TDPSA requirements
Texas took a different route to scope: the law, effective July 1, 2024, applies to any business that conducts business in Texas and processes or sells personal data, unless it qualifies as a small business under SBA definitions, and even small businesses need consent to sell sensitive data. Since January 1, 2025 controllers must honor universal opt-out signals. The Texas Attorney General has been the most aggressive state enforcer outside California, with suits against Allstate and Arity over driving-data collection through embedded SDKs and investigations into connected-vehicle and app tracking. Enforcement is by the AG only, with a 30-day cure period and civil penalties up to $7,500 per violation. The Allstate complaint is a useful reminder that SDKs inside mobile apps are squarely within scope.
TDPSA articles and analysis
Cookie Compliance in 2026: Why Consent Banners Don’t Prevent Enforcement Actions
Consent banners alone do not guarantee cookie compliance. Regulators now focus on actual third-party data flows, tracking pixels, cookie syncing, fingerprinting, and unauthorized data sharing....
Read More
U.S. Privacy Laws (and Key Provisions) That Take Effect or Become Enforceable in 2026
2026 is a turning point in U.S. privacy regulation: multiple new comprehensive state laws go live, enforcement provisions activate, and novel mechanisms (like the California...
Read More
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.