Processes biometric data, in Texas

Tex. Bus. & Com. Code sec. 521.052 · Read the law's page

• This binds any business that collects or maintains sensitive personal information (an individual's name combined with a Social Security number, driver's license or government-issued identification number, or a financial account, credit, or debit card number together with any required access code; or information that identifies an individual and relates to the individual's physical or mental health, health care, or payment for health care) in the regular course of business; a financial institution as defined by 15 U.S.C. § 6809 is exempt.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect that sensitive personal information from unlawful use or disclosure. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable through any means.
• There is no private right of action for a violation of this duty; only the attorney general may enforce it, seeking a civil penalty of $2,000 to $50,000 per violation and injunctive relief under Section 521.151.

Tex. Bus. & Com. Code sec. 503.001, as amended by Tex. HB 149, 89th Legislature (2025) · Read the law's page

• Inform an individual and obtain consent before capturing their retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry for a commercial purpose in Texas.
• Do not treat an individual's biometric identifiers appearing in publicly available online media as consent to capture them unless that individual made the media publicly available themselves.
• Do not sell, lease, or disclose a captured biometric identifier except for the narrow statutory exceptions covering identification of a missing or deceased person, a requested financial transaction, legal compulsion, or a law enforcement warrant.
• Store and transmit a captured biometric identifier with reasonable care equal to or exceeding the protection given your other confidential information, and destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.
• Confirm any AI training use of biometric identifiers stays within the training, processing, or evaluation exemption. It ends once the AI system is deployed to uniquely identify a specific individual.

Tex. Bus. & Com. Code secs. 541.001, 541.101(b)(4) · Read the law's page

• Obtain a Texas consumer's opt-in consent before processing sensitive data, including biometric or genetic data collected to uniquely identify the individual, racial or ethnic origin, religious belief, a health diagnosis, sexuality, immigration status, or precise geolocation.
• Follow the Children's Online Privacy Protection Act's consent framework, not TDPSA's general consent rule, when processing a known child's sensitive data.
• Do not treat an identifier derived solely from a photograph, or from a video or audio recording, as TDPSA biometric data requiring this consent. The statutory definition excludes recording-derived data.

Tex. Bus. & Com. Code ch. 542 (secs. 542.001-542.004) · Read the law's page

• This chapter applies only to a business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information, as those terms are defined by Section 521.002.
• It is a safe harbor, not a duty: if such an entity is sued over a breach of system security and demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program meeting Section 542.004's requirements, the claimant may not recover exemplary damages from it. A qualifying program must contain administrative, technical, and physical safeguards; conform to a named industry-recognized cybersecurity framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000-series, the HITRUST Common Security Framework, the Secure Controls Framework, SOC 2, or a similar framework); and be scaled by headcount: simplified measures such as password policies and employee training below 20 employees, the CIS Controls Implementation Group 1 from 20 to 99 employees, and full conformance with a named framework from 100 to 249 employees.
• The chapter creates no duty to adopt a program and no cause of action of its own; it only removes exemplary-damages exposure for a qualifying entity that already has one at the time of a breach.

Tex. Health & Safety Code secs. 174.003, 174.005 · Read the law's page

• If you are a medical facility, research facility, company or nonprofit organization that conducts research on or testing of genome sequencing or the human genome in Texas, do not use a genome sequencer or software produced by or on behalf of a foreign adversary, a state-owned enterprise of a foreign adversary, an organization domiciled in a country that is a foreign adversary, or an owned or controlled subsidiary or affiliate of such an organization (Tex. Health & Safety Code secs. 174.003, 174.005).
• Certify to the attorney general not later than December 31 of each year that you are in compliance with chapter 174, through an attorney who submits the certification where one represents you (Tex. Health & Safety Code sec. 174.008).

Tex. Bus. & Com. Code § 503.001 · Read the law's page

• The mere existence of an image or other media containing someone's biometric identifiers on the Internet or another publicly available source does not, by itself, count as that person's informed consent to your capturing or storing their biometric identifier for a commercial purpose, unless they themselves made that image or media publicly available.
• A 2025 amendment (HB 149, TRAIGA) exempts the training, processing, or storage of biometric identifiers to develop, train, evaluate, disseminate, or otherwise offer an artificial intelligence system, unless the system is used or deployed to uniquely identify a specific individual.
• Only the Texas Attorney General may sue under this Act, for a civil penalty of up to $25,000 per violation; there is no private right of action, unlike Illinois's BIPA.