What does the Texas Data Privacy and Security Act mean for advertising?
Part of US and Canada targeting
The short answer
The Texas Data Privacy and Security Act, in effect since July 1, 2024, lets Texas residents opt out of targeted advertising, sale and certain profiling. It covers businesses serving Texans that process personal data and are not small businesses under the SBA's definition. Ads based on the current search or visit are excluded, and only the Attorney General enforces it.
Key takeaways
- Chapter 541 of the Business and Commerce Code took effect July 1, 2024, with the authorized agent technology rule in section 541.055(e) following on January 1, 2025.
- Texas has no consumer count threshold: the act reaches a person serving Texans that processes or sells personal data, unless it is a small business as the SBA defines one.
- Small businesses are generally exempt but still need prior consent to sell sensitive data, under section 541.107.
- Processing for targeted advertising triggers a documented data protection assessment that the Attorney General can demand.
- The Attorney General has exclusive enforcement authority, a 30 day cure notice with no sunset, and penalties up to $7,500 per violation.
What does the Texas Data Privacy and Security Act say about targeted advertising?
House Bill 4 of the 88th Legislature added Chapter 541 to the Business and Commerce Code (opens in a new tab). The Texas State Law Library (opens in a new tab) says the law became effective July 1, 2024 and that section 541.055(e) went into effect January 1, 2025. Section 541.051 gives a consumer the right to opt out of processing for targeted advertising, for the sale of personal data, and for profiling in furtherance of a decision with legal or similarly significant effects.
Definition
- Targeted advertising (section 541.001)
- Displaying to a consumer an advertisement selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict the consumer's preferences or interests.
Texas words the definition around data "obtained from" activity, where Colorado and Maryland also cover data inferred from it. The exclusions match theirs: ads based on activity within the controller's own sites or apps, ads based on the context of the current search query, website visit or app, ads sent in response to the consumer's request, and processing solely to measure or report performance, reach or frequency.
| Section | Duty | What triggers it |
|---|---|---|
| 541.051(b)(5) | Honor an authenticated request to opt out of targeted advertising, sale or certain profiling | A consumer request |
| 541.103 | Clearly and conspicuously disclose the processing and how to opt out | Selling personal data to third parties or processing it for targeted advertising |
| 541.102(b) | Post the notice "NOTICE: We may sell your sensitive personal data." | Selling sensitive data |
| 541.105(a)(1) | Conduct and document a data protection assessment | Processing personal data for targeted advertising |
| 541.055(a) | Offer two or more secure and reliable request methods | Being a controller under the chapter |
| 541.055(e) | Comply with opt outs sent by an authorized agent, including through a browser setting or extension | From January 1, 2025, subject to four listed exceptions |
The assessment duty is where advertising meets paperwork. Section 541.105 requires the assessment to weigh benefits to the controller, consumer and public against risks to the consumer, and to factor in deidentified data, consumers' reasonable expectations, the context of the processing and the relationship with the consumer. An assessment done for another state's law can count if it has reasonably comparable scope and effect.
Who must comply with the Texas law?
Section 541.002 says the chapter applies only to a person that meets all three conditions: it conducts business in Texas or produces a product or service consumed by Texas residents; it processes or engages in the sale of personal data; and it is not a small business as defined by the United States Small Business Administration. The Texas Attorney General's overview (opens in a new tab) restates the test in the same terms.
Section 541.002(b) then excludes state agencies and political subdivisions, financial institutions or data subject to Title V of the Gramm Leach Bliley Act, HIPAA covered entities and business associates, nonprofit organizations, institutions of higher education, and certain electric utilities and retail electric providers. The nonprofit exclusion is a point where Texas text departs from states that cover nonprofits.
How is the Texas small business rule different?
Colorado and Maryland draw their line with consumer counts set in their statutes: 100,000 consumers in Colorado and 35,000 in Maryland. Texas sets no count. It borrows the federal small business definition instead, so the question becomes how large the business is, not how many Texans' records it holds.
Size standards vary by industry and are generally based on the number of employees or the amount of annual receipts the business has.
The SBA assigns a size standard to each NAICS industry code, set out in 13 CFR 121.201, and counts the employees or receipts of all affiliates. The same SBA page says most manufacturing companies with 500 employees or fewer, and most non-manufacturing businesses with average annual receipts under $7.5 million, will qualify as small, with exceptions by industry. The SBA page frames these standards for government contracting; Texas imports the definition by reference.
| Question | Texas, section 541.002 | Volume threshold states, for example Colorado 6-1-1304 |
|---|---|---|
| What is measured | The business's size under the SBA definition for its industry | The number of state residents whose personal data is processed |
| Who can fall outside | A business that is small under the SBA standard, whatever its data volume | A business under the count, whatever its size |
| What still applies to those outside | Prior consent to sell sensitive data (541.107) | None of the act's general duties |
| How a team checks it | Industry code, employees or receipts, and affiliates | Annual count of residents' records |
How has the Texas Attorney General enforced the law?
