Trains models, in Texas

Tex. Bus. & Com. Code sec. 521.052 · Read the law's page

• This binds any business that collects or maintains sensitive personal information (an individual's name combined with a Social Security number, driver's license or government-issued identification number, or a financial account, credit, or debit card number together with any required access code; or information that identifies an individual and relates to the individual's physical or mental health, health care, or payment for health care) in the regular course of business; a financial institution as defined by 15 U.S.C. § 6809 is exempt.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect that sensitive personal information from unlawful use or disclosure. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable through any means.
• There is no private right of action for a violation of this duty; only the attorney general may enforce it, seeking a civil penalty of $2,000 to $50,000 per violation and injunctive relief under Section 521.151.

Tex. Bus. & Com. Code sec. 503.001, as amended by Tex. HB 149, 89th Legislature (2025) · Read the law's page

• Inform an individual and obtain consent before capturing their retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry for a commercial purpose in Texas.
• Do not treat an individual's biometric identifiers appearing in publicly available online media as consent to capture them unless that individual made the media publicly available themselves.
• Do not sell, lease, or disclose a captured biometric identifier except for the narrow statutory exceptions covering identification of a missing or deceased person, a requested financial transaction, legal compulsion, or a law enforcement warrant.
• Store and transmit a captured biometric identifier with reasonable care equal to or exceeding the protection given your other confidential information, and destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.
• Confirm any AI training use of biometric identifiers stays within the training, processing, or evaluation exemption. It ends once the AI system is deployed to uniquely identify a specific individual.

Tex. Bus. & Com. Code Ch. 541 · Read the law's page

• TDPSA applies to you if you do business in Texas or produce a product or service consumed by Texas residents and you process or sell personal data, unless you qualify as a small business under U.S. Small Business Administration size standards, which vary by industry rather than a fixed revenue or consumer-count number.
• Personal data excludes deidentified data and publicly available information, meaning information lawfully available through government records or that you have a reasonable basis to believe is lawfully available to the public through widely distributed media, the consumer, or someone the consumer disclosed it to.
• Even if you qualify as a small business, you may not sell sensitive personal data without the consumer's prior consent.

Tex. Bus. & Com. Code ch. 542 (secs. 542.001-542.004) · Read the law's page

• This chapter applies only to a business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information, as those terms are defined by Section 521.002.
• It is a safe harbor, not a duty: if such an entity is sued over a breach of system security and demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program meeting Section 542.004's requirements, the claimant may not recover exemplary damages from it. A qualifying program must contain administrative, technical, and physical safeguards; conform to a named industry-recognized cybersecurity framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000-series, the HITRUST Common Security Framework, the Secure Controls Framework, SOC 2, or a similar framework); and be scaled by headcount: simplified measures such as password policies and employee training below 20 employees, the CIS Controls Implementation Group 1 from 20 to 99 employees, and full conformance with a named framework from 100 to 249 employees.
• The chapter creates no duty to adopt a program and no cause of action of its own; it only removes exemplary-damages exposure for a qualifying entity that already has one at the time of a breach.

Tex. Penal Code § 43.235 · Read the law's page

• Do not knowingly possess, access with intent to view, or promote obscene visual material that appears to depict a child younger than 18 engaging in sexual conduct, whether the depiction is of an actual child, a cartoon or animation, or an AI-generated image.
• Do not use an image of an actual child to train an AI model to produce material that constitutes child pornography.
• Either offense is a state jail felony at minimum, rising to a third-degree felony on one prior conviction under this section or the related child-pornography sections, and a second-degree felony on two or more.

Tex. Bus. & Com. Code § 503.001 · Read the law's page

• The mere existence of an image or other media containing someone's biometric identifiers on the Internet or another publicly available source does not, by itself, count as that person's informed consent to your capturing or storing their biometric identifier for a commercial purpose, unless they themselves made that image or media publicly available.
• A 2025 amendment (HB 149, TRAIGA) exempts the training, processing, or storage of biometric identifiers to develop, train, evaluate, disseminate, or otherwise offer an artificial intelligence system, unless the system is used or deployed to uniquely identify a specific individual.
• Only the Texas Attorney General may sue under this Act, for a civil penalty of up to $25,000 per violation; there is no private right of action, unlike Illinois's BIPA.