Texas Data Privacy Law (TDPSA): What Texas Residents Need to Know

Texas passed the Texas Data Privacy and Security Act (TDPSA) in 2023, one of the broadest state privacy laws in the country. Unlike some state laws that only apply to large corporations, the TDPSA covers a significantly wider range of businesses. Here is what the law covers, how it protects you, and how to use it.

What Is the TDPSA?

The Texas Data Privacy and Security Act was signed into law by Governor Greg Abbott on June 18, 2023, and became effective July 1, 2024. It gives Texas residents privacy rights broadly similar to California's CCPA, but with some important structural differences, most notably who it applies to.

The TDPSA applies to any person or business that conducts business in Texas or produces products or services consumed by Texas residents, processes or engages in the sale of personal data, and is not a small business as defined by the US Small Business Administration. There is no revenue threshold or minimum data volume, making the law's reach broader than California's CCPA in some respects.

Your Rights Under the TDPSA

Texas residents have five rights under the TDPSA:

How the TDPSA Differs From California's CCPA

The TDPSA and CCPA share the same underlying goal, giving consumers control over their personal data, but there are meaningful differences in how each law operates:

Data Brokers Under the TDPSA

Texas also has a separate data broker registration law that predates the TDPSA. Under Texas Business and Commerce Code Chapter 503B, data brokers (defined as businesses that collect and sell or license personal information about individuals with whom they have no direct relationship) must:

• Register with the Texas Office of the Attorney General annually
• Provide a simple mechanism for Texas residents to opt out of having their data sold
• Publish their data collection and use practices
• Implement security measures to protect personal data

This registration requirement, effective September 1, 2023, means that most major people-search sites and data aggregators operating in Texas are required to provide a clear opt-out path. Failure to register or honor opt-out requests can result in enforcement action by the Texas AG.

How to Submit a TDPSA Deletion Request

Submitting a deletion request under the TDPSA follows a similar process to the CCPA:

1. 1. Locate the privacy notice. The TDPSA requires covered businesses to publish a clear, accessible privacy notice. Look for it in the site's footer, under "Privacy Policy," or search for "[company name] privacy policy Texas."
2. 2. Find the designated request method. The business's privacy notice must describe how consumers can submit rights requests. This is typically a webform, email address, or toll-free number.
3. 3. Submit your deletion request. Provide your name, contact information, and state of residence. Some brokers may ask you to verify your identity to confirm you are the person whose data you are requesting be deleted.
4. 4. Wait for the response. The business has 45 days to respond, extendable by an additional 45 days if they notify you of the extension and explain the reason.
5. 5. Appeal a denial. If your request is denied, you have the right to appeal the decision within a reasonable time period. The business must provide instructions for submitting an appeal. If the appeal is denied, you can file a complaint with the Texas Attorney General at texasattorneygeneral.gov.

The Bigger Picture: A National Wave of Privacy Laws

Texas is not alone. As of 2026, more than 13 states have enacted comprehensive consumer privacy legislation, with more in progress at the federal and state level:

The practical effect of this state-by-state wave is real: complying separately with the privacy laws of 13+ states, each with different applicability rules, response timelines, and opt-out mechanisms, is operationally untenable for most data brokers. The result is that most major data brokers now process deletion requests from all US residents, not just those in states with active laws. Trying to verify state residency for every incoming request creates more legal exposure than simply processing all requests uniformly.

For Texas residents, the TDPSA, combined with the broader national legal picture, gives you real, enforceable leverage to demand data brokers delete your personal information. Authorized agent services have made exercising that leverage much more practical. Learn more about how to use privacy law to remove your data, or let GhostVault handle it automatically.