Laws
Texas Data Privacy and Security Act (TDPSA): your rights and how to use them
Quick answer
If you live in Texas, the Texas Data Privacy and Security Act lets you ask a covered company to show you, correct or delete the personal data it holds about you, and to stop selling it or using it for targeted ads. Send the request through one of the methods in the company's privacy notice: it has 45 days to answer, and it's free up to twice a year. If the company refuses, appeal to it first, then complain to the Texas Attorney General.
All privacy laws“A controller shall comply with an authenticated consumer request to exercise the right to: ... (3) delete personal data provided by or obtained about the consumer;”
- Applies in
- Texas
- In force since
- Companies must answer within
- Without undue delay and within 45 days of receiving your request. The company can extend once by 45 more days if it's reasonably necessary and it tells you within the first 45 days (Bus. & Com. Code § 541.052(b)). Appeals get a written answer within 60 days (§ 541.053(c)).
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: texasattorneygeneral.gov, capitol.texas.gov, sos.state.tx.us
Last verified against the official page:
Texas residents. The law applies to companies that do business in Texas or sell products or services Texans use, that process or sell personal data, and that aren't small businesses under the U.S. Small Business Administration's definition. State agencies, financial institutions covered by the Gramm-Leach-Bliley Act, HIPAA covered entities, nonprofits and colleges are exempt, and so is data covered by GLBA, HIPAA, the Fair Credit Reporting Act and FERPA.
Your rights
-
Confirm and access
Ask a company whether it processes your personal data, and see the data it has (Bus. & Com. Code § 541.051).
-
Correct
Have inaccurate data fixed. The company can take into account what kind of data it is and why it holds it (Bus. & Com. Code § 541.051).
-
Delete
Have a company delete personal data you gave it, and also data it obtained about you from somewhere else (Bus. & Com. Code § 541.051).
-
Get a portable copy
If the data you gave the company is available digitally, get a copy in a portable format you can take to another company (Bus. & Com. Code § 541.051).
-
Opt out
Stop the company using your data for targeted advertising, selling it, or profiling you for decisions with legal or similarly significant effects. Since January 1, 2025 a browser setting or global device setting can send the opt-out for you (Bus. & Com. Code § 541.055).
-
Appeal
Appeal a refusal. The company must answer in writing within 60 days and, if it still says no, give you the online way to complain to the Attorney General (Bus. & Com. Code § 541.053).
-
No retaliation
A company can't punish you for using these rights, for example by charging you a different price or refusing you goods or services (Bus. & Com. Code § 541.101).
General information, not legal advice.
How to use it
- 1
Find the request methods in the privacy notice
Covered companies must offer at least two secure and reliable ways to send a request, usually listed in the privacy notice. A company that only operates online and has a direct relationship with you may offer just an email address.
The company can't make you create a new account just to send a request.
- 2
Say which rights you want to use
Name them plainly: access, correction, deletion, a copy, or an opt-out. A line like "Under the Texas Data Privacy and Security Act, please delete the personal data you hold about me" is enough to start. A parent or legal guardian can send the request for a known child.
- 3
Confirm your identity if asked
Companies act on an authenticated request, so they may ask for extra information that's reasonably necessary to confirm it's you.
- 4
Turn on a browser opt-out signal
For opt-outs only, you don't have to write to each company. Since January 1, 2025 you can use an authorized agent, which includes a browser setting or extension, or a global device setting, that signals you want to opt out of targeted ads and sales.
- 5
Wait up to 45 days
The company has 45 days to respond and can extend once by 45 more days if it tells you why. Answering your requests is free up to twice a year.
- 6
Appeal if the company refuses
Use the company's appeal process. It must answer in writing within 60 days. If it denies the appeal, it has to tell you how to complain to the Attorney General online.
- 7
Complain to the Texas Attorney General
File a complaint with the Attorney General's Consumer Protection Division at consumerprotection.texasattorneygeneral.gov. The Attorney General is the only one who can enforce the law: you can't sue a company under it yourself. After a written notice and a 30-day cure period, a company can be fined up to $7,500 per violation.
No answer in time? Complain to Texas Attorney General, Consumer Protection Division .
Who has to follow the TDPSA
The law covers companies that do business in Texas or make products or services that Texans use, and that process or sell personal data. Small businesses, as the U.S. Small Business Administration defines them, are generally outside it. One exception: even a small business needs your consent before it sells sensitive data.
The Texas data broker registry
Texas also has a separate data broker law. A data broker has to register with the Texas Secretary of State to do business in the state, pay $300 and renew every year.
According to the Texas Attorney General, a business counts as a data broker when its main source of revenue is collecting, processing or transferring personal data it didn't collect directly from the person. It also has to meet one of two tests in a 12-month period: more than 50% of its revenue comes from that work, or it processes or transfers data on more than 50,000 people.
The data broker law gives you no deletion right of its own. It requires brokers to register and post a notice on their website. It also requires a security program. That's all. When you ask a broker to delete your data, the right you're using is the TDPSA's. You can look up registered brokers in the Secretary of State's Data Broker Registry, which is linked from its data broker FAQ.
Why a company can say no
Some companies and some data sit outside the TDPSA. State agencies and nonprofits are exempt. So are colleges and HIPAA covered entities, along with financial institutions covered by the Gramm-Leach-Bliley Act (GLBA). Data covered by federal laws is exempt too, including GLBA (banking), HIPAA (health), the Fair Credit Reporting Act (credit reports) and FERPA (school records).
So if a company tells you your data falls under the FCRA or GLBA, that's the likely reason it's declining. You can still appeal and, if you think the refusal is wrong, complain to the Attorney General.
About the section numbers
The section numbers on this page come from House Bill 4 as enacted in 2023, which created chapter 541 of the Texas Business and Commerce Code. The current codified text on the Texas statutes site may include later changes, so check it there if you need the exact wording.
Where Serus fits
The TDPSA works one company at a time, and you first have to know which companies hold your data. Serus finds the data brokers that operate where you live and sends the deletion and opt-out requests for you. Then it follows up and checks whether your data shows up again. The steps above are free if you'd rather do them yourself.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
When did the Texas privacy law take effect?
The Texas Data Privacy and Security Act took effect on July 1, 2024. The part that lets a browser or device setting opt out for you took effect on January 1, 2025.
Can I sue a company under the TDPSA?
No. The law has no private right of action. The Texas Attorney General has exclusive enforcement authority, so complaints go there.
Do data brokers have to register in Texas?
Yes. A data broker must register with the Texas Secretary of State to do business in Texas. The fee is $300 and a registration lasts one year.
Does the Texas data broker law let me delete my data?
No. The data broker law requires registration, a notice on the broker's website and a security program. Your right to delete comes from the TDPSA. The Secretary of State doesn't investigate violations: complaints go to the Attorney General.
Does it cost anything to use my rights?
No, up to twice a year. A company must answer your requests free of charge up to two times in a year.
What counts as an opt-out agent?
A technology that signals you want to opt out, such as a link to a website, a browser setting or extension, or a global device setting.
Sources
- texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act
- capitol.texas.gov/tlodocs/88R/billtext/html/HB00004F.htm
- texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-broker-act
- sos.state.tx.us/statdoc/faqs4000.shtml
- consumerprotection.texasattorneygeneral.gov
Something wrong or out of date? Tell us and we'll re-check it.