Law / United States / 
Texas
Texas Capture or Use of Biometric Identifier Act (CUBI), publicly available media clause
Tex. Bus. & Com. Code § 503.001
In force since .
A personal data rule binding public and private bodies.
- Audit expectation
- none
What it requires
- The mere existence of an image or other media containing someone's biometric identifiers on the Internet or another publicly available source does not, by itself, count as that person's informed consent to your capturing or storing their biometric identifier for a commercial purpose, unless they themselves made that image or media publicly available.
- A 2025 amendment (HB 149, TRAIGA) exempts the training, processing, or storage of biometric identifiers to develop, train, evaluate, disseminate, or otherwise offer an artificial intelligence system, unless the system is used or deployed to uniquely identify a specific individual.
- Only the Texas Attorney General may sue under this Act, for a civil penalty of up to $25,000 per violation; there is no private right of action, unlike Illinois's Biometric Information Privacy Act (BIPA).
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- When a third party posts a person's image, does that person make the image "publicly available" under Tex. Bus. & Com. Code section 503.001(b-1) by keeping a public profile or by not asking for its removal?
- Is a face-geometry record extracted from a scraped image captured "for a commercial purpose" under Tex. Bus. & Com. Code section 503.001(b-1) when it is used only to train a model?
What it makes you log
Logging duty
Section 503.001 requires notice and consent before a biometric identifier is captured, limits disclosure, requires reasonable-care storage and requires destruction within a reasonable time and not later than the first anniversary of the day the collection purpose expires (subsection c). That destruction deadline limits how long the identifier itself may be held and requires no log or record of consent or capture, so it is not coded as a record retention period. The section has no territorial clause.
- Kind
- None
- As of
What this law does
CUBI, added in 2007 by Acts 2007, 80th Legislature, chapter 885, section 2.01, effective and amended by HB 149 (TRAIGA, 2025 Legislature, effective ), requires that a person inform an individual before capturing a biometric identifier (a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry) for a commercial purpose and receive that individual's consent.
The 2025 amendment adds a rule bearing directly on scraping: the mere existence of an image or other media containing someone's biometric identifiers on the Internet or another publicly available source does not, by itself, count as that person having been informed of or having consented to the capture or storage of their biometric identifier for a commercial purpose, unless the individual themselves made that image or media publicly available.
A separate clause in the same 2025 amendment exempts the training, processing, or storage of biometric identifiers to develop, train, evaluate, disseminate, or otherwise offer an artificial intelligence system, unless that system is used or deployed to uniquely identify a specific individual. A civil penalty of not more than $25,000 per violation is recoverable solely by the Attorney General; CUBI carries no private right of action, unlike Illinois's Biometric Information Privacy Act (BIPA).
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .