Texas

A social media platform must provide an easily accessible complaint system, with clear and conspicuous notice of it, letting a user report explicit deep fake material (deep fake material, meaning AI-altered or AI-created visual material made with intent to deceive, that depicts sexual conduct or exposes intimate parts).

On receiving such a report the platform must immediately confirm awareness to the user, remove the reported content and any identical known copies, and provide a status update within seven days; if the platform determines the content is not explicit deep fake material it may restore it, and if it determines the content is explicit deep fake material it must take measures to prevent the same material from being reposted.

A violation is a deceptive trade practice actionable under the Texas Deceptive Trade Practices-Consumer Protection Act. This chapter reaches only a social media platform with more than 50 million active United States users in a calendar month, so it binds a small number of the largest commercial platforms rather than every online service.

The Attorney General has exclusive authority to enforce the chapter, and the chapter provides no basis for a private right of action. The Attorney General maintains an online mechanism through which a consumer may submit a complaint. On a complaint alleging a violation, the Attorney General may issue a civil investigative demand under the procedures of Section 15.10.

A demand may ask for a high-level description of the system's purpose, intended use, deployment context and associated benefits, a description of the type of data used to program or train it, a high-level description of the categories of input data and of the outputs, any performance metrics, any known limitations, and a high-level description of post-deployment monitoring and user safeguards.

Before suing, the Attorney General must notify the person in writing of the specific provisions allegedly violated, and may not bring an action before the 60th day after the notice or if the person cures the violation within that period and provides a written statement that it has cured the violation, supporting documentation, and any necessary changes to internal policies to reasonably prevent further violation.

A person who violates the chapter and does not cure the violation is liable for a civil penalty of $10,000 to $12,000 for each curable violation or breach of a cure statement, $80,000 to $200,000 for each uncurable violation, and $2,000 to $40,000 for each day a violation continues, and the Attorney General may also seek an injunction and recover attorney's fees, court costs and investigative expenses.

There is a rebuttable presumption that a person used reasonable care as required under the chapter. A defendant may seek an expedited hearing or other process, including a request for declaratory judgment, if it believes in good faith that it has not violated the chapter.

A defendant may not be found liable if another person uses its AI system in a manner the chapter prohibits, or if it discovers a violation through feedback from a developer, deployer, or other person who believes a violation has occurred, through testing including adversarial or red-team testing, through following guidelines set by applicable state agencies, or, if it substantially complies with the most recent version of the National Institute of Standards and Technology's Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile or another nationally or internationally recognized risk management framework for AI systems, through an internal review process.

The Attorney General may not bring an action to collect a civil penalty against a person for an AI system that has not been deployed. A state agency may impose sanctions, including suspension, probation or revocation of a license, registration or certificate or a monetary penalty not to exceed $100,000, on a person it licenses, registers or certifies if the person has been found in violation under Section 552.105 and the Attorney General has recommended additional enforcement by that agency.

A person commits an offense if, with intent to injure a candidate or influence the result of an election, the person creates a deep fake video, defined as a video created with intent to deceive that appears to depict a real person doing something that did not occur, and causes it to be published or distributed within 30 days of an election.

This deep fake-specific offense is unaffected by Ex parte Stafford, in which the Texas Court of Criminal Appeals struck down as facially unconstitutional the same section's separate general provision, subsection (b), which had made it an offense to knowingly misrepresent in a campaign communication that it emanates from a source other than its true source; the court's holding was confined to that provision.

A person commits an offense by knowingly possessing, accessing with intent to view, or promoting obscene visual material that appears to depict a child younger than 18 engaging in sexual conduct, regardless of whether the depiction is of an actual child, a cartoon or animation, or an image created with an AI application or other computer software. A separate offense covers using an image of an actual child to train an AI model to produce material constituting child pornography.

The offense is a state jail felony, rising to a third-degree felony on one prior conviction under this section or the related child-pornography sections, and a second-degree felony on two or more.

A defendant who, without effective consent and with intent to harm, produces, solicits, discloses, or promotes artificial intimate visual material (AI-produced depictions of a person's exposed intimate parts or of them engaging in sexual conduct) that reveals the depicted person's identity is civilly liable to that person for damages.

A website, application, or social media platform owner who recklessly facilitates production or disclosure of the material for payment, or who owns a nudification application, an AI application primarily designed and marketed to produce artificial intimate visual material, is separately liable for damages. An owner is also liable for damages if the depicted person requests removal and the owner fails to remove the material, and known identical copies, within 72 hours of the request.

Every such owner must provide an accessible removal-request system and a clear, plain-language notice of it, and a violation of the removal, system, or notice duties is a deceptive trade practice actionable under the Texas Deceptive Trade Practices-Consumer Protection Act. A claim under this chapter must be brought not later than 10 years after the later of the depicted person's discovery of the material or the date the depicted person turns 18.

A person commits an offense by knowingly producing or distributing, by electronic means and without the depicted person's effective consent, deep fake media (visual material created or altered by software, machine learning, artificial intelligence, or other technological means) that appears to depict that person with computer-generated intimate parts or engaging in sexual conduct they did not engage in.

A separate offense covers intentionally threatening to produce or distribute such media to coerce, extort, harass, or intimidate.

The provision was originally enacted in 2023 and has since been amended, effective September 1, 2025; a general-purpose AI application or software provider has an affirmative defense if its terms prohibit this use and it takes active technical steps against it, such as training the system to identify prohibited content, providing reporting tools, and filtering it from outputs and training data. A disclaimer that the media is unauthorized or inauthentic is not a defense.

A person may not develop or deploy an AI system that intentionally aims to incite self-harm, harm to another, or criminal activity; may not develop or deploy an AI system with the sole intent of infringing a constitutional right; may not develop or deploy an AI system with intent to unlawfully discriminate against a protected class, though disparate impact alone does not show that intent; and may not develop or distribute an AI system with the sole intent of producing AI-generated child pornography or deepfake sexually explicit media, or that engages a minor in simulated sexual conversation while impersonating a child.

Enforcement is exclusively by the Attorney General, with no private right of action and a 60-day notice-and-cure period. Civil penalties run from $10,000 to $12,000 per curable violation, $80,000 to $200,000 per uncurable violation, and $2,000 to $40,000 per day for a continuing violation, and the Attorney General cannot bring an action over a system that has not been deployed.

A health care practitioner, public or private, may use AI for diagnostic purposes, including AI-generated recommendations on diagnosis or treatment based on a patient's medical record, only if the practitioner stays within the scope of their license, the use is not otherwise restricted by law, and the practitioner reviews all AI-created records consistent with Texas Medical Board standards; a practitioner who uses AI for diagnosis must disclose that use to the patient.

This layers onto, and is narrower than, TRAIGA's own health-care AI disclosure duty at Business & Commerce Code 552.051(f). The chapter's covered entities may face a civil penalty of $5,000 per negligent violation, $25,000 per knowing or intentional violation, or $250,000 per violation where protected health information was knowingly or intentionally used for financial gain, plus regulatory investigation and disciplinary action.

Senate Bill 815 added Section 4201.156 to the Texas Insurance Code, under which a utilization review agent may not use an automated decision system to make, wholly or partly, an adverse determination. An automated decision system is an algorithm, including an algorithm incorporating an artificial intelligence system, that uses data-based analytics to make, suggest, or recommend certain determinations, decisions, judgments, or conclusions.

An adverse determination is a determination by a utilization review agent that health care services provided or proposed to be provided to a patient are not medically necessary or appropriate or are experimental or investigational. The ban does not prohibit the use of an algorithm, artificial intelligence system, or automated decision system for administrative support or fraud-detection functions.

