Guide · US state law

TDPSA: the Texas law explained for people with ads

The Texas law does not use a number of visitors to decide who has to comply. It looks at whether the business is small under federal criteria. In this guide you will understand this rule, what a visitor can refuse and how the Texas attorney general has been enforcing it.

Audit my site for Texas Read the guide

✓Based on the law and on the Texas attorney general's page
✓Examples designed for sites with AdSense and Ad Manager
✓Read-only scan, no changes to the site

2notices with mandatory wording for those who sell sensitive or biometric data

30 daystime to fix a violation after the attorney general's notice, before action is taken

$7,500maximum civil penalty per violation

45 daysdeadline to respond to consumer requests, extendable by another 45

What it is

A state law with broad reach and active enforcement

The Texas Data Privacy and Security Act, or TDPSA, is in Chapter 541 of the Texas Business and Commerce Code. It was passed in 2023 and took effect on July 1, 2024.

The structure is similar to Virginia's: consumer rights, opt-out of targeted advertising and sale, consent for sensitive data and data protection assessments. The big difference is in who has to comply.

Instead of requiring a minimum number of visitors, the TDPSA applies to anyone who does business in Texas or has products or services consumed by Texans, processes personal data and is not a small business under the criteria of the federal small business agency, the SBA.

For a site with ads, this means company size matters more than traffic. And the Texas attorney general has already shown that he uses the law: in January 2025 he sued the insurer Allstate and the data company Arity under it.

Checklist

What you need to meet

If your company is not small under SBA criteria and has visitors from Texas, this is the basic list.

Publish a complete privacy notice
The notice must be clear and easy to find. It lists the data processed, the purposes, the data shared, the categories of third parties, the request channels and how to appeal.
Example
Privacy Policy link in the footer of every page, leading to the full notice.
Say there is targeted advertising and how to opt out
Anyone who sells data or does targeted advertising must say so clearly and visibly. Along with it, they must explain how the visitor opts out.
Example
Sentence in the notice: we use your data for targeted advertising. To opt out, use the Do Not Sell or Share My Personal Information link.
Use the exact sentence if you sell sensitive data
The law requires publishing a notice with fixed text, in English, for anyone who sells sensitive or biometric data.
Example
NOTICE: We may sell your sensitive personal data. For biometric data: NOTICE: We may sell your biometric personal data.
Ask for consent for sensitive data
Sensitive data can only be processed with consent. Even a small business needs consent before selling this data.
Example
Before using the visitor's precise location, show a question with the options Allow and Do not allow.
Accept the opt-out sent by the browser
Since January 1, 2025, the visitor can opt out through a global browser or device setting. Honor it when the request can be verified.
Example
Visitor with GPC turned on: treat it as if they had clicked opt out.
Receive requests without requiring a new account
Offer at least two secure channels for requests and do not require a new account. Respond within 45 days, extendable by another 45, and have an appeal path.
Example
According to the attorney general, an online-only business with a direct relationship with the consumer may offer just an email, such as privacy@yoursite.com.
Do the data protection assessment
Targeted advertising, sale of data and sensitive data require a written assessment of risks and benefits. The attorney general can request this document.
8
Pass the opt-out to Google
Google does not require a CMP for US states. Use the US state regulations message, in Privacy & messaging, or turn on restricted data processing, RDP, in the tag for people who opted out. With GPP, Google reads the US National section for Texas.
Example
AdSense or Ad Manager: Privacy & messaging, US state regulations card, Create. Then choose the sites and publish.
```
// Só para o visitante que recusou
googletag.pubads().setPrivacySettings({
  restrictDataProcessing: true,
});
```

In practice

Right and wrong

WrongOpt-out that is hidden or forces the visitor to create an account.
RightOpt-out link visible on every page, which opens the choice screen without asking for sign-up.
WrongThe site ignores the browser setting because the visitor did not click on the banner.
RightThe browser sends GPC and the site treats it as an opt-out of sale and targeted advertising.
WrongThe site sells the visitor's precise location without notice and without consent.
RightThe site asks for consent before using or selling sensitive data, such as precise location.
WrongVague policy, without the rights, without the third parties and without the required sentence.
RightComplete policy, easy to find and with the NOTICE sentence when sensitive data is sold.

