Install freeTexas Data Privacy and Security Act (TDPSA) Compliance
Pandectes GDPR Compliance helps Shopify stores meet Texas TDPSA requirements. Our scans identify cookies and tracking technologies, providing detailed reports and actionable insights to ensure compliance with privacy regulations.
Start Free
The #1 cookie consent app for Shopify, trusted by 185k stores
What is TDPSA?
The Texas Data Privacy and Security Act (TDPSA) is Texas’s comprehensive consumer privacy law. It was signed on June 18, 2023 as House Bill 4 and added as Chapter 541 of the Texas Business and Commerce Code. It follows the Virginia model, but it reaches more businesses than most state laws because it has no revenue or consumer-count threshold.
Under the TDPSA, Texas consumers have the right to:
- Confirm whether a business processes their personal data and access it
- Correct inaccuracies in their personal data
- Delete personal data provided by or obtained about them
- Obtain a portable copy of the personal data they provided
- Opt out of targeted advertising, the sale of their personal data, and profiling that produces legal or similarly significant effects
The law also defines sensitive data, which includes racial or ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, precise geolocation, and personal data collected from a known child. A business that sells sensitive data must say so in its privacy notice with the statement “NOTICE: We may sell your sensitive personal data.”
Who does the TDPSA apply to?
The TDPSA applies to anyone that conducts business in Texas or produces products or services consumed by Texas residents, processes or sells personal data, and is not a small business as defined by the US Small Business Administration. Most state privacy laws only cover businesses that target their residents. Because Texas covers products and services “consumed by” Texans, an online store outside Texas that ships to Texas customers can be in scope.
Small businesses are exempt, except that they must get consent before selling sensitive data. Government bodies, financial institutions subject to the Gramm-Leach-Bliley Act, HIPAA covered entities, nonprofits, and institutions of higher education are also exempt, as is data about people acting in a commercial or employment context.
What happens if I don’t comply with the TDPSA?
The Texas Attorney General has exclusive authority to enforce the TDPSA, and has been actively bringing privacy cases. The main points are:
- Cure period: before bringing an action, the Attorney General must give written notice and 30 days to cure the violation, and the business must confirm in writing that it has cured it. This cure period is permanent.
- Penalties: if the violation continues after the cure period, or the written statement is breached, the Attorney General may seek an injunction and civil penalties of up to $7,500 for each violation.
- Costs: the Attorney General may recover attorney’s fees and investigation costs.
- No private right of action: consumers cannot sue a business directly under the law. They can file a complaint with the Attorney General.
When did the TDPSA go into effect?
The TDPSA took effect on July 1, 2024. Since January 1, 2025, businesses must also honor universal opt-out signals such as Global Privacy Control.
Complying with the TDPSA
If the TDPSA applies to your online store, the work that matters most for cookies and tracking looks like this:
- Offer an opt-out of targeted advertising and sale. Advertising pixels and tags that track visitors across other websites are typically targeted advertising. If you sell personal data or use it for targeted advertising, you must clearly disclose this and explain how consumers can opt out. A visible opt-out link and a cookie banner with clear choices are the usual way to do this. Since January 1, 2025, you must also honor universal opt-out signals such as Global Privacy Control.
- Get opt-in consent for sensitive data. You must not process sensitive data, such as precise geolocation, without the consumer’s consent. Data collected from a known child must be handled under the federal Children’s Online Privacy Protection Act.
- Publish a clear privacy notice. It must describe the categories of personal data you process, why you process it, the categories you share with third parties, and how consumers can exercise their rights and appeal your decisions.
- Handle consumer requests on time. Provide at least one secure and reliable way to submit requests, without requiring a new account. Respond within 45 days, extendable once by another 45 days when reasonably necessary, and answer appeals within 60 days.
- Keep collection to what you need. Limit personal data to what is adequate, relevant, and reasonably necessary for the purposes you disclose, and protect it with reasonable security practices.
To make this easier, consider a Consent Management Platform (CMP) like Pandectes GDPR Compliance. It is built for Shopify stores and provides a cookie banner with opt-out options for US states, a “Do not sell or share my personal information” link, automatic cookie scanning and classification, a cookie declaration, consent logs, and data subject request handling. Region-specific banner settings let you show Texas visitors the right experience based on their location.
Every business is different, so review your obligations under the TDPSA with legal counsel where appropriate.