Law / United States / Texas

Consumer Protection Against Computer Spyware Act

Consumer Protection Against Computer Spyware Act, Tex. Bus. & Com. Code ch. 324

In force since 1 Apr 2009.

A device storage and tracking consent rule binding private bodies.

Obligation class

Prohibition, Consent

As of 27 October 2026.

What it requires

• If you are not the owner or operator of a computer (its owner or lessee, or an individual using it with the owner's or lessee's authorization), do not knowingly cause software to be copied to a computer in Texas and use it to do any of the acts below; you act knowingly if you have actual knowledge of the facts that constitute the violation or consciously avoid information that would establish that knowledge, and causing software to be copied means distributing or transferring it or a component of it, not merely transmitting, routing, caching, hosting through a website or giving a link to it.
• Do not use that software to collect personally identifiable information (a name, home address, e-mail address, card or bank account number, password or access code, government identification number, or account balances, overdraft history or payment history that identify the person) through intentionally deceptive means by a keystroke-logging function that records all keystrokes and transfers them to another person, or in a manner that correlates it with all or substantially all of the websites the owner or operator visits other than your own.
• Do not use that software to cull, through intentionally deceptive means, a card number, bank account number, password or access code for a card or bank account, social security number, account balance or overdraft history from the hard drive for a purpose wholly unrelated to any purpose of the software or service you described to the owner or operator.
• Do not use that software to modify, through intentionally deceptive means, the page that appears when an Internet browser is launched, the default provider or web proxy used to access or search the Internet, or the list of bookmarks.
• Do not use that software to take control of the computer by using its modem or Internet service to cause damage or to make the owner, operator or a third party incur financial charges for a service not previously authorized, or by opening, without the owner's or operator's consent, advertisements in multiple, sequential or stand-alone form that an ordinarily reasonable person cannot close without closing the browser or shutting down the computer.
• Do not use that software to modify settings that relate to access to or use of the Internet and the protection of information for the purpose of stealing the owner's or operator's personally identifiable information, or security settings for the purpose of causing damage to one or more computers.
• Do not use that software to prevent, through intentionally deceptive means, the owner's reasonable efforts to block or disable software by making software the owner has properly removed or disabled reinstall or reactivate itself; do not misrepresent to another that software will be uninstalled or disabled by the owner's actions; do not remove, disable or render inoperative, through intentionally deceptive means, security, antispyware or antivirus software; do not offer an option to decline installation knowing the installation will proceed anyway, or misrepresent that software has been disabled; and do not change the software's name, location or other designation, or create randomized or deceptive file names, folders, formats or registry entries, to keep the owner from locating or removing it.
• Do not induce the owner or operator of a computer in Texas to install a software component by intentionally misrepresenting the extent to which installation is necessary for security or privacy reasons, to open or view text, or to play musical or other content, and do not copy and execute, or cause the copying and execution of, a software component in a deceptive manner with the intent that the owner or operator use it in a way that violates the chapter.
• Do not knowingly cause or offer to cause a computer you do not own or operate to become a zombie or part of a botnet (a computer compromised without the owner's or operator's knowledge and consent so that a program or person other than the owner or operator has access or control); do not knowingly create, have created, use or offer to use a zombie or botnet to send unsolicited commercial electronic mail, cause a loss of service, send data from a computer without the owner's or operator's authorization, forward software designed to damage or disrupt another computer or system, collect personally identifiable information, or perform an act for another purpose the owner or operator has not authorized; and do not purchase, rent or otherwise gain control of a zombie or botnet created by another person, or sell, lease or otherwise provide another person access to or use of one.
• Section 324.052 other than its subdivision (1), section 324.053(4), section 324.054 and section 324.055 do not apply to a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service that monitors or interacts with a subscriber's Internet or other network connection or service, or a protected computer, for a network or computer security purpose, diagnostics, technical support or repair, an authorized update of software or system firmware, authorized remote system management, or detection or prevention of unauthorized use or of fraudulent or other illegal activity, including scanning for and removing software the chapter proscribes.

These lines are LexLint's reading of the law's text, as of 27 October 2026.

If you get it wrong

Who enforces it

When LexLint raises it

When your app profile says your app tracks devices or distributes a software product.

Back to the example  ·  Lint your app