← ALL REGULATIONS
Texas Data Privacy and Security Act cookie rules, and opt-out signals.
Texas does not require opt-in consent for cookies. The Texas Data Privacy and Security Act gives consumers the right to opt out of targeted advertising, the sale of their data and some profiling, and since 1 January 2025 an opt-out sent through a browser setting or extension, such as Global Privacy Control (GPC), has to be honoured, with limited exceptions.
TDPSA at a glanceOpt-out, opt-in for some data
- Applies to
- Anyone doing business in Texas, or whose products Texans use, that processes or sells personal data. There is no revenue or volume threshold; small businesses as the SBA defines them are exempt, but need consent to sell sensitive data
- In force
- July 2024, with browser opt-out signals required since January 2025
- Enforced by
- Texas Attorney General, exclusively
- Penalties
- Up to $7,500 per violation, after notice and 30 days to cure, plus injunctions and the Attorney General’s costs
WHAT TDPSA REQUIRES
What Texas asks of a site that uses advertising cookies.
THE RULEA clear opt-out of targeted advertising and saleA controller that sells personal data or uses it for targeted advertising must disclose that clearly and conspicuously, together with how to opt out.
WITH KATLAIn US State Laws (CCPA) mode, the banner’s main button is "Do Not Sell or Share My Personal Information", and the marketing category is labelled as the sale or sharing of personal information. The wording follows California’s law; there is no Texas-specific label.
THE RULEHonour browser opt-out signalsSince 1 January 2025, a consumer can opt out through a browser setting, browser extension or device setting, and the controller must comply unless, for example, it cannot verify that the consumer lives in Texas. The Act does not name a particular signal.
WITH KATLAKatla honours Global Privacy Control: a visitor whose browser sends it is recorded as opted out, unless they have already made a choice.
THE RULEConsent for sensitive dataProcessing sensitive data, such as precise geolocation, health information or data about a known child, needs consent first. Small businesses the Act otherwise exempts still need consent before selling it.
WITH KATLAKatla’s categories describe what cookies are for, not which data types they carry. A site that processes sensitive data can run Katla in GDPR mode, so nothing non-essential is set before an opt-in.
THE RULESale notices in the privacy noticeA controller that sells sensitive or biometric data must say so in its privacy notice in the words the Act prescribes, such as "NOTICE: We may sell your sensitive personal data."
WITH KATLAKatla generates the cookie policy from the scan, with CCPA disclosures in CCPA mode. It does not add the Texas sale notices, so they belong in your own privacy notice if they apply.
THE RULEData protection assessmentsProcessing for targeted advertising or sale, or of sensitive data, needs a data protection assessment, which the Attorney General can ask to see.
WITH KATLAAssessments are outside what a consent tool does. Katla’s scan, which lists every cookie it finds with its domain and category, can inform one.
TDPSA questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Does Texas require a cookie banner?
- Not an opt-in one. It requires a clear way to opt out of targeted advertising and sale, consent for sensitive data, and honouring opt-outs sent by a browser setting or extension.
- Does the Texas law apply to small businesses?
- Businesses that are small under the US Small Business Administration’s definitions are exempt, with one exception: they may not sell sensitive data without the consumer’s consent. Unlike most state laws, there is no threshold based on revenue or the number of consumers.
- Is there a cure period?
- Yes, and the Act sets no end date for it. The Attorney General must give written notice and 30 days to cure before suing, and violations after that carry civil penalties of up to $7,500 each.
- Has Texas enforced the Act?
- Yes. In January 2025 the Attorney General sued Allstate and its subsidiary Arity, alleging they collected and sold location data from mobile apps without notice or consent. His office described it as the first enforcement action by a state attorney general under a comprehensive privacy law.
- How does Katla treat Texas visitors?
- Auto mode reads the visitor’s timezone, and US timezones get the CCPA banner with its opt-out and GPC handling. You can also set the site to US State Laws (CCPA) mode for everyone.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.