Official tools

Certified CMPs and official links

Google does not require a certified CMP or GPP for US state laws. You can use Google's own message or turn on RDP in the tag.

Who it applies to

The small business rule

The TDPSA has no visitor or revenue threshold of its own. The main question is whether your company is small under the SBA's criteria.

Business tied to Texas

Doing business in Texas or having products and services consumed by residents of the state. A site with a Texan audience may fit.

Process or sell data

Processing personal data or selling that data. Cookies and ad identifiers are personal data.

Not being a small business

The SBA defines a small business by industry, based on revenue or number of employees. Anyone above that size comes under the law.

An exception that applies to everyone

Even a small business needs the consumer's consent before selling their sensitive data.

Definitions

The terms that matter for people who sell ads

Texas defines sale broadly, including exchanges that involve no money.

Personal data

Information linked, or reasonably linkable, to an identified or identifiable person. De-identified and public data are left out.

Sensitive data

Racial or ethnic origin, religion, mental or physical health, sexuality, immigration status, genetic and biometric data, data of a known child and precise location.

Sale

Sharing, disclosing or transferring personal data to a third party in exchange for money or other value. Data partnerships in exchange for a service may count.

Targeted advertising

An ad chosen based on data about the person's activities over time on other companies' sites and apps. Contextual ads do not count.

Site obligations

Privacy notice with mandatory sentences

The business needs a clear, accessible privacy notice. It lists the categories of data processed, the purposes, how to exercise rights and appeal, the categories of data passed to third parties and the categories of those third parties.

Texas requires exact wording in two cases. Anyone who sells sensitive data must include this sentence in the notice: NOTICE: We may sell your sensitive personal data. Anyone who sells biometric data must include NOTICE: We may sell your biometric personal data. The notices are shown in English, as the law requires.

Anyone who sells data or does targeted advertising must also show this clearly and visibly, along with the way to opt out. Opting out cannot require creating a new account.

Sensitive data can only be processed with consent. For a known child under 13, the federal COPPA law applies, with parental consent.

Rights, opt-out and assessments

Visitor rights, browser opt-out and assessments

A Texas visitor can find out whether the business processes their data, access it, take a copy, correct it, delete it and refuse targeted advertising, sale and certain profiling, without retaliation. The business responds within 45 days, extendable by another 45, and must offer an appeal to anyone whose request is denied.

Since January 1, 2025, the law lets the visitor refuse targeted advertising and the sale of data through a technology, such as a global browser or device setting, that works as an authorized agent. The business must comply when it can verify identity and authorization. The law does not name the Global Privacy Control, but the GPC is the best-known example of this kind of setting.

In practice, the safest path is for the CMP to detect the GPC, mark the visitor as opted out and pass that opt-out to all ad partners before the first request.

The business must also carry out data protection assessments for targeted advertising, sale of data, sensitive data and certain profiling. The assessment weighs benefits and risks and can be requested by the attorney general in an investigation.

Timeline

Texas law dates

Dates confirmed on the Texas attorney general's page and in official statements.

2023
Law passed
Texas passes the TDPSA, which goes into Chapter 541 of the Business and Commerce Code.
July 1, 2024
Entry into force
The rights, mandatory notices, opt-out and assessments take effect.
January 1, 2025
Browser opt-out
The opt-out through a global browser or device setting takes effect.
January 2025
Lawsuit against Allstate
The attorney general sues Allstate and Arity over the use of location data without notice and consent.

Enforcement and fines

Attorney general with exclusive power and a 30-day cure period

The Texas attorney general has exclusive authority to enforce the TDPSA. He can demand documents, seek a court order and collect fines and fees. Individuals cannot sue the business, but can file a complaint on the attorney general's website.

Before filing suit, the attorney general must give written notice. The business has 30 days to fix the problem and send a written statement with documents showing the fix, including changes to internal policies. This cure period has no end date.

Anyone who does not fix it in time or breaks the statement they sent is subject to a civil penalty of up to $7,500 per violation.