The commissioner may audit and inspect at any time a utilization review agent's use of an automated decision system for utilization review. A notice of an adverse determination must include a description of and the source of the screening criteria and review procedures used as guidelines in making the adverse determination. The amended chapter applies only to utilization review conducted for a health benefit plan delivered, issued for delivery, or renewed on or after January 1, 2026. The act is Chapter 989 of the Acts of the 89th Legislature, Regular Session. The act took effect September 1, 2025.

A governmental agency that makes an AI system available to interact with consumers must disclose, before or at the time of interaction, that the consumer is interacting with an AI system, regardless of whether that would already be obvious; the disclosure must be clear, conspicuous, in plain language, free of dark patterns, and may be given by hyperlink.

The same disclosure duty extends to any provider of a health care service or treatment, public or private, that uses an AI system in that service or treatment, who must give it to the patient or the patient's representative by the time the service is first provided, or as soon as reasonably possible in an emergency.

CUBI is Texas's dedicated biometric-identifier statute. It defines 'biometric identifier' as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry, with no exclusion for an identifier derived from a photograph, video, or audio recording.

A person may not capture an individual's biometric identifier for a commercial purpose without first informing the individual and obtaining consent, may not sell, lease, or disclose a captured identifier outside narrow statutory exceptions, must store and transmit it with reasonable care equal to or better than its other confidential information, and must destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.

HB 149 (89th Legislature, 2025), effective January 1, 2026, added that an individual's biometric identifiers appearing in publicly available online media do not by themselves establish consent to capture unless that individual made the media publicly available, and added exemptions for biometric identifiers used only to train, process, or store data for developing or evaluating an AI model, and for AI systems used to prevent fraud, harassment, or other illegal activity.

A person conducting business in Texas that owns or licenses computerized data including sensitive personal information (a Social Security, driver's license, or government identification number, or a financial account number with an access code, each combined with a name, or certain health information) must notify affected Texas residents without unreasonable delay and no later than 60 days after determining a breach of system security occurred.

If 250 or more Texas residents are affected, the person must also notify the Texas Attorney General as soon as practicable and no later than 30 days after that determination, and a person notifying more than 10,000 persons at one time must also notify each nationwide consumer reporting agency.

Biometric data such as a fingerprint, voiceprint, or retina or iris image sits in the chapter's separate, broader personal identifying information definition and does not itself trigger this notification duty.

Enforcement of this notification duty is exclusive to the Attorney General, with a civil penalty of $2,000 to $50,000 per violation, and this section creates no private right of action, though a separate provision of the same chapter (sec. 521.152) ties a violation of the identity theft prohibition in sec. 521.051 to a private action under the Deceptive Trade Practices Act.

TDPSA governs private-sector processing of Texas residents' personal data. It applies to a person who conducts business in Texas, or produces a product or service consumed by Texas residents, and who processes or sells personal data, unless the person is a small business under SBA size standards (a limited exception for selling sensitive data under sec. 541.107 applies regardless of size).

The Act excludes state agencies, political subdivisions, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions, Health Insurance Portability and Accountability Act (HIPAA) covered entities, nonprofits, higher-education institutions, and electric utilities, and 'personal data' excludes deidentified data and publicly available information.

A medical facility, research facility, company or nonprofit organization subject to chapter 174 may not sell or otherwise transfer genomic sequencing data of residents of this state as part of a bankruptcy proceeding or a chapter 11 plan of reorganization to a foreign adversary, a state-owned enterprise of a foreign adversary, an organization domiciled in a foreign adversary country, or an owned or controlled subsidiary or affiliate of such an organization.

A covered facility, company or organization may not store any genome sequencing data of a resident of this state at a location within the borders of a country that is a foreign adversary. A covered facility, company or organization that stores genome sequencing data of residents of this state, including through a third-party data storage contract, must ensure its security using reasonable encryption methods, restriction on access and other cybersecurity best practices.

A covered facility, company or organization must ensure genome sequencing data of residents of this state, other than open data, is inaccessible to any person located within the borders of a country that is a foreign adversary.

A resident who is a patient or research subject and who is harmed by the storage or use of the resident's genome sequencing data in violation of chapter 174 may bring an action and obtain the greater of actual damages or statutory damages not to exceed $5,000 for each violation, plus court costs and reasonable attorney's fees.

A medical facility, research facility, company or nonprofit organization that violates chapter 174 is liable to this state for a civil penalty of $10,000 for each violation, which the attorney general may bring an action to recover. Chapter 174 applies to a medical facility, research facility, company or nonprofit organization that conducts research on or testing of genome sequencing or the human genome in this state.

Section 2(b) of the Act that added chapter 174 provides that section 174.006 applies only to a bankruptcy filing that occurs on or after the effective date of the Act. Section 174.007 was added by Acts 2025, 89th Legislature, chapter 368 (House Bill 130), effective September 1, 2025.

In chapter 183 a covered entity has the meaning section 181.001 assigns and includes a health care practitioner, but does not include a home and community support services agency, a nursing facility, a continuing care facility, an assisted living facility, an intermediate care facility, a day activity and health services facility, or a provider under the Texas home living or home and community-based services waiver program.

A covered entity must ensure that electronic health records under its control that contain patient information are physically maintained in the United States or a territory of the United States, including records stored by a third-party or subcontracted computing facility or cloud computing service and records stored using a technology through which patient information may be retrieved, accessed or transmitted.

A covered entity must ensure that the electronic health record information of this state's residents, other than open data, is accessible only to individuals who require it to perform duties within the scope of their employment related to treatment, payment or health care operations. Each covered entity must implement reasonable and appropriate administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of electronic health record information.

The attorney general may institute an action for injunctive relief to restrain a violation of chapter 183. The attorney general may institute an action for civil penalties against a covered entity, which may not exceed $5,000 for each negligent violation in a single year, $25,000 for each knowing or intentional violation in a single year, or $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain.

The appropriate regulatory agency may take disciplinary action against a covered entity that violates chapter 183 three or more times in the same manner as if the covered entity violated an applicable licensing or regulatory law. Chapter 183 was added by Acts 2025, 89th Legislature, chapter 1002 (Senate Bill 1188), effective September 1, 2025.

Section 2(b) of the Act that added chapter 183 provides that section 183.002 applies to the storage of an electronic health record on or after January 1, 2026, regardless of the date on which the record was prepared.

A data broker conducting business in Texas has a duty to protect the personal data it holds, and must develop, implement and maintain a comprehensive written information security program with administrative, technical and physical safeguards appropriate for its size, scope and type of business, its resources, the amount of data it stores and the need for security and confidentiality. The program must include the designation of one or more employees of the data broker to maintain it.

The program must incorporate safeguards that are consistent with the safeguards for protection of personal data and information of a similar character under state or federal laws and regulations applicable to the data broker. The program must provide a means for detecting and preventing security system failures.

The program must include security policies for the data broker's employees relating to the storage, access and transportation of records containing personal data outside the broker's physical business premises. The program must include measures for preventing a terminated employee from accessing records containing personal data.

The program must provide reasonable restrictions on physical access to records containing personal data, including by requiring the records to be stored in a locked facility, storage area or container. The program must include regular monitoring to ensure that it operates in a manner reasonably calculated to prevent unauthorized access to or unauthorized use of personal data and, as necessary, upgrading information safeguards to limit that risk.

The program must provide policies for supervising third-party service providers, including requiring them by contract to implement and maintain appropriate security measures for personal data. The program's security measures must be reviewed at least annually, and whenever there is a material change in the data broker's business practices that may reasonably affect the security or integrity of records containing personal data.

The program must require documentation of the responsive actions taken in connection with any incident involving a breach of security, including a mandatory post-incident review of each event.

