Texas is known as a business-friendly state, but it has passed some of the broadest privacy and online-safety laws in the country. If you run a business website in Texas — or sell to Texans from elsewhere — these are the laws to know. For formation, franchise tax, and local SEO, see the main Texas business guide.
Texas Data Privacy and Security Act (TDPSA)
The TDPSA took effect on July 1, 2024. Unlike most state privacy laws, it has no consumer-count or revenue threshold. It applies to businesses that conduct business in Texas or produce products or services consumed by Texas residents, process or sell personal data, and are not small businesses as defined by the U.S. Small Business Administration.
Covered businesses must:
- publish a privacy notice describing the categories of personal data processed, purposes, sharing, and how to exercise rights;
- respond to requests to access, correct, delete, and port personal data, and to opt out of sale, targeted advertising, and certain profiling;
- obtain consent before processing sensitive data;
- recognize universal opt-out mechanisms such as Global Privacy Control (required since January 1, 2025);
- post the notice "NOTICE: We may sell your sensitive personal data." if they sell sensitive data (and a similar notice for biometric data);
- conduct data protection assessments for higher-risk processing.
Small businesses are not entirely exempt: they may not sell sensitive personal data without the consumer's prior consent. The Texas Attorney General enforces the TDPSA, with a 30-day cure period before an enforcement action.
Data-breach notification
Texas's identity-theft and breach law (Business & Commerce Code Chapter 521) requires businesses to protect sensitive personal information with reasonable procedures and to notify affected individuals of a breach without unreasonable delay and no later than 60 days after determining a breach occurred. If at least 250 Texans are affected, the Attorney General must also be notified — currently as soon as practicable and within 30 days.
Data broker registration
Businesses whose principal source of revenue comes from collecting, processing, or transferring personal data they did not collect directly from consumers may be "data brokers" under Texas law, which requires registration with the Texas Secretary of State and posting specific notices on their website. Most ordinary business websites are not data brokers.
Minors and online services
Texas's SCOPE Act (HB 18), effective September 1, 2024, places duties on certain digital service providers that allow users to create accounts and interact socially. Parts of the law have been blocked by federal courts, so check the current status if your site has social features aimed at or used by minors. The federal COPPA Rule applies to sites directed to children under 13.
Advertising and consumer protection
- Texas Deceptive Trade Practices Act (DTPA): prohibits false, misleading, or deceptive acts in trade — including website claims about products, prices, and guarantees — and gives consumers a private right of action.
- Federal rules on reviews and endorsements, CAN-SPAM email rules, and the TCPA for texts apply in Texas as everywhere. Texas also has its own telemarketing and telephone-solicitation registration law that can apply to some text and call campaigns.
Accessibility
Texas has no separate state website-accessibility statute for private businesses, but ADA Title III applies, and website claims are filed in Texas federal courts. Build to WCAG 2.1 AA. See the accessibility guide.
Texas tax quirks for online businesses
- Sales tax on digital services: Texas taxes some services that many states don't. Data processing services, for example, are taxable in Texas, with 20% of the charge exempt. Whether a particular web, hosting, or software service is taxable depends on how it is structured — check with the Texas Comptroller.
- Remote sellers: out-of-state sellers must collect Texas sales tax once their Texas revenue exceeds $500,000 in the preceding twelve months.
- Franchise tax and Public Information Report: Texas LLCs and corporations file annually with the Comptroller even when no tax is due.
Texas website compliance checklist
- Decide whether you are a small business under SBA standards (and therefore outside most of the TDPSA).
- Publish an accurate privacy notice; add opt-out and Global Privacy Control support if you're covered.
- Never sell sensitive data without consent — regardless of size.
- Document a breach-response plan that meets the 60-day and Attorney General notice rules.
- Check that advertising claims and prices are accurate under the DTPA.
- Test accessibility against WCAG 2.1 AA.
- Confirm sales-tax treatment of any digital services you sell.
Related guides
Frequently asked questions
What laws apply to creating a business website in Texas?
The main state laws are the Texas Data Privacy and Security Act (for businesses that are not SBA small businesses), the breach-notification law in Business & Commerce Code Chapter 521, the Deceptive Trade Practices Act, and, for some sites, the data broker and SCOPE Act rules. Federal ADA, COPPA, CAN-SPAM, and FTC rules also apply.
Does the Texas privacy law have a revenue threshold?
No. The TDPSA has no revenue or consumer-count threshold; instead it exempts businesses that qualify as small businesses under SBA size standards, except that they still need consent before selling sensitive data.
How quickly must a Texas business report a data breach?
Affected individuals must be notified without unreasonable delay and within 60 days after the breach is determined. If 250 or more Texans are affected, the Attorney General must also be notified, currently within 30 days.
Do out-of-state online sellers have to collect Texas sales tax?
Yes, once their Texas sales revenue exceeds $500,000 in the preceding twelve months. Texas sellers collect from the start.