Law / United States / 
Texas
Capture or Use of Biometric Identifier Act (CUBI), as amended by HB 149
Tex. Bus. & Com. Code sec. 503.001, as amended by Tex. HB 149, 89th Legislature (2025)
In force since .
A biometric privacy rule binding private bodies.
- Private right of action
- No
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- Inform an individual and obtain consent before capturing their retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry for a commercial purpose in Texas.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P1
- Do not treat an individual's biometric identifiers appearing in publicly available online media as consent to capture them unless that individual made the media publicly available themselves.
- Do not sell, lease, or disclose a captured biometric identifier except for the narrow statutory exceptions covering identification of a missing or deceased person, a requested financial transaction, legal compulsion, or a law enforcement warrant.NIST Privacy FrameworkCT.PO-P1
- Store and transmit a captured biometric identifier with reasonable care equal to or exceeding the protection given your other confidential information, and destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.NIST Privacy FrameworkPR.DS-P1NIST Privacy FrameworkCT.DM-P5
- Confirm any AI training use of biometric identifiers stays within the training, processing, or evaluation exemption. It ends once the AI system is deployed to uniquely identify a specific individual.
These lines are LexLint's reading of the law's text. Also read by: Office of the Texas Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P5Data are destroyed according to policy.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P1Data-at-rest are protected.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/biometric-identifier-act
- Guidance body
- Office of the Texas Attorney General
- Open questions
- At what point is an artificial intelligence system 'used or deployed for the purpose of uniquely identifying a specific individual' under Section 503.001(e)(2), so that the exemption for training, processing or storage of biometric identifiers no longer applies?
What it makes you log
Logging duty
Section 503.001 requires notice and consent before capturing a biometric identifier for a commercial purpose (503.001(b)), reasonable-care storage (503.001(c)(2)) and destruction within a year after the collection purpose ends (503.001(c)(3)). The consent is a condition of capture and the section does not require the person to keep or produce it. The destruction deadline limits how long the identifier may be kept and is not a retention period for a log or record. The Attorney General recovers a civil penalty of up to $25,000 per violation (503.001(d)). The section has no territorial clause.
- Kind
- None
- As of
What this law does
CUBI is Texas's dedicated biometric-identifier statute. It defines 'biometric identifier' as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry, with no exclusion for an identifier derived from a photograph, video, or audio recording.
A person may not capture an individual's biometric identifier for a commercial purpose without first informing the individual and obtaining consent, may not sell, lease, or disclose a captured identifier outside narrow statutory exceptions, must store and transmit it with reasonable care equal to or better than its other confidential information, and must destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.
HB 149 (89th Legislature, 2025), effective , added that an individual's biometric identifiers appearing in publicly available online media do not by themselves establish consent to capture unless that individual made the media publicly available, and added exemptions for biometric identifiers used only to train, process, or store data for developing or evaluating an AI model, and for AI systems used to prevent fraud, harassment, or other illegal activity.
When LexLint raises it
When your app profile says your app processes biometric data, trains models or processes personal data.
Back to the example · Lint your app
Page updated .