To the extent technically feasible, the program must include secure user authentication protocols, secure access control measures, encryption of transmitted records and of personal data stored on laptop computers or other portable devices, reasonable monitoring of systems, firewall protection and operating system patches, and system security agent software with malware protection.

A violation of section 510.007 by a data broker is a deceptive trade practice actionable under Subchapter E of Chapter 17 of the code. In Chapter 17 of the code, the consumer protection division means the consumer protection division of the attorney general's office. The consumer protection division may bring an action in the name of the state to restrain an act or practice declared unlawful by Subchapter E of Chapter 17 by temporary restraining order or injunction.

In a proceeding under section 17.47(a), the consumer protection division may request, and the trier of fact may award, a civil penalty to the state of not more than $10,000 per violation and, where the act or practice was calculated to acquire or deprive money or other property from a consumer 65 years of age or older, an additional amount of not more than $250,000.

Senate Bill 2105 of 2023 added the duty, and House Bill 1620 of 2025 redesignated it from Chapter 509 to Chapter 510 of the code, effective September 1, 2025.

A data broker is a business entity that collects, processes or transfers personal data that it did not collect directly from the individual linked or linkable to the data. Personal data excludes deidentified data, employee data and publicly available information.

Chapter 510 applies only to a data broker that, in a 12-month period, derives more than 50 percent of its revenue directly from processing or transferring personal data it did not collect from the individuals, or derives revenue directly from the personal data of more than 50,000 individuals not collected from them.

The chapter does not apply to a service provider, a person or entity that collects personal data from another person or entity related to it by common ownership or corporate control where a reasonable consumer would expect them to share data, a governmental entity, an entity that serves as a congressionally designated nonprofit, national resource center or clearinghouse on missing and exploited children issues, a consumer reporting agency or other person or entity that furnishes information for inclusion in a consumer credit report or obtains a consumer credit report to the extent the Fair Credit Reporting Act regulates it, or a financial institution subject to Title V of the Gramm-Leach-Bliley Act.

The chapter does not apply to deidentified data that meets stated conditions, employee data, publicly available information, inferences made exclusively from multiple independent sources of publicly available information that do not reveal sensitive data, or data subject to Title V of the Gramm-Leach-Bliley Act.

A data broker that maintains a website or mobile application must post a conspicuous notice stating that it is a data broker, using language the secretary of state provides by rule, and telling a consumer how to exercise any consumer rights under Chapter 541. To conduct business in Texas, a data broker must register with the secretary of state by filing a registration statement and paying a registration fee of $300.

The registration statement gives the broker's legal name and contact details, a link to its consumer-rights instructions, the categories of data it processes and transfers, whether it uses a purchaser credentialing process, its practices for the data of a known child, and the number of security breaches it had in the preceding year. A registration certificate expires on the first anniversary of its issuance and is renewed by filing a renewal application and paying a renewal fee of $300.

A data broker that violates the notice or registration section is liable to the state for a civil penalty of at least $100 for each day of violation plus the unpaid registration fees for each year it failed to register, and the penalty may not exceed $10,000 against the same data broker in a 12-month period. The attorney general may bring an action to recover the civil penalty, and may recover reasonable attorney's fees and court costs.

As enacted in 2023 the definition reached only a business entity whose principal source of revenue is derived from collecting, processing or transferring personal data it did not collect directly from the individual. Senate Bill 2105 of 2023 added the chapter, then numbered 509, effective September 1, 2023, and applied it only to data collected, processed or transferred on or after December 1, 2023.

House Bill 1620 of 2025 redesignated the chapter from Chapter 509 to Chapter 510, effective September 1, 2025. Senate Bill 2121 of 2025 amended the chapter, effective September 1, 2025. Senate Bill 1343 of 2025 amended the chapter, effective September 1, 2025.

A covered entity must ensure each electronic health record system it uses to store electronic health records of minors allows a minor's parent or, if applicable, the minor's managing conservator or guardian to obtain complete and unrestricted access to the minor's electronic health record immediately. Access may be restricted where state or federal law or a court order restricts access to all or part of the record.

A minor is an individual 17 years of age or younger who has not had the disabilities of minority removed for general purposes. Chapter 183 applies only to an electronic health record prepared on or after the effective date of the act that added it.

The Texas Department of Insurance rule governs the treatment of nonpublic personal financial information about individuals by all covered entities. It requires a covered entity to provide notice to individuals about its privacy policies and practices. It describes the conditions under which a covered entity may disclose nonpublic personal financial information about individuals to nonaffiliated third parties and provides methods for individuals to prevent that disclosure.

The rule does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes.

TDPSA gives a Texas consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect, exercisable against the controller.

A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available, must answer an appeal of a refusal within 60 days, and must conduct and document a data protection assessment before targeted advertising, sale, certain profiling, sensitive-data processing, or other heightened-risk processing.

A covered entity is an individual or entity that receives an authorization from the Texas Department of Insurance, including an individual or entity described by section 82.002. A covered entity must comply with sections 6802 and 6803 of title 15 of the United States Code, as amended, in the same manner as a financial institution is required to comply under those sections.

An entity that is a nonaffiliated third party in relation to a covered entity must comply with section 6802(c) of title 15 of the United States Code, as amended. The commissioner of insurance must adopt rules to implement chapter 601. The Texas Department of Insurance enforces sections 6801 to 6805 of title 15 of the United States Code, as amended, to the extent section 6805 requires, and chapter 601.

The attorney general, after conferring with the commissioner, may institute an action for civil penalties against a covered entity or nonaffiliated third party for a violation of chapter 601, and a civil penalty may not exceed $3,000 for each violation. If a court finds that violations of chapter 601 have occurred with a frequency that constitutes a pattern or practice, the court may assess a civil penalty not to exceed $250,000. Chapter 601 was added by Acts 2003, 78th Legislature, chapter 1274, effective April 1, 2005.

The Texas Attorney General has exclusive authority to enforce TDPSA. Before suing, the Attorney General must give an alleged violator 30 days' written notice identifying the specific provisions violated; curing the violation within that period and confirming the cure in writing bars the action. An uncured violation is subject to a civil penalty of up to $7,500 per violation, and the chapter expressly bars any private right of action.

The Attorney General filed the state's first TDPSA enforcement action against Allstate Corp. and Arity LLC on January 13, 2025, over the sale of geolocation and driving-behavior data collected through SDKs embedded in third-party apps, and that case remains pending.

A person may not require an individual to disclose the individual's social security number to obtain goods or services from, or enter into a business transaction with, the person unless the person adopts a privacy policy, makes it available to the individual and maintains under it the confidentiality and security of the number disclosed.

The privacy policy must include how personal information is collected, how and when it is used, how it is protected, who has access to it and the method of its disposal.

Subchapter B does not apply to a person required to maintain a privacy policy under the Gramm-Leach-Bliley Act, the Family Educational Rights and Privacy Act or the Health Insurance Portability and Accountability Act, to an insurance covered entity under commissioner rules, to a governmental body other than a municipally owned utility, to a person not engaged in the business of making loans with respect to a loan transaction, or to a person subject to section 901.457 of the Occupations Code.

A person who violates section 501.052(a) is liable to this state for a civil penalty not to exceed $500 for each calendar month during which a violation occurs, and the penalty may not be imposed for more than one violation in a month. The attorney general may bring an action in the name of the state to restrain or enjoin a person from violating section 501.052(a).

The history note of section 501.052 lists Acts 2007, 80th Legislature, chapter 885 (House Bill 2278), section 2.01, effective April 1, 2009. House Bill 2278 (2007) is an act relating to a nonsubstantive revision of statutes relating to business and commerce.

TDPSA classifies genetic or biometric data processed to uniquely identify a person, along with racial or ethnic origin, religious belief, a mental or physical health diagnosis, sexuality, citizenship or immigration status, precise geolocation, and a known child's data, as sensitive data requiring the consumer's prior consent before a controller may process it.

'Biometric data' means data from automatic measurement of an individual's biological characteristics used to identify them, including a fingerprint, voiceprint, or eye retina or iris, but the definition expressly excludes data generated from a photograph, or from a video or audio recording, so an identifier derived solely from such a recording falls outside this consent duty.

Chapter 174 may be cited as the Texas Genomic Act of 2025. Chapter 174 applies to a medical facility, research facility, company or nonprofit organization that conducts research on or testing of genome sequencing or the human genome in this state.

A medical facility, research facility, company or nonprofit organization subject to chapter 174 may not use a genome sequencer or software produced by or on behalf of a foreign adversary, a state-owned enterprise of a foreign adversary, a company or nonprofit organization domiciled in a foreign adversary country, or an owned or controlled subsidiary or affiliate of such an organization.

A covered facility, company or organization must certify to the attorney general not later than December 31 of each year that it is in compliance with chapter 174. The attorney general may investigate an allegation of a violation of chapter 174. A medical facility, research facility, company or nonprofit organization that violates chapter 174 is liable to this state for a civil penalty of $10,000 for each violation, which the attorney general may bring an action to recover. Chapter 174 was added by Acts 2025, 89th Legislature, chapter 368 (House Bill 130), effective September 1, 2025.

A covered entity is any person who, for commercial, financial or professional gain or on a cooperative, nonprofit or pro bono basis, engages in whole or in part in assembling, collecting, analyzing, using, evaluating, storing or transmitting protected health information, comes into possession of it, obtains or stores it under the chapter, or is an employee, agent or contractor of such a person insofar as it handles protected health information.

Except for Subchapter D, chapter 181 does not apply to a covered entity as defined by section 602.001 of the Insurance Code, an entity established under Article 5.76-3 of the Insurance Code, or an employer. Each covered entity must provide training on state and federal law concerning protected health information to its employees, and an employee must complete the training not later than the 90th day after being hired.

A health care provider using an electronic health records system capable of fulfilling the request must provide a person's electronic health record in electronic form not later than the 15th business day after receiving the person's written request, unless the person agrees to accept another form.

A covered entity must prominently post on its Internet website and at any facility detailed instructions for a consumer to request health care records, contact the disciplinary or licensing authority and file a consumer complaint. A person may not reidentify or attempt to reidentify an individual who is the subject of any protected health information without the individual's consent or authorization if required under chapter 181 or other state or federal law.

A covered entity must obtain clear and unambiguous permission in written or electronic form to use or disclose protected health information for any marketing communication, except for the listed face-to-face, nominal gift, patient assistance program and oral request communications. A covered entity may not disclose an individual's protected health information to any other person in exchange for direct or indirect remuneration, except as section 181.153 allows.

A covered entity must provide notice to an individual whose protected health information is subject to electronic disclosure. Except as section 181.154(c) provides, a covered entity may not electronically disclose an individual's protected health information to any person without a separate authorization from the individual or the individual's legally authorized representative for each disclosure.

The attorney general may institute an action for injunctive relief to restrain a violation of chapter 181. The attorney general may institute an action for civil penalties against a covered entity, which may not exceed $5,000 for each violation in one year committed negligently, $25,000 for each such violation committed knowingly or intentionally, or $250,000 for each violation in which the covered entity knowingly or intentionally used protected health information for financial gain.

A court that finds violations of chapter 181 have occurred with a frequency that constitutes a pattern or practice may assess a civil penalty not to exceed $1.5 million annually. A violation of chapter 181 by a covered entity that is licensed by an agency of this state is subject to investigation and disciplinary proceedings, including probation or suspension by the licensing agency. Chapter 181 was added by Acts 2001, 77th Legislature, chapter 1511, effective September 1, 2001.

Section 5(b) of the 2001 Act that added chapter 181 provides that a covered entity shall comply with the requirements of chapter 181 not later than September 1, 2003. Section 181.001 was amended by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective September 1, 2012. Section 181.105 was added by Acts 2025, 89th Legislature, chapter 650 (House Bill 4224), effective September 1, 2025.

Section 181.101 was added by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective September 1, 2012. Section 181.102 was added by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective September 1, 2012. Section 181.153 was added by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective September 1, 2012. Section 181.154 was added by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective September 1, 2012. Section 181.201 was amended by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective September 1, 2012.

An employer commits an unlawful employment practice by failing or refusing to hire, discharging or otherwise discriminating against an individual on the basis of genetic information or because of the individual's refusal to submit to a genetic test, and a labor organization or employment agency commits one by the like conduct.

An employer is a person engaged in an industry affecting commerce with 15 or more employees, an agent of such a person, an individual elected to public office, or a county, municipality, state agency or state instrumentality regardless of the number of individuals employed. A reference in Labor Code chapter 21 to the commission means the Texas Workforce Commission. A person claiming to be aggrieved by an unlawful employment practice or the person's agent may file a complaint with the commission.

Within 60 days after receiving a notice of the right to file a civil action, the complainant may bring a civil action against the respondent. On finding that a respondent engaged in an unlawful employment practice, a court may prohibit the practice by injunction and order additional equitable relief as appropriate.

Compensatory damages for future pecuniary and nonpecuniary losses and punitive damages together may not exceed, for each complainant, $50,000 for a respondent with fewer than 101 employees, up to $300,000 for a respondent with more than 500 employees. Section 21.402 was added by Acts 1997, 75th Legislature, chapter 1215, effective September 1, 1997.

Under section 21.403(a), genetic information is confidential and privileged regardless of the source of the information, except as section 21.4031 provides. A person who holds genetic information about an individual may not disclose or be compelled to disclose, by subpoena or otherwise, that information unless the disclosure is specifically authorized as section 21.4032 provides.

Section 21.403 applies to a redisclosure of genetic information by a secondary recipient of the information after disclosure by an initial recipient. An individual or the individual's legal representative may authorize disclosure of genetic information by a written authorization that includes a description of the information to be disclosed, the name of the person to whom the disclosure is made and the purpose for the disclosure.

An individual who submits to a genetic test has the right to know the results, and on the written request of the individual the entity that performed the test must disclose the results to the individual or to a physician the individual designates. A sample of genetic material obtained from an individual for a genetic test must be destroyed promptly after the purpose for which it was obtained is accomplished, unless an exception in section 21.405 applies.

A person who discloses genetic information in violation of section 21.403 is liable for a civil penalty of not more than $10,000, and the attorney general may bring an action in the name of the state to recover the penalty plus reasonable attorney's fees and court costs. Section 21.403 was added by Acts 1997, 75th Legislature, chapter 1215, effective September 1, 1997.

Section 21.403 was amended by Acts 2003, 78th Legislature, chapter 965, effective June 20, 2003, and by chapter 1276, effective September 1, 2003.

A covered entity is a person who holds or is required to hold a license, registration, certificate of authority or other authorization under the Insurance Code or another insurance law of this state, including an insurance company, a health maintenance organization and an insurance agent.

Chapter 602 does not apply to a covered entity that is required to comply with the federal standards governing the privacy of individually identifiable health information adopted under the Health Insurance Portability and Accountability Act. Except as section 602.053 provides, a covered entity must obtain authorization to disclose nonpublic personal health information before disclosing the information.

A request for authorization to disclose nonpublic personal health information may be in written or electronic form and must state the identity of the consumer or customer, describe each type of information, each recipient, the purpose, the use and the revocation procedure, include a signature and date, and give notice of the validity period and the right to revoke at any time. The period for which an authorization is valid may not exceed 24 months.

The covered entity must retain the original or a copy of the authorization in the records of the individual who is the subject of the information. A covered entity may not knowingly or wilfully violate chapter 602. The attorney general may bring an action for a civil penalty against a covered entity or health care entity for a violation of chapter 602.

A civil penalty under section 602.103 may not be less than $3,000 for each violation, and a court that finds a pattern or practice may assess a civil penalty not to exceed $250,000. A covered entity that violates chapter 602 is subject to investigation, disciplinary proceedings, and probation or suspension of its license or other authorization to engage in business.

Subchapter C does not affect any right of a person under other law to bring a cause of action or otherwise seek relief for conduct that violates chapter 602. Chapter 602 was added by Acts 2003, 78th Legislature, chapter 1274, effective April 1, 2005. Section 602.054 was added by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective September 1, 2012. The sections this entry groups came into force on different days.

Chapter 546 applies only to a health benefit plan that provides benefits for medical or surgical expenses incurred as a result of a health condition, accident or sickness, including the listed forms of plan.

A health benefit plan issuer that requests an applicant to submit to a genetic test in connection with the application must notify the applicant that the test is required, disclose the proposed use of the results and obtain the applicant's written informed consent before the test is administered. A health benefit plan issuer may not use the results of a genetic test conducted under section 546.051(a) to induce the purchase of coverage under the plan.

A health benefit plan issuer may not use genetic information or an applicant's refusal to submit to a genetic test to reject, deny, limit, cancel, refuse to renew, increase the premiums for or otherwise adversely affect eligibility for or coverage under the plan. A sample of genetic material obtained from an individual for a genetic test must be destroyed promptly after the purpose for which it was obtained is accomplished, unless a listed exception applies.

An individual who submits to a genetic test has the right to know the results, and on the individual's written request the issuer or other entity that performed the test must disclose them to the individual or to a physician the individual designates. A person or entity that holds genetic information about an individual may not disclose or be compelled to disclose that information, by subpoena or otherwise, unless the individual specifically authorized the disclosure as section 546.104 provides.

On a finding that a health benefit plan issuer is in violation of chapter 546, the commissioner may issue a cease and desist order. A health benefit plan issuer that operates a plan in violation of chapter 546 is subject to an administrative penalty as provided by Insurance Code chapter 84. An administrative penalty under Insurance Code chapter 84 for a violation may not exceed $25,000, unless a greater or lesser penalty is specified by the Insurance Code or another insurance law of this state.

Chapter 546 was added by Acts 2003, 78th Legislature, chapter 1274, effective April 1, 2005. Section 546.002 was amended by Acts 2005, 79th Legislature, chapter 670, effective September 1, 2005. Section 546.151 was amended by Acts 2005, 79th Legislature, chapter 670 (Senate Bill 53), effective September 1, 2005. Section 546.152 was amended by Acts 2005, 79th Legislature, chapter 670 (Senate Bill 53), effective September 1, 2005. The provisions this entry describes came into force on different days.

Section 501.001(a) bars a person other than a government from intentionally communicating or making an individual's social security number available to the public, displaying it on a card required to access a product or service, requiring its transmission over the Internet unless the connection is secure or the number is encrypted, requiring it for access to a website unless a password or other authentication device is also required, and printing it on mailed material unless state or federal law requires it.

On a written request from an individual to stop using the individual's social security number in a manner section 501.001(a) prohibits, the person must comply not later than the 30th day after the request is received and may not impose a fee.

Section 501.001 does not apply to the collection, use or release of a social security number required by state or federal law, its use for internal verification or administrative purposes, a document recorded or required to be open to the public, a court record, or an institution of higher education whose use is regulated by the Education Code. The history note of section 501.001 lists Acts 2007, 80th Legislature, chapter 885 (House Bill 2278), section 2.01, effective April 1, 2009. House Bill 2278 (2007) is an act relating to a nonsubstantive revision of statutes relating to business and commerce.

A person may not print an individual's social security number on a card or other device required to access a product or service the person provides unless the individual has requested that printing in writing. A person who violates section 501.002 is liable to this state for a civil penalty not to exceed $500 for each violation, which the attorney general or the prosecuting attorney in the county of the violation may bring an action to recover.

The attorney general may bring an action in the name of the state to restrain or enjoin a person from violating section 501.002. Section 501.002 does not apply to the collection, use or release of a social security number required by state or federal law or to its use for internal verification or administrative purposes. The history note of section 501.002 lists Acts 2007, 80th Legislature, chapter 885 (House Bill 2278), section 2.01, effective April 1, 2009. House Bill 2278 (2007) is an act relating to a nonsubstantive revision of statutes relating to business and commerce.

An operator is the operator of a website, online service, online application or mobile application, to the extent operating in that capacity, with actual knowledge that it is used primarily for a school purpose and was designed and marketed for a school purpose.

Covered information is personally identifiable information, or information linked to it, that is not publicly available and that a student or parent provides to an operator, an employee of a school district or campus provides to an operator, or an operator gathers, for a school purpose and that personally identifies a student.

An operator may not knowingly engage in targeted advertising based on information acquired through the school use of its service, use information it creates or gathers to create a profile about a student unless the profile is created for a school purpose, or, except as section 32.152(c) provides, sell or rent any student's covered information.

An operator may disclose covered information to a third party it has contracted with to provide a service for a school purpose, and the contract must prohibit the third party from using covered information for any other purpose and the operator must require the third party to implement and maintain reasonable procedures and practices designed to prevent disclosure.

An operator must implement and maintain reasonable security procedures and practices designed to protect any covered information from unauthorized access, deletion, use, modification or disclosure.

If a school district requests deletion of a student's covered information under its control and maintained by the operator, the operator must delete it not later than the 60th day after the request, or as the contract or terms of service specify, unless the student or the student's parent consents to the operator's maintenance of the information. Subchapter D does not apply to general audience websites, online services, online applications or mobile applications.

Subchapter D was added by Acts 2017, 85th Legislature, chapter 355 (House Bill 2087), effective September 1, 2017. Section 32.155 was amended by Acts 2021, 87th Legislature, chapter 806 (House Bill 1525), effective September 1, 2023.

Subsection (a) makes it a Class B misdemeanor to knowingly access a computer, computer network, or computer system without the effective consent of the owner.

A separate, more serious offense, subsection (b-1), is Texas's own statutory answer to the ToS and robots.txt authorization question: it applies where a person, with intent to defraud or harm another or to alter, damage, or delete property, knowingly accesses a computer system owned by government or a business in violation of either a clear and conspicuous prohibition posted by the owner or a contractual agreement the person expressly agreed to.

A posted no-scraping notice or a clickwrap agreement therefore carries independent legal weight in Texas, but only elevates exposure when paired with fraudulent or harmful intent, not for ordinary commercial data collection alone. No Texas case law applying subsection (b-1) or CUBI's publicly available media clause to a scraping fact pattern was found.

CUBI, added in 2007 by Acts 2007, 80th Legislature, chapter 885, section 2.01, effective April 1, 2009 and amended by HB 149 (TRAIGA, 2025 Legislature, effective January 1, 2026), requires that a person inform an individual before capturing a biometric identifier (a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry) for a commercial purpose and receive that individual's consent.

The 2025 amendment adds a rule bearing directly on scraping: the mere existence of an image or other media containing someone's biometric identifiers on the Internet or another publicly available source does not, by itself, count as that person having been informed of or having consented to the capture or storage of their biometric identifier for a commercial purpose, unless the individual themselves made that image or media publicly available.

A separate clause in the same 2025 amendment exempts the training, processing, or storage of biometric identifiers to develop, train, evaluate, disseminate, or otherwise offer an artificial intelligence system, unless that system is used or deployed to uniquely identify a specific individual. A civil penalty of not more than $25,000 per violation is recoverable solely by the Attorney General; CUBI carries no private right of action, unlike Illinois's Biometric Information Privacy Act (BIPA).

TDPSA applies to any person conducting business in Texas, or producing a product or service consumed by Texas residents, that processes or sells personal data and is not a small business as defined by the United States Small Business Administration, except that the sensitive-data-sale consent duty in section 541.107 applies even to a small business.

This is deliberately not a fixed dollar-revenue or consumer-count threshold; the SBA's small-business size standards vary by industry, often revenue in the tens of millions or employee counts in the hundreds, so TDPSA reaches many mid-sized data collectors that fall below other states' 100,000-consumer or $25-million thresholds.

Personal data excludes deidentified data and publicly available information, defined as information lawfully available through government records or that a business has a reasonable basis to believe is lawfully available to the public through widely distributed media, by the consumer, or by a person the consumer disclosed it to. Enforcement is by the Attorney General only, with a 30-day cure period; TDPSA carries no private right of action.

A business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information may invoke a safe harbor from exemplary damages. In an action arising from a breach of system security, such an entity may not be held liable for exemplary damages if it demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program conforming to a named industry-recognized framework and scaled to its size. The chapter creates a safe harbor from a category of damages, not a freestanding duty to adopt a program.

A business must implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect from unlawful use or disclosure any sensitive personal information it collects or maintains in the regular course of business. A business must also destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise rendering it unreadable or indecipherable.

A financial institution as defined by 15 U.S.C. § 6809 is exempt from the destruction duty, and the section states no further content for what 'reasonable' requires beyond the general standard.

A state agency or local government that owns, licenses, or maintains computerized data that includes sensitive personal information, confidential information, or information the disclosure of which is regulated by law must, in the event of a cybersecurity incident, notify the Texas Cyber Command, including the chief, not later than 48 hours after the discovery of the incident.

If the cybersecurity incident involves election data, the state agency or local government notifies the secretary of state instead of the command. Not later than the 10th business day after the eradication, closure, and recovery from a cybersecurity incident, a state agency or local government shall notify the command of the details of the incident and include an analysis of its cause.

Section 2063.302 does not apply to a cybersecurity incident that a local government is required to report to the independent organization certified by the Public Utility Commission of Texas under Section 39.151 of the Utilities Code. Contract language in a cybersecurity insurance contract or other contract for goods or services that prohibits or restricts a state agency's or local government's compliance with the section, or otherwise circumvents its requirements, is void and unenforceable.

A cybersecurity incident includes a breach or suspected breach of system security, the introduction of ransomware into a computer, computer network, or computer system, and any other cybersecurity-related occurrence that jeopardizes information or an information system designated by command policy. Section 2063.302 was transferred, redesignated and amended from Government Code section 2054.603 by chapter 331 of the Acts of 2025, effective September 1, 2025.

A holder of a money transmission or currency exchange license issued under Finance Code chapter 152 must notify the banking commissioner as soon as practicable but prior to customer notification, and not later than 15 days following its determination that a cybersecurity incident regarding its information system will likely trigger a listed consequence.

The listed consequences are a required notice to another regulator or law enforcement agency, a data breach notification to customers, or a substantive impact on its ability to effect or report transactions or conduct its business. "You" in section 33.30 means a holder of a money transmission or currency exchange license issued under Finance Code chapter 152.

The notice must include, to the extent known, a description of the incident, a list of the regulators notified, and the name and contact details of an employee or agent from whom additional information may be obtained. The notice requirement must be incorporated into the written incident response plan the licensee maintains as part of its information security program. Section 33.30 was adopted to be effective January 2, 2020, and amended to be effective November 16, 2023.

A state bank shall notify the banking commissioner and submit the information required by 12 CFR Part 225, Subpart N, or Part 304, Subpart C, as applicable, regarding a computer-security incident that qualifies under those regulations as a notification incident. The notice is due no later than the time the information is required to be submitted to the applicable federal regulatory agency.

The Texas Department of Banking states that financial institutions are required to notify regulators within 36 hours after determining a notification incident has occurred. Section 3.24 was adopted to be effective January 2, 2020, and amended to be effective September 8, 2022.

A state trust company shall notify the banking commissioner as soon as practicable but prior to customer notification, and not later than 15 days following its determination that a cybersecurity incident regarding its information system will likely trigger a listed consequence. The listed consequences are a required notice to another regulator, a data breach notification to clients or beneficiaries, or a substantive impact on its ability to effect transactions or conduct its business.

The confidential notice must include, to the extent known, a brief description of the incident, a list of the regulators notified, and the name and contact details of an employee or agent from whom additional information may be obtained. The notice requirement must be incorporated into the trust company's written incident response plan, maintained as part of its information security program. Section 17.5 does not apply to a state trust company that is exempt under Finance Code section 182.011. Section 17.5 was adopted to be effective January 2, 2020.

A person may not intentionally transmit an unsolicited commercial electronic mail message that falsifies its transmission or routing information, or any commercial electronic mail message with false, deceptive or misleading information in the subject line or that uses another person's Internet domain name without consent.

An unsolicited commercial electronic mail message is one sent without the recipient's consent by a person with whom the recipient has no established business relationship (one formed by a voluntary two-way communication about a product or service and not terminated), and the term excludes an organization's email communicating only with its members, employees or contractors.

Those prohibitions are framed as rules against falsity or deception, the kind of state email rule the CAN-SPAM Act's preemption clause leaves in force; the labeling and removal duties are not framed that way.

A person may not intentionally transmit an unsolicited commercial electronic mail message unless "ADV:" appears first in its subject line, or "ADV: ADULT ADVERTISEMENT" for obscene material or material depicting sexual conduct, and the sender provides a functioning return address to which a recipient can send a removal request at no cost; the sender must remove the address within three days after receiving the request.

A sender may not sell or otherwise provide to another the address of a person who has asked to be removed, except as other law requires. A person is not liable for a commercial electronic mail message transmitted by error or accident, and a sender who contracts in good faith with an electronic mail service provider to transmit its messages, with no reason to believe the provider will violate the chapter, is not liable for a message that violates it.

Intentionally transmitting a message with obscene material or material depicting sexual conduct without the adult-advertisement label is a Class B misdemeanor. A violator is liable to the state for a civil penalty of not more than the lesser of $10 for each unlawful message or $25,000 for each day, which the attorney general or a local prosecuting attorney may recover with an injunction and expenses.

A violation is also a false, misleading or deceptive act under the Deceptive Trade Practices Act, except that no action under the chapter may be certified as a class action.

A person injured by a violation may recover actual damages, including lost profits, or in lieu of them the lesser of $10 for each unlawful message or $25,000 for each day it is received, while an injured electronic mail service provider may recover the greater of those amounts, and a prevailing plaintiff recovers attorney's fees and costs.

Section 324.051 of the Business and Commerce Code bars a person other than the owner or operator of a computer from knowingly causing computer software to be copied to a computer in Texas and using it to collect personally identifiable information through intentionally deceptive means, by a keystroke-logging function or in a manner that correlates the information with all or substantially all of the websites the owner or operator visits.

Section 324.051 also bars using the software to cull, through intentionally deceptive means, a card number, bank account number, password or access code, social security number, account balance or overdraft history from the hard drive for a purpose wholly unrelated to the purposes of the software or service described to the owner or operator.

Section 324.052 bars the same person from knowingly causing software to be copied to a computer in Texas and using it to modify, through intentionally deceptive means, the browser start page, the default provider or web proxy, or the bookmarks list.

Section 324.052 also bars using the software to take control of the computer by using its modem or Internet service to cause damage or unauthorized charges, or by opening advertisements, without the consent of the owner or operator, that an ordinarily reasonable person cannot close without closing the browser or shutting down the computer.

