Law / United States / 
Texas
Texas Data Privacy and Security Act, sensitive data and biometric consent
Tex. Bus. & Com. Code secs. 541.001, 541.101(b)(4)
In force since .
A sensitive categories rule binding private bodies.
- Excludes recording-derived identifiers
- Yes
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Obtain a Texas consumer's opt-in consent before processing sensitive data, including biometric or genetic data collected to uniquely identify the individual, racial or ethnic origin, religious belief, a health diagnosis, sexuality, immigration status, or precise geolocation.
- Follow the Children's Online Privacy Protection Act's consent framework, not TDPSA's general consent rule, when processing a known child's sensitive data.
- Do not treat an identifier derived solely from a photograph, or from a video or audio recording, as TDPSA biometric data requiring this consent. The statutory definition excludes recording-derived data.
These lines are LexLint's reading of the law's text. Also read by: Office of the Texas Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act
- Guidance body
- Office of the Texas Attorney General
- Open questions
- Is a voiceprint generated from an audio recording 'biometric data' under Section 541.001(3), which lists a voiceprint but excludes data generated from a video or audio recording?
What it makes you log
Logging duty
Section 541.101(b)(4) bars processing sensitive data without the consumer's consent, and 541.001(6) defines consent as a clear affirmative act that includes a written statement. Consent is a condition of processing; neither section requires the controller to keep, produce or demonstrate a record of it. The Act's records sit in sections this row does not cite: documented data protection assessments, including for sensitive data (541.105(a)(4)), and the Attorney General's civil investigative demand (541.153(b)). The row cites the definitions in 541.001, which define a consumer as a resident of this state (541.001(7)); the business-reach prong in 541.002(a) is not cited here.
- Kind
- None
- As of
What this law does
TDPSA classifies genetic or biometric data processed to uniquely identify a person, along with racial or ethnic origin, religious belief, a mental or physical health diagnosis, sexuality, citizenship or immigration status, precise geolocation, and a known child's data, as sensitive data requiring the consumer's prior consent before a controller may process it.
'Biometric data' means data from automatic measurement of an individual's biological characteristics used to identify them, including a fingerprint, voiceprint, or eye retina or iris, but the definition expressly excludes data generated from a photograph, or from a video or audio recording, so an identifier derived solely from such a recording falls outside this consent duty.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .