// SCOPE
Web analytics, cookies, tag managers, CMPs, ad pixels, session-replay, and biometric-capable tools as deployed on websites and apps targeting Texas consumers. TDPSA applies to anyone 'conducting business in Texas' except SBA-defined small businesses; CUBI applies regardless of size whenever a biometric identifier is captured. English + Spanish notice considerations are noted but not formally mandated by TDPSA.
National addons
Country-specific statutes layered on the EU baseline.
TDPSA
Texas Data Privacy and Security Act
Comprehensive consumer privacy law. Unlike CCPA/VCDPA/CPA, TDPSA has no revenue or data-volume threshold — it applies to any person who (1) conducts business in Texas or produces products/services consumed by Texas residents, (2) processes or engages in the sale of personal data, and (3) is not a 'small business' as defined by the United States Small Business Administration. Among comprehensive US state-privacy laws as of 2026-05-06 this is one of the broadest statutory scopes. Opt-out model: rights to know, correct, delete, port, and opt out of (a) sale, (b) targeted advertising, (c) profiling with legal/significant effects.
- § 541.051 Applicability — 'small business' (SBA) carve-out is the only size filter; no revenue/consumer thresholds
- § 541.052 Consumer rights — know, correct, delete, port, opt-out of sale/targeted ads/profiling
- § 541.055 Sensitive data — opt-in consent required (genetic/biometric, precise geolocation, race/ethnicity, religion, health, sexuality, citizenship/immigration, children's data)
- § 541.101 Privacy notice + 'sale of sensitive personal data' / 'sale of biometric data' specific banner-text mandates
- § 541.105 Data protection assessments — required for high-risk processing (targeted ads, sale, sensitive data, profiling)
- §§ 541.151–541.155 Enforcement (Subchapter D) — exclusive AG authority, civil penalty up to $7,500 per violation, 30-day cure period; controllers should consult the enacted code text for the precise subsection mapping (cure period and penalty caps live in adjacent subsections within Subchapter D)
CUBI
Capture or Use of Biometric Identifier Act
Biometric-specific law: prohibits capturing a biometric identifier (retina/iris scan, fingerprint, voiceprint, hand/face geometry) for a commercial purpose without prior informed consent. Captured biometrics may not be sold/leased/disclosed except in narrow exceptions, must be reasonably protected, and must be destroyed within 1 year of the original purpose. AG-only enforcement — no private right of action (distinguishing CUBI from Illinois BIPA). The Google ($1.4B) and Meta ($1.4B) settlements were both anchored in CUBI claims (face-grouping in Photos, face-tagging on Facebook).
- § 503.001(b) Prior informed consent required before capturing a biometric identifier
- § 503.001(c)(1) Sale/lease/disclosure of biometric identifiers prohibited except narrow exceptions
- § 503.001(c)(3) Destruction within 1 year of original purpose (or earlier on request)
- § 503.001(d) Civil penalty — up to $25,000 per violation; AG enforces
SCOPE Act
Securing Children Online through Parental Empowerment Act
Minors-only protections (under 18 — broader than COPPA's under-13 federal floor). 'Digital service providers' must (1) register the age of every user, (2) prohibit targeted advertising to known minors, (3) disable algorithmic recommendation/personalization based on a minor's data, (4) prohibit sale of minors' personal information without parental consent, (5) provide parental tools for monitoring/disabling features. Partially enjoined Aug 2024 (1st Amendment grounds for 'harmful content' filtering provisions) — privacy provisions remain in force.
- § 509.052 Age registration — service must register a user's age category before collection
- § 509.053 Prohibition on targeted advertising / data sale / algorithmic personalization for known minors
- § 509.055 Parental tools — monitoring + content/feature controls
- § 509.151 Enforcement — AG only; injunctive relief + civil penalties up to $10,000 per violation
TITEPA
Texas Identity Theft Enforcement and Protection Act
Pre-TDPSA security baseline: businesses holding 'sensitive personal information' (SSN, government ID, financial-account, biometric, health, insurance, login credentials) must implement reasonable safeguards, notify affected consumers within 60 days of a breach affecting 250+ Texans, and notify the AG within 30 days. Continues to operate alongside TDPSA — TDPSA does not displace breach-notification obligations.