Section 324.052 further bars using the software to modify settings relating to Internet access and the protection of information for the purpose of stealing personally identifiable information, or security settings for the purpose of causing damage to one or more computers.

Section 324.053 bars the same person from using the software to prevent, through intentionally deceptive means, the owner's reasonable efforts to block or disable software by causing software the owner has properly removed or disabled to reinstall or reactivate itself. Section 324.053 also bars using the software to remove, disable or render inoperative, through intentionally deceptive means, security, antispyware or antivirus software installed on the computer.

Section 324.053 also bars using the software to change its name, location or other designation, or to create randomized or deceptive file names, directory folders, formats or registry entries, so that the owner cannot locate or remove it.

Section 324.054 bars a person other than the owner or operator of a computer from inducing the owner or operator to install a software component by intentionally misrepresenting the extent to which installation is necessary for security or privacy reasons, to open or view text, or to play musical or other content. Section 324.055 separately bars a person who is not the owner or operator of a computer from knowingly causing or offering to cause the computer to become a zombie or part of a botnet.

A person knowingly violates sections 324.051, 324.052, 324.053 or 324.055 if the person acts with actual knowledge of the facts that constitute the violation or consciously avoids information that would establish actual knowledge of those facts. The owner or operator of a computer is its owner or lessee, or an individual using it with the authorization of the owner or lessee.

Causing software to be copied does not include transmitting or routing it, intermediate temporary storage or caching, providing a storage medium, a website, distribution of software by a third party through a computer server, or an information location tool through which the user locates the software.

A person acts through intentionally deceptive means if, with the intent to deceive the owner or operator of a computer, the person makes a materially false or fraudulent statement, makes a statement or uses a description that omits or misrepresents material information, or materially fails to give the owner or operator any notice of the installation or execution of the software.

Section 324.052 other than its subdivision (1), section 324.053(4), section 324.054 and section 324.055 do not apply to a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service that monitors or interacts with a subscriber's connection or a protected computer for network or computer security, diagnostics, technical support or repair, authorized updates, authorized remote system management, or detection or prevention of unauthorized use or fraud.

A provider of computer software, an owner of a web page or trademark, a telecommunications carrier, a cable operator or an Internet service provider adversely affected by a violation of section 324.051, 324.052, 324.053 or 324.054 may bring a civil action against the violator. That plaintiff may obtain an injunction and damages equal to the greater of actual damages or $100,000 for each violation of the same nature.

The court may increase an award of actual damages to not more than three times the actual damages if the violation has reoccurred with sufficient frequency to constitute a pattern or practice. A person who violates the chapter is liable to the state for a civil penalty of not more than $100,000 for each violation, which the attorney general may sue to recover. The chapter was added by House Bill 2278 of the 80th Legislature and took effect April 1, 2009.

A person commits an offense by knowingly installing or using a pen register or trap and trace device to record or decode electronic or other impulses for the purpose of identifying telephone numbers dialed or otherwise transmitted on a telephone line.

It is an affirmative defense that the actor is a communication common carrier's officer, employee or agent recording numbers in the normal course of the carrier's business to protect its property or services or to assist a peace officer the actor reasonably believes is authorized, an officer, employee or agent of a lawful enterprise acting as a necessary incident to the enterprise's services or the protection of its property and not to gather information for a law enforcement or private investigative agency (other than about theft of its communication or information services), or a person authorized under Code of Criminal Procedure chapter 18B. Chapter 18B lets a judge order the installation and use of a pen register, ESN reader or similar equipment by an authorized peace officer.

An offense is a state jail felony, and the section gives no private civil action.

It is an offense to intentionally intercept, or procure another to intercept, a wire, oral or electronic communication, to intentionally disclose its contents knowing or having reason to know they were obtained by an unlawful interception, or to intentionally use them knowing or being reckless about whether they were.

It is an affirmative defense that a person not acting under color of law is a party to the communication or one of its parties has given prior consent, unless the communication is intercepted for the purpose of committing an unlawful act.

It is also an affirmative defense to intercept or access an electronic communication made through a system configured so that it is readily accessible to the general public, and for a provider of electronic communications service to record that a communication was initiated or completed to protect itself, another provider or a user from fraudulent, unlawful or abusive use.

A party to a communication, not a third party, may sue a person who intercepts it, uses or divulges information the person knows or reasonably should know was obtained by intercepting it, or, as a landlord, building operator or communication common carrier, aids or knowingly permits the interception.

Interception for that civil action is the aural acquisition of a communication's contents through an interception device without the consent of a party to it, so one party's consent is enough there too, and it excludes the ordinary use of telephone equipment, a hearing aid, a radio or television receiver, or a cable system relaying a public broadcast.

That chapter's communication is speech uttered by a person or information including speech transmitted with the aid of a wire or cable, narrower than the offense's wire, oral or electronic communication. A prevailing plaintiff recovers an injunction, statutory damages of $10,000 for each occurrence, all actual damages above $10,000, punitive damages, and reasonable attorney's fees and costs.

A communication common carrier's officer, employee or agent may intercept, disclose or use a communication in the normal course of employment where necessary to service or to protect the carrier's rights or property, but a carrier may not use service observation or random monitoring except for mechanical or service-quality checks.

An automated dial announcing device is automated equipment used for telephone solicitation or collection that can store numbers to call, or produce them with a random or sequential number generator, and play a prerecorded or synthesized voice message without a live operator, and the subchapter reaches such a device used to make a call that originates or terminates in Texas.

A person may not use such a device without a Public Utility Commission permit, renewed annually, and may not use it to play a recorded message on connection without first giving each telecommunications utility whose system it will use written notice of the device. The device may not be used for random or sequential number dialing when it plays a recorded message on connection.

It may not be used for a solicitation call terminating in Texas before noon or after 9 p.m. on a Sunday, or before 9 a.m. or after 9 p.m. on a weekday or Saturday, or for a collection call at an hour the federal Fair Debt Collection Practices Act prohibits. It must disconnect from the called person's line within five seconds after either party ends the call; if it cannot, a live operator must introduce the call and receive the called person's oral consent before the message begins.

Its recorded message must state within the first 30 seconds the nature of the call, the caller's identity and the number calling from, with added disclosures where the call promotes a pay-per-call service. A solicitation message must be shorter than 30 seconds unless the device can recognize an answering machine on the line and end the call within 30 seconds.

These rules do not reach a device used for an emergency or approved public-service call, by a school locating a truant student, by or for a municipality delivering public-health, safety or welfare information, or by an organization calling its own member. The owner or operator must notify the Commission by certified mail at least 48 hours before changing the device's number or address, or the permit is invalid.

The Commission may impose an administrative penalty of up to $1,000 for each day or part of a day the device operates in violation. On a Commission or court determination of a violation, the telecommunications utility must disconnect the violator's service. Knowingly owning or operating a device that is operating in violation of the subchapter is a Class A misdemeanor, and the subchapter states no private civil action.

A person may not make, or use an automatic dial announcing device to make, a telephone call for the purpose of making a sale if the person knows or should have known that the called number is a mobile telephone for which the called person will be charged for that call, and the called person has not consented to the call to the caller or the business it calls for.

A person may not make or cause a facsimile transmission for the purpose of a solicitation or sale to a device the recipient will be charged for without the recipient's prior consent, or to a facsimile device after 11 p.m. and before 7 a.m. A violation is a Class C misdemeanor, which the county or district attorney where the called person resides investigates on complaint.

A person who receives a communication that violates the federal Telephone Consumer Protection Act or its regulations, or these prohibitions, may sue the person who originated it for an injunction, damages of the greater of $500 for each violation or actual damages, or both, which a court may increase for a knowing or intentional violation to not more than the greater of $1,500 for each violation or three times actual damages.