In January 2025, the attorney general accused Allstate and Arity of collecting and selling drivers' precise location through apps, without the notice and consent required for sensitive data.

AdSense and Ad Manager

How Google treats the Texas visitor

The IAB Tech Lab has a Texas section in the GPP string, but Google does not list it among the sections AdSense accepts. For Texas, Google reads the US National section.

When the US National section indicates an opt-out of sale, sharing or targeted advertising, Google turns on restricted data processing, RDP, and shows only non-personalized ads.

The US states privacy message, in AdSense and Ad Manager, includes Texas and saves the choice in the US National section. With another CMP, check that it sends the US National section for Texan visitors and marks the opt-out when the GPC is on.

Another option is to turn on RDP directly in the ad tag, for example with restrictDataProcessing in GPT, for people who opted out. The opt-out must also reach header bidding, video and pixels.

In practice

What is and is not allowed in Texas

Examples for a site with ads that is covered by the law.

Allowed

Show personalized ads to adults without asking permission first, with a visible opt-out link
Treat the GPC and other global settings as an opt-out of targeted advertising
Record the opt-out in the US National section of the GPP
Show contextual ads to people who opted out
Fix the problem and send the written statement within the 30 days after a notice

Not allowed

Sell sensitive data without consent, even as a small business
Sell sensitive data without the mandatory notice sentence in the policy
Require creating an account to opt out of targeted advertising
Ignore a global opt-out setting because the visitor did not click the banner
Collect precise location through an app without notice and consent

Common errors

Where sites usually go wrong with Texas

The lack of a visitor threshold confuses a lot of people.

Looking for a visitor number

The business looks for a 100,000-visitor threshold that does not exist in Texas and does not check whether it is a small business under the SBA.

State section without US National

The CMP sends only the Texas section, which AdSense does not accept, and the ads stay personalized.

Global setting ignored

The site honors the GPC only for California and forgets that, since 2025, Texas law provides for opt-out through a global browser setting.

Policy without the required notice

The business sells sensitive data, but the policy does not include the mandatory sentence.

In ConsentMode

What the audit checks about the TDPSA

Opens the site as a Texas visitor with the GPC off and on and compares the ad requests.
Reads the GPP string and shows whether the US National section is present and indicates the opt-out.
Looks for the opt-out link in a visible place and checks that it leads to a choice screen, with no registration.
Identifies the CMP and checks that the ad and header bidding tags wait for its response.
Reads the privacy policy and points out whether rights, third parties, targeted advertising and the mandatory sentences are missing when sensitive data is sold.

Run an audit See everything that is checked

Frequently asked questions about the Texas law

My site is small. Does the TDPSA apply to me?

If the business is small under the SBA's criteria, most of the law does not apply. The exception is the sale of sensitive data, which requires consent from any business. The SBA's criteria vary by industry, so it is worth checking with your accountant or lawyer.

Do I need a consent banner for Texas?

For personalized ads to adults, no. The law asks for an opt-out. Consent is required for sensitive data.

Does Texas require honoring the GPC?

Since January 1, 2025, the law requires honoring opt-outs sent through a global browser or device setting, when identity and authorization can be verified. The law does not name the GPC, but it is the best-known example, and honoring it is the safest path.

Which GPP section should I send for Texas?

For Google, the US National section. The Texas section exists in the IAB standard, but AdSense does not list it as accepted.

Does ConsentMode tell me whether I am a small business?

No. That is a legal and accounting analysis. ConsentMode audits the site from the outside and shows whether the link, the signals and the policy are in place.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See whether the Texas opt-out reaches the ads

The audit opens the site as a Texas visitor, with and without GPC, and shows what to fix without changing anything.

Start the audit

TDPSA: the Texas law explained for people with ads

A state law with broad reach and active enforcement

What you need to meet

Publish a complete privacy notice

Say there is targeted advertising and how to opt out

Use the exact sentence if you sell sensitive data

Ask for consent for sensitive data

Accept the opt-out sent by the browser

Receive requests without requiring a new account

Do the data protection assessment

Pass the opt-out to Google