- § 521.052 Reasonable safeguards for sensitive PI
- § 521.053 Breach notification — 60 days to consumers (250+ TX residents triggers AG notification within 30 days)
- § 521.151 Civil penalty up to $50,000 per violation; AG enforces
Regulators
Supervisory authorities that interpret and enforce privacy law here.
State / Land DPAs · 1 authorities
| Land / state | Authority | Note | |
|---|---|---|---|
| Texas — OAG | Office of the Attorney General of Texas | Sole enforcer of TDPSA, CUBI, SCOPE Act, and TITEPA. Created a dedicated Consumer Privacy Unit in June 2024 — staffed with attorneys, investigators, and IT experts focused on privacy enforcement. Under AG Ken Paxton, the Texas OAG has been among the most active US-state attorneys general on privacy enforcement, including two of the largest US privacy settlements to date (Google $1.375B announced May 2025; Meta $1.4B Jul 2024) and ongoing TikTok litigation. No private right of action under TDPSA or CUBI — leverage is concentrated in the AG office. | site ↗ |
Coordination body
Texas OAG Consumer Privacy Unit · Office of the Attorney General — Consumer Privacy Unit
Single-regulator model. The OAG Consumer Privacy Unit (created June 2024) consolidates TDPSA + CUBI + SCOPE Act + TITEPA enforcement. No state-level data protection authority, no private right of action, no concurrent agency (contrast with California's CPPA + AG split). Enforcement priorities published via press releases and public notices; no formal binding opinions, but settlement language is treated as de facto authority by Texas-based counsel.
- 2024-06-04 · Consumer Privacy Unit launch — AG Paxton announces a dedicated privacy enforcement team — first US state AG to create a unit exclusively for privacy/AI/biometric enforcement. Stated priorities: TDPSA compliance, biometric (CUBI), data brokers, children's data (SCOPE).
- 2024-07-30 · TDPSA enforcement priorities — Six-month-out compliance notices issued to controllers operating in Texas; OAG warned that absence of revenue/consumer thresholds means 'small businesses' (SBA-defined) are the only carve-out — every non-small business operating in Texas should expect coverage.
- 2024-10-03 · TikTok lawsuit — Texas OAG sues TikTok for SCOPE Act violations + biometric collection from minors without verifiable parental consent. Pending in 2026.
Notable enforcement
As of 2026-05-06 Texas is among the most active single-regulator US-state privacy enforcers. The July 2024 Meta $1.4B and May 2025 Google $1.375B settlements — both anchored in CUBI biometric claims (face-tagging on Facebook, face-grouping in Photos) plus parallel TX UDAP theories — are reported as two of the largest US state-privacy settlements to date, materially above California's prior Healthline $1.55M ceiling. AG Ken Paxton has positioned the office as a leading US enforcer on biometric and big-tech cases, leveraging CUBI's pre-existing 2009 baseline (15 years older than TDPSA) to reach conduct beyond TDPSA's 1-Jul-2024 effective date. Distinctive structural features amplify this: (1) no revenue/consumer thresholds in TDPSA — among the broadest US state-law scopes; (2) no private right of action — leverage concentrated in OAG; (3) Consumer Privacy Unit (created June 2024) focused on privacy, biometric, AI, and SCOPE Act work; (4) 30-day cure period preserved (not sunsetted) — observed in practice as a procedural step rather than a safe harbor. Active 2024-2026 priorities reported by OAG press releases: connected-vehicle data (GM, Allstate/Arity), minors' data (TikTok lawsuit ongoing under SCOPE Act + CUBI), AI training data, data brokers. Web-analytics controllers should expect continued TDPSA-era enforcement activity throughout 2026 as cure-period seasoning matures.
GA4 status
As of 2026-05-06, GA4 is broadly deployable in Texas under TDPSA's opt-out baseline (no pre-collection consent required for adults), provided that (1) controllers publish a TDPSA-conforming privacy notice with the specific banner-text mandates of § 541.101, (2) opt-out of sale + targeted advertising is honored (universal opt-out signals like GPC are recognized but, unlike California, not yet expressly mandatory — TDPSA leaves the technical signal question to forthcoming AG guidance), (3) sensitive personal data (precise geolocation, biometric, health, race/ethnicity, religion, sexuality, immigration, children) is gated on opt-in consent, and (4) CUBI separately bars any biometric capture (e.g., voiceprint, face geometry) without prior informed consent + 1-year destruction. Editorial verdict shifts to red whenever GA4 is configured to capture biometric or precise-location data without explicit consent — the Google $1.375B settlement is the cautionary anchor.
| DPA | Stance |
|---|---|
| Texas OAG | Aggressive single-regulator. CUBI biometric capture is the bright line ($1.4B Meta + $1.375B Google). TDPSA opt-out + sensitive-data opt-in must be operational; the absence of revenue/consumer thresholds means small-business-carveout (SBA-defined) is the only filter. Consumer Privacy Unit treats analytics + ad-tech vendor flows as 'sale of personal data' absent conforming controller-processor contracts under § 541.104. |
Cross-border transfers + Schrems II
Domestic US — no Schrems II issue. TDPSA imposes contractual flow-down obligations (§ 541.104) requiring controllers to bind processors via contract specifying purpose, data type, processing instructions, confidentiality, audit rights, and onward-transfer terms. There is no GDPR-Chapter-V-equivalent regime: no adequacy decisions, no SCCs, no data-residency requirement. CUBI's biometric onward-transfer prohibition (§ 503.001(c)) operates independently — biometric data may not be sold/leased/disclosed even within the US except in narrow exceptions.
Not applicable. Controllers should focus on TDPSA § 541.104 controller-processor contracts and CUBI § 503.001(c) biometric handling restrictions. Failure to bind processors via conforming contracts converts a 'disclosure' into a 'sale of personal data' under TDPSA's broad definition — a Sephora-style risk that the OAG has signaled it will pursue.
Employee data
Key thresholds
Child consent age
13 years
Article 27 representative
Not required
Marketing consent
Single opt-in
Vendor signals
Red / yellow / green markers are an editorial reading of public regulator guidance and published enforcement actions, applied to vendor behavior we can observe or that the vendor documents. They are not legal conclusions, not endorsements, and not advice about your specific processing. Configuration changes the picture — a "yellow" vendor in one configuration may be defensible in another.
Analytics tools · 12 · 8 green · 3 yellow · 1 red
| Vendor | Status | Rationale |
|---|---|---|
| Adobe Analytics | GREEN | Visitor ID cookie + cross-suite stitching with Experience Platform. DPIA strongly recommended; configure ECID + IP obfuscation. US baseline more permissive. |
| Amplitude | GREEN | EU residency available on paid plans; default cloud is US. Persistent user IDs require config + DPA + DPF chain. US baseline more permissive. |
| Fathom | GREEN | Cookieless and aggregate-only — no PI sale trigger, no biometric capture. |
| Matomo (self-hosted) | GREEN | Self-hosted with cookieless config — no third-party data flow, no biometric trigger. |
| Matomo Cloud | GREEN | Cloud version with appropriate controls; no advertising flow, no biometric capture. |
| Pirsch | GREEN | Cookieless privacy-first analytics; no PI sale or biometric trigger. |
| Plausible | GREEN | Cookieless, no PI sale/share, no biometric capture. Outside TDPSA 'sale' definition and outside CUBI scope. |
| Umami | GREEN | Open-source self-hosted; default cookieless. |
| Google Analytics 4 | YELLOW | Legal with TDPSA opt-out + sensitive-data opt-in + Google controller-processor contract under § 541.104 + Google Signals/Ads-features disabled or gated. Status flips to red if biometric or precise-location capture is enabled without CUBI-conforming consent. $1.375B Google settlement (May 2025) is the anchor. |
| Mixpanel | YELLOW | Controller-processor contract + opt-out implementation required; product-analytics vs. advertising boundary matters for TDPSA 'sale of personal data' analysis. |
| PostHog | YELLOW | EU cloud helps but session recording + autocapture default to PII collection. Disable autocapture and recordings or self-host for green. |
| Heap | RED | Auto-capture grabs every click and form value — broad PII risk under GDPR Art 5(1)(c) data minimization. |
Consent management platforms · 5 · 5 green · 0 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| Cookiebot | GREEN | Danish-based, EU-hosted. Auto-blocks third-party scripts pre-consent — verify your manual scripts also gate. |
| Iubenda | GREEN | Italian-based, EU-hosted. Free tier limits 5k pageviews/mo; granular per-vendor controls require paid plan. |
| Klaro | GREEN | Open-source, self-hosted. No managed updates — site owner maintains vendor list. |
| OneTrust | GREEN | GDPR + CCPA + multi-region templates available. Common config error: GDPR/CCPA mode mismatch — verify per-region defaults. US baseline more permissive. |
| Usercentrics | GREEN | German-based, EU-hosted. v3 SDK required for Consent Mode v2; TCF flow can over-collect for non-AdTech sites. |
Tag managers · 1 · 0 green · 1 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| Google Tag Manager | YELLOW | Container only — verdict depends on tags. Gate biometric-capable and ad-tech tags behind explicit consent under TDPSA + CUBI. |
Session replay · 3 · 0 green · 3 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| FullStory | YELLOW | Full session capture is high-risk under § 541.105 risk-assessment rules; sensitive-page exclusion + opt-out honoring required. Biometric capture is the CUBI flip-to-red trigger. |
| Hotjar | YELLOW | Session replay raises CUBI question if mouse/keystroke biometric or face-camera is enabled. Default deployments without face-capture are TDPSA-permissive but require opt-out + sensitive-page exclusion + risk assessment under § 541.105. |
| Microsoft Clarity | YELLOW | Session replay + Microsoft data flows; honor opt-out, run § 541.105 data protection assessment, exclude sensitive pages, verify no biometric (face/voice) capture is enabled — CUBI exposure if it is. |
Ad pixels · 3 · 0 green · 1 yellow · 2 red
| Vendor | Status | Rationale |
|---|---|---|
| LinkedIn Insight Tag | YELLOW | Loads pre-consent if naively placed; cross-device matching broad. Block until consent + IAB TCF string set. US opt-out baseline relaxes the verdict, but GPC + CCPA opt-out signals must still be honoured. |
| Meta Pixel | RED | Two anchoring concerns: (1) Meta's $1.4B settlement (Jul 2024) under CUBI for face-tagging shows OAG's appetite for biometric claims against Meta's broader ecosystem; (2) Meta Pixel data flows are clearly a 'sale of personal data' under TDPSA's broad definition absent conforming controller-processor contracts. Even with TDPSA opt-out + contracts, vendor concentration risk is high. |
| TikTok Pixel | RED | TikTok is the active OAG defendant (Oct 2024 lawsuit ongoing) under SCOPE Act + CUBI + TDPSA. Pixel deployment exposes controllers to derivative TDPSA + SCOPE Act claims if any minors' data is in scope. Highest risk vendor in the Texas-targeted analytics stack. |
Server-side · 3 · 2 green · 1 yellow · 0 red
| Vendor | Status | Rationale |
|---|---|---|
| Addingwell | GREEN | EU-only datacenters strong for FR/DE compliance; per-event pricing scales steeply at high traffic. |
| Stape | GREEN | EU server containers handle the routing — but server-side tagging does NOT auto-fix consent. CMP must still gate browser-side pings. |
| Server-side GTM (Google Cloud) | YELLOW | "EU server" ≠ EU data — clients still transmit to Google ad backends downstream. Use only for Google-ecosystem first-party-routing. |
Compare with neighbors
Side-by-side rule comparison.
Common questions
Is Google Analytics usable in Texas in 2026?
Editorial reading as of 2026-05-06: GA4 is broadly deployable with proper safeguards. Texas uses an opt-out baseline under TDPSA (effective 1 Jul 2024), so GA4 can typically be deployed without pre-collection consent for adults. Practitioners commonly (1) publish a TDPSA-conforming privacy notice with the specific banner-text mandates of § 541.101 (including 'sale of sensitive personal data' / 'sale of biometric data' disclosures if applicable), (2) honor opt-out requests for sale and targeted advertising, (3) gate any sensitive personal data on opt-in consent (precise geolocation, biometric, health, race/ethnicity, religion, sexuality, immigration, children), (4) execute a controller-processor contract with Google under § 541.104, and (5) avoid enabling biometric capture (voiceprint, face geometry) without separate CUBI-conforming consent + 1-year destruction. The Google $1.375B settlement (announced May 2025) is the cautionary anchor for biometric claims; the absence of TDPSA thresholds means the SBA-defined small-business carveout is the only size filter. Not legal advice.
Does TDPSA have a revenue or consumer-volume threshold like CCPA?
No — and this is its single most distinctive feature among US state privacy laws. TDPSA applies to anyone who (1) conducts business in Texas or produces products/services consumed by Texas residents, (2) processes or engages in the sale of personal data, and (3) is NOT a 'small business' as defined by the United States Small Business Administration. There is no $26.625M revenue trigger (CCPA), no 100,000-consumer trigger (VCDPA/CPA/CTDPA), no 50%-of-revenue-from-sale trigger. Practical implication: most non-tiny businesses operating in or marketing to Texas are within scope from day one. The SBA size standards vary by NAICS code (typically 100-500 employees or $7-40M revenue depending on industry) — check 13 C.F.R. § 121.201.
What is CUBI and why does it matter for analytics?
CUBI (Capture or Use of Biometric Identifier Act, Tex. Bus. & Com. Code § 503.001) is Texas's biometric-specific law, enacted in 2009 — 15 years before TDPSA. It bars capturing a 'biometric identifier' (retina/iris scan, fingerprint, voiceprint, hand or face geometry) for a commercial purpose without prior informed consent, requires reasonable safeguards, and mandates destruction within 1 year of the original purpose. Sale, lease, or disclosure is prohibited except in narrow exceptions. The OAG enforces (no private right of action — distinguishing CUBI from Illinois BIPA). The two largest US state-privacy settlements ever — Meta $1.4B (Jul 2024) and Google $1.375B (announced May 2025) — were both anchored in CUBI claims (face-tagging on Facebook / face-grouping in Photos). For analytics: any tool that captures voiceprint (call-center IVR analytics), face geometry (camera-based session replay, age-gating face scans), or fingerprint patterns triggers CUBI's separate opt-in regime, regardless of TDPSA's opt-out baseline.
Who enforces TDPSA and how active is enforcement?
The Office of the Attorney General of Texas is the sole enforcer — there is no private right of action and no concurrent agency (contrast California's CPPA + AG split or Illinois BIPA's private suits). The AG created a dedicated Consumer Privacy Unit in June 2024, focused on privacy, biometric, AI, and SCOPE Act work — described in OAG public communications as among the first dedicated state-AG privacy units. Under AG Ken Paxton, the Texas OAG has been among the most active US-state privacy enforcers as of 2026-05-06: Meta $1.4B (Jul 2024), GM lawsuit (Aug 2024), TikTok lawsuit (Oct 2024), Allstate/Arity lawsuit (Jan 2025), Google $1.375B (announced May 2025; finalized Oct 2025). The combination of (a) no thresholds, (b) AG-only leverage, (c) preserved 30-day cure period, and (d) a dedicated enforcement unit means controllers commonly observe the cure period operating as a procedural step rather than a safe harbor. As an editorial reading: treat any OAG contact as enforcement-track, not informal warning.
What did the Meta $1.4B and Google $1.375B settlements actually establish?
Three things. (1) CUBI's biometric-capture rule applies to large-scale consumer-product features — face-tagging in Facebook (Meta, Jul 2024), face-grouping in Google Photos and voiceprint in Google Assistant (Google, announced May 2025; finalized Oct 2025). (2) Pre-TDPSA conduct is reachable under CUBI back to 2009 — Texas does not need TDPSA's effective date to bring biometric claims. (3) Settlement amounts can substantially exceed California's prior $1.55M ceiling (Healthline) when CUBI's $25,000-per-violation multiplier is applied to billions of photos/voiceprints. Google's settlement also included Incognito-mode-tracking and geolocation-history claims under TX UDAP — showing the OAG layers CUBI + TDPSA + UDAP theories in big-tech cases. Practical implication: if your analytics or product stack captures any biometric identifier from Texans, get explicit CUBI-conforming consent + 1-year destruction protocols in place yesterday.
