About Us
ComplyTexas is specifically centered around regulatory compliance connected directly to your business's operating license and consumer-facing requirements.
Social Account
ComplyTexas is specifically centered around regulatory compliance connected directly to your business's operating license and consumer-facing requirements.
In Texas, consumer protection isn’t just a promise—it’s a priority backed by law. The Texas Data Privacy and Security Act (TDPSA) dramatically shifts how businesses must handle personal information, requiring explicit transparency about what data is collected, why it’s collected, and exactly how it’s used and shared. With tough enforcement, significant fines, and a clear consumer-first approach, the TDPSA sends a message to every business operating in Texas: Mishandling Texans’ data isn’t just bad business—it’s now against the law.
The Texas Data Privacy and Security Act (TDPSA) (H.B. No. 4) is a state law that regulates how businesses collect, use, share, and process personal data belonging to Texas consumers. It requires clear, accessible privacy notices explaining what personal data is collected, how it is used, and with whom it is shared or sold. It also gives consumers enforceable rights to access, correct, delete, and restrict the use of their personal information—including the right to opt out of data sales, targeted advertising, and profiling.
Signed into law on June 18, 2023, the TDPSA took effect July 1, 2024, with a mandatory universal opt‑out mechanism required by January 1, 2025. Non‑compliance carries civil penalties of up to $7,500 per violation, enforced exclusively by the Texas Attorney General. For businesses handling consumer data, every disclosure, omission, or misstep could carry a financial cost—and regulatory exposure that multiplies fast.
Unlike other state regulations, the TDPSA doesn’t have a minimum revenue threshold. This means businesses of any size can fall under its jurisdiction based solely on how much consumer data they handle.
In practice, virtually all businesses, including small or medium-sized businesses, must assume full compliance obligations if they:
Practically speaking, if your business has any form of digital or physical presence that touches consumer data—whether via websites, social media, apps, email marketing tools, customer relationship management (CRM) systems, advertising networks, analytics platforms, or third-party integrations—the TDPSA applies directly to you.
Even small businesses and sole proprietors, who may initially assume exemption based on their size, often face full compliance requirements. While the law provides limited carve-outs, these apply only in very narrow circumstances and rarely relieve businesses from the Act’s core duties.
By January 1, 2025, businesses must provide an accessible universal opt-out mechanism, such as a clear online “Do Not Sell or Share My Data” tool.
Under TDPSA, covered businesses must:
1. Clearly Inform Consumers: Provide clear, accessible privacy notices detailing all data collection activities, purposes, third-party sharing or sales, and instructions for consumers to exercise their privacy rights (§541.102).
2. Notice and Consent
Businesses must offer clear, accessible privacy notices explaining precisely:
3. Adopt Transparent Opt-Out Mechanisms: By January 1, 2025, businesses must offer consumers a clear, universal method to opt out of data sales, targeted ads, and profiling.
4. Limit Data Collection and Use
Under the TDPSA, businesses are required to:
5. Secure Consumer Data:
The TDPSA requires implementation of reasonable security measures, including:
6. Data Protection Assessments (DPAs)
If your business engages in high-risk data practices—such as targeted advertising, selling personal data, or consumer profiling—you must regularly conduct and document formal Data Protection Assessments (DPAs). These assessments must clearly outline potential privacy risks and steps taken to mitigate them.
Controllers must respond to authenticated consumer requests within 45 days, with one allowable 45-day extension for complexity, provided notice is given (§541.052(b)). Denial of requests mandates written justification and clear instructions for appeal (§541.052(c)-(d)).
7. Respond to consumer rights requests within 45 days, with one allowable 45-day extension for complexity, provided notice is given (§541.052(b)). Denial of requests mandates written justification and clear instructions for appeal (§541.052(c)-(d)).
Compliance involves several critical areas, all rigorously enforced by Texas regulators. Under TDPSA, covered businesses must:
Right to Opt-Out of ((§541.051(b)(5)):
Businesses must inform consumers how to exercise these rights and must not discriminate against consumers for exercising their rights (§541.101(b)(3)).
The TDPSA prohibits several practices, including:
The TDPSA expressly prohibits businesses from discriminating against consumers who exercise their data privacy rights. Any differential pricing, denial of goods or services, or reduction in service quality based on consumers asserting their privacy rights is illegal, except under narrowly defined loyalty or discount programs clearly disclosed to consumers.
Transparency is non-negotiable under TDPSA. Businesses acting as controllers (entities determining data processing purposes) must deliver concise, easily accessible privacy notices detailing:
TDPSA enforcement is serious business—and the Attorney General has the exclusive authority to enforce it (§ 541.151). Here’s what that means practically:
Companies engaging in targeted advertising or selling data to third parties must provide conspicuous opt-out methods directly within these privacy notices.
The Attorney General identifies noncompliant businesses through:
Before pursuing enforcement action, the Attorney General must issue written notice to the noncompliant entity, specifying alleged violations. Businesses then have a 30-day period to cure identified violations. To properly “cure,” businesses must:
If a violation persists after the cure period, or if the entity breaches assurances provided to the Attorney General, enforcement actions may be initiated.
TDPSA enforcement is serious business—and the Attorney General has the exclusive authority to enforce it. Here’s what that means practically:
Entities failing to comply after the allotted cure period, or violating assurances given to the Attorney General, face:
Given these severe penalties, TDPSA enforcement actions could be financially devastating and even existential threats for businesses—particularly for those with repeated or systemic non-compliance.
A small Texas-based retailer uses a third-party CRM to store customer email addresses and purchase histories, advertises via targeted ads on Facebook or Instagram, and uses Google Analytics on its website. Even if it never directly “sells” this data, it must still comply with TDPSA. Why?
Therefore, small businesses are almost always subject to TDPSA’s stringent data protection and compliance requirements due to common tools, integrations, and modern digital business practices.
The TDPSA explicitly acknowledges affiliate and third-party risks. Businesses that engage with third-party services, affiliates, vendors, or partners must ensure their contractual agreements reflect clear TDPSA compliance obligations. Failure of a processor or third party can expose the primary business to significant legal and financial liability if the controller knew or should have reasonably known about potential non-compliance (§541.203).
**Given the TDPSA’s broad conditions, small businesses that believe they may qualify for exemption are strongly advised to directly consult with the Texas Attorney General’s Office to confirm their compliance obligations. Virtually any online presence, customer management software usage, or sharing consumer data with third parties likely triggers full compliance obligations. Misinterpretation of the law’s scope can lead to severe regulatory penalties.
The passage of TDPSA represents a profound recalibration of business obligations toward consumer data protection in Texas. It mandates that businesses rethink their data practices, placing transparency, consumer control, and robust security at the forefront. With stringent oversight from the Attorney General’s office, Texans can look forward to greater empowerment and stronger assurances that their data will no longer be mishandled, commodified, or processed without clear consent.
To avoid regulatory actions, businesses must immediately evaluate their data practices, update privacy disclosures, ensure consumer rights mechanisms are operational, and verify third-party compliance. Compliance is no longer a best practice—it’s Texas law.
Businesses that prioritize compliance will not only protect their customers—they’ll protect their bottom line and reputation as well.
