TDPSA Compliance: The Texas Data Privacy and Security Act, Handled
Texas's privacy law has no revenue threshold — it reaches almost every business that isn't a small business. ConsentPixel makes compliance a one-pixel install.
The Texas Data Privacy and Security Act (TDPSA) gives Texas residents control over their personal data — and it applies far more broadly than most state privacy laws because it has no revenue or data-volume threshold. ConsentPixel — Privacy · Verified handles opt-outs, universal opt-out signals, privacy documents, and audit-ready logs so TDPSA compliance is one pixel away.
What is the TDPSA?
The Texas Data Privacy and Security Act is Texas's comprehensive consumer privacy law. It took effect on July 1, 2024, with its universal opt-out requirement following on January 1, 2025. The law grants Texas residents rights over their personal data and imposes obligations on businesses that handle it.
What makes the TDPSA unusual is its applicability test. Most US state privacy laws apply only above certain revenue or consumer-count thresholds. The TDPSA instead applies to any business that operates in Texas or targets Texas residents and processes personal data — unless it qualifies as a small business under the federal Small Business Administration definition (generally fewer than 500 employees). Even small businesses must get opt-in consent before selling sensitive data.
The TDPSA follows an opt-out model for general personal data and an opt-in model for sensitive data. Crucially, it requires businesses to recognize universal opt-out signals like Global Privacy Control.
Who must comply
- Businesses that conduct business in Texas or produce products or services consumed by Texas residents, and that process or sell personal data.
- The law applies regardless of revenue or number of consumers — there is no numeric threshold.
- Small businesses (per the SBA definition) are largely exempt, except they still need opt-in consent to sell sensitive data.
- Standard exemptions apply (HIPAA, GLBA, and similar).
What the TDPSA requires
- Privacy notice: Provide a clear, accessible privacy notice describing data practices and consumer rights.
- Consumer rights: Honor access, correction, deletion, portability, and opt-out of sale, targeted advertising, and certain profiling — within 45 days.
- Opt-out of sale & targeted advertising: Provide clear opt-out mechanisms.
- Universal opt-out signals: Recognize signals like GPC as a valid opt-out (effective Jan 1, 2025).
- Sensitive data consent: Obtain opt-in consent before processing sensitive personal data, including data from children under 13.
- Data protection assessments: Conduct assessments for higher-risk processing.
The Texas Attorney General has exclusive enforcement authority — there is no private right of action. Businesses get a 30-day cure period, and violations can carry civil penalties of up to $7,500 each.
How ConsentPixel makes you TDPSA-compliant
ConsentPixel — Privacy · Verified sits between your visitors and your trackers. It detects what's running, presents a geo-aware consent banner, enforces the visitor's choice, and keeps an immutable record of every decision. Here's how that maps to your obligations:Geo-aware opt-out model. Texas visitors get the opt-out experience the TDPSA requires, with sensitive-data categories gated behind opt-in consent — and GPC honored as the universal opt-out the law mandates from Jan 2025.
Auto-detecting scanner finds every cookie and tracker on your site, so your disclosures and consent categories are complete and accurate — not guesswork.
Signal passthrough drives Google Consent Mode v2, Microsoft UET, Meta Pixel, and IAB TCF 2.3 from a single consent event, so every platform respects the same choice.
GPC honoring recognizes Global Privacy Control opt-out signals and applies them automatically.
Document generator auto-creates Privacy Policy, Cookie Policy, Terms, and DPA documents to support your transparency obligations.
Immutable, tamper-evident logs record every consent decision — audit-ready proof of what each visitor saw and chose.
One pixel, under 5 minutes. Everything above ships from a single pixel install, with a public trust badge and verification page.
Why ConsentPixel
- Auto-detection ensures opt-outs actually suppress the right trackers, not just display a banner.
- One pixel handles opt-outs, GPC, documents, and signals together.
- Audit-ready logs give defensible proof for the Texas AG's exclusive enforcement.
- Multi-regulation: the same install covers other state laws your visitors fall under.
Frequently asked questions
Does the TDPSA apply to small businesses?
Mostly no. Small businesses as defined by the federal Small Business Administration are largely exempt — but even they must obtain opt-in consent before selling sensitive personal data.
Is there a revenue threshold for the TDPSA?
No. Unlike most state privacy laws, the TDPSA has no revenue or consumer-count threshold. It applies based on doing business in Texas or targeting Texas residents, with the small-business carve-out being the main limit.
Do I have to honor GPC under the TDPSA?
Yes. As of January 1, 2025, the TDPSA requires businesses to recognize universal opt-out signals such as Global Privacy Control. ConsentPixel honors GPC automatically.
What are the penalties for violating the TDPSA?
The Texas Attorney General can seek civil penalties of up to $7,500 per violation after a 30-day cure period. There is no private right of action.
How fast must I respond to consumer requests?
Generally within 45 days, with the possibility of an extension. ConsentPixel's logs help you track and demonstrate timely handling.
The bottom line
Because the TDPSA skips the revenue threshold most state laws rely on, it sweeps in far more businesses — if you're not an SBA-defined small business and you reach Texans, you're likely in scope. A geo-aware opt-out layer that honors GPC and logs every decision is the most efficient way to comply.
Make TDPSA compliance a one-pixel job
Install ConsentPixel to serve Texas visitors the right opt-out model, honor GPC, generate your privacy documents, and keep audit-ready logs.
Scan your site free Start free trialThis page is informational and is not legal advice. The TDPSA is a Texas state law; consult qualified counsel for advice on your specific obligations.