need separate opt-outs. See how to opt out of data brokers yourself. This is general information, not legal advice.
Sources
- Texas Attorney General: Texas Data Privacy and Security Act (effective date, coverage, rights, deadlines, penalties, cure period, complaints)
Frequently asked questions
When did the Texas privacy law take effect?
July 1, 2024.
What can I ask a company to do?
Confirm whether it processes your data, give you a copy, correct it, delete it and stop selling it or using it for targeted ads.
How long does a company have to respond?
No later than 45 days after receiving an authenticated request, extendable by 45 days with an explanation.
What is the penalty?
Up to $7,500 per violation, after a 30-day cure period.
Can I sue?
The AG’s page says the Act does not provide a private right of action.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.