Texas

A social media platform must provide an easily accessible complaint system, with clear and conspicuous notice of it, letting a user report explicit deep fake material (deep fake material, meaning AI-altered or AI-created visual material made with intent to deceive, that depicts sexual conduct or exposes intimate parts).

On receiving such a report the platform must immediately confirm awareness to the user, remove the reported content and any identical known copies, and provide a status update within seven days; if the platform determines the content is not explicit deep fake material it may restore it, and if it determines the content is explicit deep fake material it must take measures to prevent the same material from being reposted.

A violation is a deceptive trade practice actionable under the Texas Deceptive Trade Practices-Consumer Protection Act. This chapter reaches only a social media platform with more than 50 million active United States users in a calendar month, so it binds a small number of the largest commercial platforms rather than every online service.

A person commits an offense if, with intent to injure a candidate or influence the result of an election, the person creates a deep fake video, defined as a video created with intent to deceive that appears to depict a real person doing something that did not occur, and causes it to be published or distributed within 30 days of an election.

This deep fake-specific offense is unaffected by Ex parte Stafford, in which the Texas Court of Criminal Appeals struck down as facially unconstitutional the same section's separate general provision, subsection (b), which had made it an offense to knowingly misrepresent in a campaign communication that it emanates from a source other than its true source; the court's holding was confined to that provision.

A person commits an offense by knowingly possessing, accessing with intent to view, or promoting obscene visual material that appears to depict a child younger than 18 engaging in sexual conduct, regardless of whether the depiction is of an actual child, a cartoon or animation, or an image created with an AI application or other computer software. A separate offense covers using an image of an actual child to train an AI model to produce material constituting child pornography.

The offense is a state jail felony, rising to a third-degree felony on one prior conviction under this section or the related child-pornography sections, and a second-degree felony on two or more.

A defendant who, without effective consent and with intent to harm, produces, solicits, discloses, or promotes artificial intimate visual material (AI-produced depictions of a person's exposed intimate parts or of them engaging in sexual conduct) that reveals the depicted person's identity is civilly liable to that person for damages.

A website, application, or social media platform owner who recklessly facilitates production or disclosure of the material for payment, or who owns a nudification application, an AI application primarily designed and marketed to produce artificial intimate visual material, is separately liable for damages. An owner is also liable for damages if the depicted person requests removal and the owner fails to remove the material, and known identical copies, within 72 hours of the request.

Every such owner must provide an accessible removal-request system and a clear, plain-language notice of it, and a violation of the removal, system, or notice duties is a deceptive trade practice actionable under the Texas Deceptive Trade Practices-Consumer Protection Act. A claim under this chapter must be brought not later than 10 years after the later of the depicted person's discovery of the material or the date the depicted person turns 18.

A person commits an offense by knowingly producing or distributing, by electronic means and without the depicted person's effective consent, deep fake media (visual material created or altered by software, machine learning, artificial intelligence, or other technological means) that appears to depict that person with computer-generated intimate parts or engaging in sexual conduct they did not engage in.

A separate offense covers intentionally threatening to produce or distribute such media to coerce, extort, harass, or intimidate.

The provision was originally enacted in 2023 and has since been amended, effective September 1, 2025; a general-purpose AI application or software provider has an affirmative defense if its terms prohibit this use and it takes active technical steps against it, such as training the system to identify prohibited content, providing reporting tools, and filtering it from outputs and training data. A disclaimer that the media is unauthorized or inauthentic is not a defense.

A person may not develop or deploy an AI system that intentionally aims to incite self-harm, harm to another, or criminal activity; may not develop or deploy an AI system with the sole intent of infringing a constitutional right; may not develop or deploy an AI system with intent to unlawfully discriminate against a protected class, though disparate impact alone does not show that intent; and may not develop or distribute an AI system with the sole intent of producing AI-generated child pornography or deepfake sexually explicit media, or that engages a minor in simulated sexual conversation while impersonating a child.

Enforcement is exclusively by the Attorney General, with no private right of action and a 60-day notice-and-cure period. Civil penalties run from $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for a continuing violation, and the Attorney General cannot bring an action over a system that has not been deployed.

