Operates a social platform, in Texas

Tex. Bus. & Com. Code sec. 521.052 · Read the law's page

• This binds any business that collects or maintains sensitive personal information (an individual's name combined with a Social Security number, driver's license or government-issued identification number, or a financial account, credit, or debit card number together with any required access code; or information that identifies an individual and relates to the individual's physical or mental health, health care, or payment for health care) in the regular course of business; a financial institution as defined by 15 U.S.C. § 6809 is exempt.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect that sensitive personal information from unlawful use or disclosure. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable through any means.
• There is no private right of action for a violation of this duty; only the attorney general may enforce it, seeking a civil penalty of $2,000 to $50,000 per violation and injunctive relief under Section 521.151.

Tex. Bus. & Com. Code ch. 120; Tex. Civ. Prac. & Rem. Code ch. 143A · Read the law's page

• Publicly disclose accurate information about your content management, data management and business practices on an easily accessible website, including how you curate and target content, place and promote content and services including your own, moderate content, use search, ranking or other algorithms or procedures, and provide users' performance data, in enough detail for users to make an informed choice about using the platform.
• Publish an acceptable use policy in a location easily accessible to users that tells them what types of content are allowed, the steps you will take to ensure content complies, and how they can notify you of content that potentially violates the policy or is illegal, including an e-mail address or complaint intake mechanism and your complaint system.
• Publish a biannual transparency report as part of the acceptable use policy, with an open license, in a machine-readable and open format, covering the preceding six months: the instances you were alerted to illegal content, illegal activity or potentially policy-violating content by a user complaint, an employee or contractor, or an internal automated detection tool; the actions you took, categorized by the rule violated and the source of the alert; the country of the user who provided the content; the number of coordinated campaigns, if applicable; the number of appeals and the percentage that restored content; and a description of each tool, practice, action or technique used in enforcing the policy.
• Provide an easily accessible complaint system that lets a user submit a complaint in good faith and track its status, including a complaint about illegal content or activity or about your decision to remove content the user posted, and give clear, conspicuous, plain-language notice of the system and its procedures that describes your duties under section 120.102 and how a user submits a complaint.
• Make a good faith effort to evaluate the legality of content or activity within 48 hours of receiving notice that it is illegal, excluding hours during a Saturday or Sunday and subject to reasonable exceptions based on concerns about the legitimacy of the notice.
• When you remove content for a violation of your acceptable use policy, notify the user who provided it and explain the reason concurrently with the removal, let the user appeal to you, and give written notice of the appeal determination and, if you reverse the removal, the reason. You need not if you cannot contact the user after reasonable steps, you know the content relates to an ongoing law enforcement investigation, or you removed it on an explicit deep fake complaint.
• On a user's complaint that you removed content the user believes was not potentially policy-violating, review the content, determine whether it adheres to your acceptable use policy, take appropriate steps, and notify the user of the determination and the steps taken, not later than the 14th day, excluding Saturdays and Sundays, after you receive the complaint.
• Do not censor a user, a user's expression, or a user's ability to receive another person's expression based on the viewpoint of the user or another person, the viewpoint represented in the expression, or the user's geographic location in this state or any part of this state. To censor means to block, ban, remove, deplatform, demonetize, de-boost, restrict, deny equal access or visibility to, or otherwise discriminate against expression.
• You may still censor expression that federal law specifically authorizes you to censor, that is the subject of a referral or request from an organization with the purpose of preventing the sexual exploitation of children and protecting survivors of sexual abuse from ongoing harassment, that directly incites criminal activity or consists of specific threats of violence targeted against a person or group because of their race, color, disability, religion, national origin or ancestry, age, sex, or status as a peace officer or judge, or that is unlawful expression, and you may let a user censor specific expression on the user's own platform or page at the user's request.
• Do not rely on a contract term or choice-of-law clause to avoid chapter 143A: a waiver of its protections is void, and an action under the chapter must be brought in a court in this state under the law of this state.
• A federal court's preliminary injunction of December 1, 2021 enjoins the Texas Attorney General, until the court enters judgment, from enforcing Section 2 and Section 7 of House Bill 20 (chapter 120 of the Business and Commerce Code and chapter 143A of the Civil Practice and Remedies Code) against the plaintiff trade associations NetChoice and the Computer and Communications Industry Association and their members, so read the duties below as context for a law whose enforcement against those members is enjoined. Section 143A.007(d) lets a user sue under chapter 143A whether or not another court has enjoined the Attorney General, unless that court's decision is binding on the court in which the user sues.

