Crawls the web, in Texas

Tex. Penal Code § 33.02 · Read the law's page

• Accessing a Texas-connected computer, computer network, or computer system without the effective consent of the owner is a criminal offense regardless of your intent (Tex. Penal Code § 33.02(a)).
• A more serious offense applies when you access a government- or business-owned system in violation of a clear and conspicuous posted prohibition, or a contract you expressly agreed to, combined with intent to defraud or harm someone or to alter, damage, or delete their data; a posted no-scraping notice or a clickwrap agreement carries real legal weight once paired with that intent.
• Ordinary commercial data collection without fraudulent or harmful intent is not elevated to the more serious offense by a posted prohibition alone.

Tex. Bus. & Com. Code sec. 521.052 · Read the law's page

• This binds any business that collects or maintains sensitive personal information (an individual's name combined with a Social Security number, driver's license or government-issued identification number, or a financial account, credit, or debit card number together with any required access code; or information that identifies an individual and relates to the individual's physical or mental health, health care, or payment for health care) in the regular course of business; a financial institution as defined by 15 U.S.C. § 6809 is exempt.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect that sensitive personal information from unlawful use or disclosure. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable through any means.
• There is no private right of action for a violation of this duty; only the attorney general may enforce it, seeking a civil penalty of $2,000 to $50,000 per violation and injunctive relief under Section 521.151.

Tex. Bus. & Com. Code Ch. 541 · Read the law's page

• TDPSA applies to you if you do business in Texas or produce a product or service consumed by Texas residents and you process or sell personal data, unless you qualify as a small business under U.S. Small Business Administration size standards, which vary by industry rather than a fixed revenue or consumer-count number.
• Personal data excludes deidentified data and publicly available information, meaning information lawfully available through government records or that you have a reasonable basis to believe is lawfully available to the public through widely distributed media, the consumer, or someone the consumer disclosed it to.
• Even if you qualify as a small business, you may not sell sensitive personal data without the consumer's prior consent.

Tex. Bus. & Com. Code ch. 542 (secs. 542.001-542.004) · Read the law's page

• This chapter applies only to a business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information, as those terms are defined by Section 521.002.
• It is a safe harbor, not a duty: if such an entity is sued over a breach of system security and demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program meeting Section 542.004's requirements, the claimant may not recover exemplary damages from it. A qualifying program must contain administrative, technical, and physical safeguards; conform to a named industry-recognized cybersecurity framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000-series, the HITRUST Common Security Framework, the Secure Controls Framework, SOC 2, or a similar framework); and be scaled by headcount: simplified measures such as password policies and employee training below 20 employees, the CIS Controls Implementation Group 1 from 20 to 99 employees, and full conformance with a named framework from 100 to 249 employees.
• The chapter creates no duty to adopt a program and no cause of action of its own; it only removes exemplary-damages exposure for a qualifying entity that already has one at the time of a breach.

Tex. Bus. & Com. Code § 503.001 · Read the law's page

• The mere existence of an image or other media containing someone's biometric identifiers on the Internet or another publicly available source does not, by itself, count as that person's informed consent to your capturing or storing their biometric identifier for a commercial purpose, unless they themselves made that image or media publicly available.
• A 2025 amendment (HB 149, TRAIGA) exempts the training, processing, or storage of biometric identifiers to develop, train, evaluate, disseminate, or otherwise offer an artificial intelligence system, unless the system is used or deployed to uniquely identify a specific individual.
• Only the Texas Attorney General may sue under this Act, for a civil penalty of up to $25,000 per violation; there is no private right of action, unlike Illinois's BIPA.