Section 541.151 gives the Attorney General exclusive authority, and section 541.156 rules out a private right of action. Under section 541.153 the Attorney General may issue a civil investigative demand and request any relevant data protection assessment. Section 541.155 sets civil penalties up to $7,500 for each violation, plus injunctions and reasonable attorney's fees and expenses.
The Texas enforcement sequence in Chapter 541
- Investigate. The Attorney General may issue a civil investigative demand on reasonable cause and ask for data protection assessments.
- Give written notice. At least 30 days before suing, the Attorney General must identify in writing the specific provisions allegedly violated.
- Allow the cure. No action may be brought if the person cures within 30 days and gives a written statement covering the cure, consumer notice where contact details exist, documentation and any policy changes.
- Sue for penalties. A violation after the cure period, or a breach of the written statement, carries up to $7,500 per violation.
Unlike Colorado's and Maryland's cure provisions, the Texas cure step carries no repeal date in the text checked. On January 13, 2025 (opens in a new tab) the Attorney General announced a suit against Allstate and its subsidiary Arity, alleging that location and movement data from software embedded in mobile apps was collected and sold without notice or consent. The release called it the first enforcement action filed by a state attorney general under a comprehensive data privacy law. These are allegations at filing; this page does not report an outcome.
Does the Texas law affect contextual advertising?
The definition excludes an advertisement based on the context of a consumer's current search query, visit to a website or online application, so an ad placed because the page matches the product is not targeted advertising under section 541.001. The opt out right, the disclosure in section 541.103 and the assessment in section 541.105(a)(1) all hang on that defined term. The contextual targeting page explains the placement method.
The exclusion does not reach the rest of the impression. Sale of personal data, measurement that goes beyond performance, reach or frequency, and sensitive data such as precise geolocation have their own provisions, and the Allstate complaint concerned location data and its sale, not ad selection.
Facts to record for a Texas line item
- Placements were chosen from page or search context, with no cross site history.
- No precise geolocation or other sensitive data is used or passed to a partner.
- Measurement identifiers are used only for performance, reach or frequency reporting.
- The advertiser's privacy notice discloses any targeted advertising or sale and how to opt out.
- The advertiser has recorded whether it is a small business under its SBA size standard.
What does a Texas review look like for a small seller?
Fictional example. Unnamed brand, no results implied.
An Oklahoma pecan grower plans a holiday flight into Texas
An unnamed family pecan grower near Tulsa, Oklahoma sells gift boxes online and plans a November display flight for buyers in Dallas and Houston, beside holiday baking, pie recipes and food gift guides. The owner believes the business is small, and the agency asks how Chapter 541 fits the plan.
The planner records three facts. The site list comes from article content, which the definition excludes from targeted advertising. The grower's size question turns on its SBA standard and affiliates, which the grower confirms from its own records. And even if exempt, the grower sells no sensitive data, so section 541.107 has nothing to attach to. The publishers and platforms in the buy are noted as separate parties that apply the test to themselves.
How does PlacementGraph build a context based site list for a Texas plan?
The line in that plan chosen from article content is the piece PlacementGraph builds.
Frequently asked questions
Are nonprofits covered by the Texas Data Privacy and Security Act?
Section 541.002(b) lists nonprofit organizations among the entities the chapter does not apply to, together with institutions of higher education, state agencies, Gramm Leach Bliley financial institutions, HIPAA covered entities and certain electric utilities. The Attorney General's overview lists the same exemptions.
Does a business operating only online need a request web form in Texas?
Section 541.055 requires two or more request methods, but a controller that operates exclusively online and has a direct relationship with the consumer is only required to provide an email address for requests for disclosed information. It may not require a new account to exercise rights.
How many free data requests does a Texan get?
Two a year. The Attorney General's overview says a company's response must be free of charge up to twice annually per consumer, unless the request is unfounded, excessive or repetitive, in which case a reasonable administrative cost may be charged. Responses are due within 45 days, extendable once by 45 days.
Does the Texas law treat pseudonymous data differently?
Section 541.106 says access, correction, deletion and portability rights and the controller duties in section 541.101 do not apply to pseudonymous data where the controller shows the identifying information is kept separately under effective controls. The opt out right in section 541.051(b)(5) is not in that list.
Sources
- Business and Commerce Code, Chapter 541, Consumer Data Protection (opens in a new tab)Texas Legislature
- Texas Data Privacy and Security Act (opens in a new tab)Office of the Texas Attorney General
- Texas Data Privacy and Security Act (July 25, 2024) (opens in a new tab)Texas State Law Library
- Attorney General Ken Paxton sues Allstate and Arity (January 13, 2025) (opens in a new tab)Office of the Texas Attorney General
- Get started with contracting: size standards (opens in a new tab)US Small Business Administration
- Senate Bill 21-190, Colorado Privacy Act (opens in a new tab)Colorado General Assembly
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.