Tex. Bus. & Com. Code ch. 509 · Read the law's page

• A federal court enjoined the monitoring and filtering requirement for the two trade associations that sued and their members, and on July 24, 2026 a Fifth Circuit panel affirmed that injunction because Section 230 preempts the requirement and vacated the order that had enjoined the Act's targeted advertising, unlawful advertising and age-verification requirements; on October 28, 2026 the full court granted rehearing en banc and vacated that panel opinion, so both of the district court's injunctions again govern: the monitoring and filtering requirement is enjoined for the two trade associations and their members, and the February 7, 2025 order enjoins the targeted advertising, unlawful advertising, age-verification and monitoring-and-filtering requirements. What follows is what the Act requires of a provider outside those injunctions.
• Applies to digital service providers whose services are used, or reasonably anticipated to be used, by a known minor in Texas.
• Determine whether a Texas account holder is a known minor based on the age they self report at registration.
• Unless a verified parent provides otherwise, by default limit data collection and use, and restrict targeted advertising, data sharing and specified design features, for known minors.

Tex. Bus. & Com. Code ch. 542 (secs. 542.001-542.004) · Read the law's page

• This chapter applies only to a business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information, as those terms are defined by Section 521.002.
• It is a safe harbor, not a duty: if such an entity is sued over a breach of system security and demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program meeting Section 542.004's requirements, the claimant may not recover exemplary damages from it. A qualifying program must contain administrative, technical, and physical safeguards; conform to a named industry-recognized cybersecurity framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000-series, the HITRUST Common Security Framework, the Secure Controls Framework, SOC 2, or a similar framework); and be scaled by headcount: simplified measures such as password policies and employee training below 20 employees, the CIS Controls Implementation Group 1 from 20 to 99 employees, and full conformance with a named framework from 100 to 249 employees.
• The chapter creates no duty to adopt a program and no cause of action of its own; it only removes exemplary-damages exposure for a qualifying entity that already has one at the time of a breach.

Tex. Bus. & Com. Code §§ 120.101, 120.1001, 120.102, 120.1015, 120.1025, 120.152 · Read the law's page

• If you operate a social media platform, provide an easily accessible complaint system letting a user report explicit deep fake material, alongside illegal content and content-removal decisions.
• Give clear, conspicuous, plain-language notice of that complaint system and how to use it.
• On receiving a report of explicit deep fake material, immediately confirm to the user that you are aware of it, remove the reported content and any identical known copies, and provide the user a written status update within seven days.
• If you determine reported content is explicit deep fake material, take measures to keep the same material from being posted again.
• Failing these duties is a deceptive trade practice, actionable under the Deceptive Trade Practices-Consumer Protection Act.

Tex. Civ. Prac. & Rem. Code §§ 98B.0021-98B.009 · Read the law's page

• A person depicted in artificial intimate visual material, produced or disclosed without their consent and with intent to harm them, can sue the creator, solicitor, discloser, or promoter for damages if the material reveals their identity.
• If you own a website, application, or social media platform and recklessly facilitate production or disclosure of such material for payment, or you own a publicly accessible nudification application (an AI application primarily designed and marketed to produce this material), you are liable for damages to the depicted person.
• If you own a website, application, or social media platform on which such material is disclosed, you are liable for damages if the depicted person requests removal and you fail to remove it, and known identical copies, within 72 hours.
• You must provide an easily accessible system for a depicted person to request removal, and a clear, plain-language notice describing that process and your responsibilities under it.
• Failing the removal, system, or notice duties is a deceptive trade practice, giving the Attorney General and a private claimant a cause of action under the Deceptive Trade Practices-Consumer Protection Act.
• A depicted person has 10 years from discovering the material, or from turning 18, whichever is later, to bring a claim.

Tex. Penal Code § 21.165 · Read the law's page

• Do not knowingly produce or distribute by electronic means deep fake media that, without the depicted person's effective consent, appears to show them with computer-generated intimate parts or engaging in sexual conduct they did not engage in; doing so is a Class A misdemeanor, elevated to a third-degree felony if you have a prior conviction under this section or the person depicted is younger than 18.
• Do not threaten to produce or distribute such deep fake media to coerce, extort, harass, or intimidate someone; doing so is a Class B misdemeanor, elevated to a Class A misdemeanor under the same two aggravators.
• A disclaimer that the media is unauthorized or not authentic is not a defense.
• A general-purpose AI application or software provider has an affirmative defense only if its terms prohibit creating this content and it takes active technical steps against it, such as training the system to identify such media, providing reporting tools, and filtering it from outputs and training data.