Capture or Use of Biometric Identifier Act (CUBI), as amended by HB 149

Tex. Bus. & Com. Code sec. 503.001, as amended by Tex. HB 149, 89th Legislature (2025)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 April 2009.

A biometric privacy rule binding private bodies.

As of 23 August 2026.

What it requires

Inform an individual and obtain consent before capturing their retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry for a commercial purpose in Texas.
Do not treat an individual's biometric identifiers appearing in publicly available online media as consent to capture them unless that individual made the media publicly available themselves.
Do not sell, lease, or disclose a captured biometric identifier except for the narrow statutory exceptions covering identification of a missing or deceased person, a requested financial transaction, legal compulsion, or a law enforcement warrant.
Store and transmit a captured biometric identifier with reasonable care equal to or exceeding the protection given your other confidential information, and destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.
Confirm any AI training use of biometric identifiers stays within the training, processing, or evaluation exemption. It ends once the AI system is deployed to uniquely identify a specific individual.

If you get it wrong

Private right of actionNo

What it reaches

Excludes recording-derived identifiersNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

CUBI is Texas's dedicated biometric-identifier statute. It defines 'biometric identifier' as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry, with no exclusion for an identifier derived from a photograph, video, or audio recording.

A person may not capture an individual's biometric identifier for a commercial purpose without first informing the individual and obtaining consent, may not sell, lease, or disclose a captured identifier outside narrow statutory exceptions, must store and transmit it with reasonable care equal to or better than its other confidential information, and must destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.

HB 149 (89th Legislature, 2025), effective January 1, 2026, added that an individual's biometric identifiers appearing in publicly available online media do not by themselves establish consent to capture unless that individual made the media publicly available, and added exemptions for biometric identifiers used only to train, process, or store data for developing or evaluating an AI model, and for AI systems used to prevent fraud, harassment, or other illegal activity.

When LexLint raises it

processes_biometrics
processes_voice
trains_models

Read the law

official Texas statute text, Business and Commerce Code chapter 503, Texas Constitution and Statutes System

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app