Texas Becomes Tenth State To Enact Comprehensive Privacy Law

On June 18, Texas enacted the Texas Data Privacy and Security Act (TDPSA), becoming the tenth U.S. state to enact a comprehensive consumer data privacy law. Businesses regulated by the TDPSA have until July 1, 2024 to come into compliance with the law. The other states with comprehensive consumer privacy laws currently in effect are California, Virginia, Colorado, and Connecticut. They will soon be joined by Utah (December 31, 2023), Tennessee (July 1, 2024), Montana (October 1, 2024), Iowa (January 1, 2025), and Indiana (January 1, 2026).

While modeled on the Virginia/Colorado/Connecticut framework, the TDPSA does include some notable differences distinguishing it from other state general privacy laws, and potentially applies to a broader range of businesses (known as "controllers") inside and outside of the state. Starting January 1, 2025, the TDPSA will also require all controllers to recognize universal opt-outs (e.g., web browser privacy settings like Global