A health care practitioner, public or private, may use AI for diagnostic purposes, including AI-generated recommendations on diagnosis or treatment based on a patient's medical record, only if the practitioner stays within the scope of their license, the use is not otherwise restricted by law, and the practitioner reviews all AI-created records consistent with Texas Medical Board standards; a practitioner who uses AI for diagnosis must disclose that use to the patient.

This layers onto, and is narrower than, TRAIGA's own health-care AI disclosure duty at Business & Commerce Code 552.051(f). The chapter's covered entities may face a civil penalty of $5,000 per negligent violation, $25,000 per knowing or intentional violation, or $250,000 per violation where protected health information was knowingly or intentionally used for financial gain, plus regulatory investigation and disciplinary action.

A governmental agency that makes an AI system available to interact with consumers must disclose, before or at the time of interaction, that the consumer is interacting with an AI system, regardless of whether that would already be obvious; the disclosure must be clear, conspicuous, in plain language, free of dark patterns, and may be given by hyperlink.

The same disclosure duty extends to any provider of a health care service or treatment, public or private, that uses an AI system in that service or treatment, who must give it to the patient or the patient's representative by the time the service is first provided, or as soon as reasonably possible in an emergency.

CUBI is Texas's dedicated biometric-identifier statute. It defines 'biometric identifier' as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry, with no exclusion for an identifier derived from a photograph, video, or audio recording.

A person may not capture an individual's biometric identifier for a commercial purpose without first informing the individual and obtaining consent, may not sell, lease, or disclose a captured identifier outside narrow statutory exceptions, must store and transmit it with reasonable care equal to or better than its other confidential information, and must destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.

HB 149 (89th Legislature, 2025), effective January 1, 2026, added that an individual's biometric identifiers appearing in publicly available online media do not by themselves establish consent to capture unless that individual made the media publicly available, and added exemptions for biometric identifiers used only to train, process, or store data for developing or evaluating an AI model, and for AI systems used to prevent fraud, harassment, or other illegal activity.

A person conducting business in Texas that owns or licenses computerized data including sensitive personal information (a Social Security, driver's license, or government identification number, or a financial account number with an access code, each combined with a name, or certain health information) must notify affected Texas residents without unreasonable delay and no later than 60 days after determining a breach of system security occurred.

If 250 or more Texas residents are affected, the person must also notify the Texas Attorney General as soon as practicable and no later than 30 days after that determination, and a person notifying more than 10,000 persons at one time must also notify each nationwide consumer reporting agency.

Biometric data such as a fingerprint, voiceprint, or retina or iris image sits in the chapter's separate, broader personal identifying information definition and does not itself trigger this notification duty.

Enforcement of this notification duty is exclusive to the Attorney General, with a civil penalty of $2,000 to $50,000 per violation, and this section creates no private right of action, though a separate provision of the same chapter (sec. 521.152) ties a violation of the identity theft prohibition in sec. 521.051 to a private action under the Deceptive Trade Practices Act.

TDPSA governs private-sector processing of Texas residents' personal data. It applies to a person who conducts business in Texas, or produces a product or service consumed by Texas residents, and who processes or sells personal data, unless the person is a small business under SBA size standards (a limited exception for selling sensitive data under sec. 541.107 applies regardless of size).

The Act excludes state agencies, political subdivisions, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions, Health Insurance Portability and Accountability Act (HIPAA) covered entities, nonprofits, higher-education institutions, and electric utilities, and 'personal data' excludes deidentified data and publicly available information.

TDPSA gives a Texas consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect, exercisable against the controller.

A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available, must answer an appeal of a refusal within 60 days, and must conduct and document a data protection assessment before targeted advertising, sale, certain profiling, sensitive-data processing, or other heightened-risk processing.

The Texas Attorney General has exclusive authority to enforce TDPSA. Before suing, the Attorney General must give an alleged violator 30 days' written notice identifying the specific provisions violated; curing the violation within that period and confirming the cure in writing bars the action. An uncured violation is subject to a civil penalty of up to $7,500 per violation, and the chapter expressly bars any private right of action.

The Attorney General filed the state's first TDPSA enforcement action against Allstate Corp. and Arity LLC on January 13, 2025, over the sale of geolocation and driving-behavior data collected through SDKs embedded in third-party apps, and that case remains pending.