Senate Bill 140, effective September 1, 2025, made a violation of this chapter a deceptive act under the Deceptive Trade Practices Act, whose public and private remedies may enforce it. A companion clause added the same session provides that a claimant who has recovered more than once under a private action arising from a violation of the chapter is not limited in a future recovery.

A seller may not make a telephone solicitation from a location in Texas or to a purchaser located in Texas unless it holds a registration certificate from the Secretary of State for each business location from which it solicits, obtained on a verified registration statement, a $200 filing fee and $10,000 in security, renewed annually and updated each quarter with the salespeople who solicited for it.

A telephone solicitation is a call or other transmission, including a text or graphic message or an image, initiated by a seller or salesperson to induce a person to purchase, rent, claim or receive an item, and includes a call a purchaser makes in response to a solicitation sent by mail or other means.

Senate Bill 140, effective September 1, 2025 for conduct on or after that date, redefined telephone solicitation in those terms and gave the chapter the chapter 304 definition of telephone call, which includes a text message to a mobile number. The Senate Research Center's analysis of the bill states that chapter 302 previously did not define telephone call or contemplate text messaging.

The chapter does not apply to, among others, a person offering qualified securities, a publicly traded corporation registered with the Securities and Exchange Commission or the State Securities Board or its subsidiary or agent, an insurance licensee on an Insurance Code transaction, a supervised financial institution or its affiliate, an educational institution or 501(c)(3) nonprofit, a seller of newspaper, magazine or cable subscriptions, a food seller, a sale to a business buying for resale or manufacturing, a seller soliciting a former or current customer under the same business name for at least two years, a seller who only arranges a later face-to-face sales presentation, a retailer operating a store under the same name for at least two years where most of its business is at the store, or an isolated transaction.

Before a telephone-solicited sale is completed, the seller must give the purchaser the street address of the calling location and its principal location and, where it offers a free item, a below-market price or an oil, gas or mineral interest, the information the chapter specifies.

Knowingly violating the registration, quarterly-addendum, posting, disclosure or no-compliance-reference duties, knowingly acting as a salesperson for an unregistered seller, or requiring a credit card or checking account number as a condition of receiving an item offered free is a Class A misdemeanor. The Attorney General may enjoin a violation and recover a civil penalty of up to $5,000 for each violation, rising to $25,000 per violation and $50,000 in aggregate for violating an injunction.

A violation of this chapter is a false, misleading or deceptive act under the Deceptive Trade Practices Act, whose public and private remedies may enforce it. That Act lets a prevailing consumer recover economic damages, increased up to three times for a knowing violation, plus attorney's fees, after the consumer gives the business 60 days' written pre-suit notice of the claim.

A claimant who has recovered under a private action arising from a violation of the chapter more than once is not limited in a future recovery.

A telemarketing call is an unsolicited telephone call made to solicit a sale of a consumer good or service, an extension of credit for one, or information that may be used for either, and a telephone call includes a text or graphic message or an image sent to a mobile number.

The chapter does not apply to a call made by a consumer in response to a solicitation or general advertising, a call in connection with an established business relationship (one formed by a voluntary two-way communication about a consumer good or service and not terminated) or with a recently terminated one, a call to a business (other than by facsimile) that has not asked not to be called, a debt-collection call, or a qualifying call by a state licensee that ends in a face-to-face presentation.

A telemarketer may not make a telemarketing call to a number on the Texas no-call list more than 60 days after it appears on the current list, which combines consumer requests with the Texas portion of the National Do Not Call Registry and whose entries expire after three years unless renewed.

A person in Texas making a facsimile solicitation must include, in at least 12-point type, its complete name and street address and a toll-free or local number answered by a person on weekdays from 9 a.m. to 5 p.m. or that automatically deletes the recipient's number, and on a stop request must send a written acknowledgment within 24 hours and make no further transmission to that number.

In making a telemarketing call, a telemarketer may not block its number, interfere with or circumvent a caller identification service, fail to provide caller identification information it is capable of providing, or transmit misleading caller identification information, though it may substitute the name and number of the person on whose behalf it calls.

The Public Utility Commission may impose an administrative penalty of up to $1,000 for each violation, and the Attorney General may recover a civil penalty of up to $1,000 for each violation, rising to $3,000 for each violation on a finding of a willful or knowing violation.

A consumer on the Texas no-call list whom a telemarketer calls more than once may sue for a second or later violation only after notifying the telemarketer, filing a verified complaint with the Commission, the Attorney General or a licensing agency within 30 days of the call, and that agency's not bringing an action before the 121st day after the complaint, and damages of up to $500 for each violation are available only on a finding of a willful or knowing violation.

A person may sue over a facsimile-solicitation violation for the greater of actual monetary loss or $500 for each violation, which a court may increase to not more than three times that amount for a willful or knowing violation. Senate Bill 140, effective September 1, 2025, made a violation of the chapter a deceptive act under the Deceptive Trade Practices Act, whose public and private remedies may enforce it, and provided that a claimant's earlier recoveries do not limit a future recovery.

Requires a commercial entity that knowingly and intentionally publishes or distributes material on a website, including a social media platform, more than one third of which is sexual material harmful to minors, to use reasonable age verification methods for Texas visitors.

House Bill 581 of 2025 (chapter 720) amended section 129B.002 effective September 1, 2025. Under the amended section, a commercial entity that operates a website with a publicly accessible tool for creating artificial sexual material harmful to minors, or otherwise makes publicly available an application for creating sexual material harmful to minors, must also use reasonable age verification methods to verify that an individual attempting to access the tool is 18 years of age or older.

An entity is outside that duty if its terms and conditions or use policies, which a user must acknowledge before being granted access, prohibit the generation of artificial sexual material harmful to minors, and it takes affirmative steps to limit the creation of that material through technological tools.

Section 129B.002(b) bars a commercial entity, or a third party that performs the age verification, from retaining any identifying information of the individual, including when the verification is required for the artificial sexual material tool.

Artificial sexual material harmful to minors is computer-generated sexual material harmful to minors that was produced, adapted, or modified using an artificial intelligence application or other computer software and in which a person is recognizable as an actual person.

House Bill 581 also added section 129B.0045 effective September 1, 2025.

Section 129B.0045 requires a commercial entity that operates a website with a publicly accessible tool for creating artificial sexual material harmful to minors, or otherwise makes publicly available an application for creating artificial sexual material harmful to minors, to ensure that any individual used as a source for the material is 18 years of age or older and has consented to the use of the individual's face and body as a source, unless the entity falls within the exemption in section 129B.002(a-2).

Requires app store providers to verify a user's age category, link a minor's account to a parent account, and obtain parental consent before a minor can download an app or make an in app purchase, and to share age and consent information with app developers. Violations are deceptive trade practices under Texas consumer protection law.

Requires digital service providers to determine whether a Texas account holder is a known minor based on self reported age at registration, and, unless a verified parent provides otherwise, by default limit data collection and use, and restrict targeted advertising, data sharing, and specified design features for known minors.

A federal court enjoined the monitoring and filtering requirement for the two trade associations that sued, and on July 24, 2026 the Fifth Circuit affirmed that injunction on the ground that Section 230 of the Communications Decency Act preempts the requirement. The same opinion vacated a second order that had enjoined the targeted advertising, unlawful advertising and age-verification requirements.

On October 28, 2026 the full Fifth Circuit granted rehearing en banc and vacated that panel opinion, so the appeal will be reheard by the full court. With the panel opinion vacated, the district court's preliminary injunctions of August 30, 2024 and February 7, 2025 again govern while the full court rehears the appeal.