What is the SCOPE Act and how does it differ from COPPA?
SCOPE Act (Securing Children Online through Parental Empowerment Act, Tex. Bus. & Com. Code § 509) is Texas's minors-only digital-protection law, effective 1 Sep 2024. Key differences from federal COPPA: (1) protects users under 18, not under 13 (much broader); (2) requires age registration for every user before collection; (3) prohibits targeted advertising to known minors; (4) prohibits algorithmic personalization based on a minor's data; (5) prohibits sale of minors' data without parental consent; (6) mandates parental tools for monitoring/disabling features; (7) AG-only enforcement, $10,000 per violation. The 'harmful content' filtering provisions were partially enjoined in Aug 2024 on 1st Amendment grounds (Free Speech Coalition v. Paxton) — but the privacy provisions are in force. The TikTok lawsuit (Oct 2024) is the active SCOPE enforcement test case.
Do I need to honor a universal opt-out signal like GPC under TDPSA?
Not yet expressly mandated — but recommended. Unlike California CPRA (11 CCR § 7025 makes GPC honoring mandatory), TDPSA does not yet specify a technical signal. § 541.055 requires controllers to recognize 'opt-out preference signals sent by a platform, technology, or mechanism' — but the AG has not issued formal regulations specifying GPC. Best practice: honor GPC as a TDPSA opt-out request to align with California compliance and pre-empt forthcoming OAG guidance. Multi-state controllers typically extend their California GPC implementation to Texas at no incremental cost.
Does TDPSA cover my employee or B2B data?
No. TDPSA § 541.002(b)(11) excludes personal data processed in the employment, applicant, contractor, B2B-contact, or beneficiary context — mirroring VCDPA/CPA/CTDPA and contrasting California's CPRA (which sunsetted that exemption in 2023). However, CUBI applies to ALL biometric capture for a 'commercial purpose' regardless of employment status: fingerprint time-clocks, facial-recognition badge entry, voiceprint authentication for call-center staff all require prior informed consent + 1-year destruction. Practical rule: for non-biometric internal HR analytics, Texas is permissive; for any biometric employee monitoring, run a CUBI-conforming consent + retention + safeguards program before deployment.
What's the children's-consent age in Texas — 13 or 18?
Both apply, in different layers. (1) COPPA (federal) = under 13 — verifiable parental consent before collecting personal information from a child. (2) TDPSA § 541.055 = 'children' (under 13) — sensitive personal data category requiring opt-in consent. (3) SCOPE Act § 509 = under 18 (a 'known minor') — registration of age, no targeted ads, no sale of data without parental consent, no algorithmic personalization. So: 13 is the federal+TDPSA sensitive-category line; 18 is the SCOPE Act minor-protection ceiling. Digital-service providers operating in Texas must build age-registration into onboarding and gate features by registered age category — this is a SCOPE Act-specific architectural requirement.
Does TDPSA require Spanish-language privacy notices?
Not formally mandated. TDPSA requires a 'reasonably accessible, clear, and meaningful' privacy notice (§ 541.101) but does not specify language. However, given Texas's ~30% Spanish-speaking population and the OAG's consumer-protection mandate, Spanish-language notices are strongly recommended for any consumer-facing controller — particularly retail, healthcare, financial services, and education. The federal Limited English Proficiency (LEP) framework + Texas Department of State Health Services notice-translation expectations provide the soft baseline. For analytics-only deployments on English-language sites, English notices typically suffice; for Texas-targeted bilingual properties, ship both.
// EDITORIAL · NOT LEGAL ADVICE This page summarises Texas's privacy framework as of 2026-05-06. Rules vary by sector, establishment, and DPA position. For binding interpretation, consult counsel admitted here.