TDPSA classifies genetic or biometric data processed to uniquely identify a person, along with racial or ethnic origin, religious belief, a mental or physical health diagnosis, sexuality, citizenship or immigration status, precise geolocation, and a known child's data, as sensitive data requiring the consumer's prior consent before a controller may process it.

'Biometric data' means data from automatic measurement of an individual's biological characteristics used to identify them, including a fingerprint, voiceprint, or eye retina or iris, but the definition expressly excludes data generated from a photograph, or from a video or audio recording, so an identifier derived solely from such a recording falls outside this consent duty.

Subsection (a) makes it a Class B misdemeanor to knowingly access a computer, computer network, or computer system without the effective consent of the owner.

A separate, more serious offense, subsection (b-1), is Texas's own statutory answer to the ToS and robots.txt authorization question: it applies where a person, with intent to defraud or harm another or to alter, damage, or delete property, knowingly accesses a computer system owned by government or a business in violation of either a clear and conspicuous prohibition posted by the owner or a contractual agreement the person expressly agreed to.

A posted no-scraping notice or a clickwrap agreement therefore carries independent legal weight in Texas, but only elevates exposure when paired with fraudulent or harmful intent, not for ordinary commercial data collection alone. Verified against the official Texas statutes site, which serves only a JavaScript shell without a full browser render. No Texas case law applying subsection (b-1) or CUBI's publicly available media clause to a scraping fact pattern was found.

CUBI, originally enacted in 2009 (exact enactment date not independently confirmed) and amended by HB 149 (TRAIGA, 2025 Legislature, effective January 1, 2026), requires that a person inform an individual before capturing a biometric identifier (a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry) for a commercial purpose and receive that individual's consent.

The 2025 amendment adds a rule bearing directly on scraping: the mere existence of an image or other media containing someone's biometric identifiers on the Internet or another publicly available source does not, by itself, count as that person having been informed of or having consented to the capture or storage of their biometric identifier for a commercial purpose, unless the individual themselves made that image or media publicly available.

A separate 2025 amendment adds an exemption for biometric identifiers used in training, processing, or storing data to develop or evaluate an AI model, which is reported to lapse once the resulting system is deployed to uniquely identify a specific individual; this exemption's exact deployment boundary is not independently verified word for word.

A civil penalty of not more than $25,000 per violation is recoverable solely by the Attorney General; CUBI carries no private right of action, unlike Illinois's Biometric Information Privacy Act (BIPA).

TDPSA applies to any person conducting business in Texas, or producing a product or service consumed by Texas residents, that processes or sells personal data and is not a small business as defined by the United States Small Business Administration, except that the sensitive-data-sale consent duty in section 541.107 applies even to a small business.

This is deliberately not a fixed dollar-revenue or consumer-count threshold; the SBA's small-business size standards vary by industry, often revenue in the tens of millions or employee counts in the hundreds, so TDPSA reaches many mid-sized data collectors that fall below other states' 100,000-consumer or $25-million thresholds.

Personal data excludes deidentified data and publicly available information, defined as information lawfully available through government records or that a business has a reasonable basis to believe is lawfully available to the public through widely distributed media, by the consumer, or by a person the consumer disclosed it to. Enforcement is by the Attorney General only, with a 30-day cure period; TDPSA carries no private right of action.

A business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information may invoke a safe harbor from exemplary damages. In an action arising from a breach of system security, such an entity may not be held liable for exemplary damages if it demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program conforming to a named industry-recognized framework and scaled to its size. The chapter creates a safe harbor from a category of damages, not a freestanding duty to adopt a program.

A business must implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect from unlawful use or disclosure any sensitive personal information it collects or maintains in the regular course of business. A business must also destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise rendering it unreadable or indecipherable.

A financial institution as defined by 15 U.S.C. § 6809 is exempt from the destruction duty, and the section states no further content for what 'reasonable' requires beyond the general standard.

Requires a commercial entity that knowingly and intentionally publishes or distributes material on a website, including a social media platform, more than one third of which is sexual material harmful to minors, to use reasonable age verification methods for Texas visitors and to protect any identifying information it collects.

Requires app store providers to verify a user's age category, link a minor's account to a parent account, and obtain parental consent before a minor can download an app or make an in app purchase, and to share age and consent information with app developers. Violations are deceptive trade practices under Texas consumer protection law.