Texas Capture or Use of Biometric Identifier Act (CUBI), publicly available media clause

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 9 months, effective 1 January 2026.

A personal data rule binding public and private bodies.

As of 29 August 2026.

What it requires

The mere existence of an image or other media containing someone's biometric identifiers on the Internet or another publicly available source does not, by itself, count as that person's informed consent to your capturing or storing their biometric identifier for a commercial purpose, unless they themselves made that image or media publicly available.
A 2025 amendment (HB 149, TRAIGA) exempts biometric identifiers used to train, process, or store data for developing or evaluating an AI model, but this exemption is reported to end once the resulting system is deployed to uniquely identify a specific individual; its exact deployment boundary is not independently verified word for word.
Only the Texas Attorney General may sue under this Act, for a civil penalty of up to $25,000 per violation; there is no private right of action, unlike Illinois's Biometric Information Privacy Act (BIPA).

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

CUBI, originally enacted in 2009 (exact enactment date not independently confirmed) and amended by HB 149 (TRAIGA, 2025 Legislature, effective January 1, 2026), requires that a person inform an individual before capturing a biometric identifier (a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry) for a commercial purpose and receive that individual's consent.

The 2025 amendment adds a rule bearing directly on scraping: the mere existence of an image or other media containing someone's biometric identifiers on the Internet or another publicly available source does not, by itself, count as that person having been informed of or having consented to the capture or storage of their biometric identifier for a commercial purpose, unless the individual themselves made that image or media publicly available.

A separate 2025 amendment adds an exemption for biometric identifiers used in training, processing, or storing data to develop or evaluate an AI model, which is reported to lapse once the resulting system is deployed to uniquely identify a specific individual; this exemption's exact deployment boundary is not independently verified word for word.

A civil penalty of not more than $25,000 per violation is recoverable solely by the Attorney General; CUBI carries no private right of action, unlike Illinois's Biometric Information Privacy Act (BIPA).

When LexLint raises it

crawls_web
trains_models
processes_biometrics

Read the law

official text, Texas Constitution and Statutes (statutes.capitol.texas.gov)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app