The new initiative comes as the state readies to roll out the Texas Data Privacy and Security Act, which is slated to go live on July 1.
Like the more than dozen other comprehensive state data privacy statutes currently on the books, the Texas law, enacted in June 2023, requires companies to give consumers the ability to access, delete, correct, and opt out of the sale and sharing of their personal information, including for targeted advertising purposes.
The law also contains nuances that set it apart from other state frameworks, including its broad reach. Rather than setting a minimum resident or data processing threshold, the Texas statute excludes small businesses as defined by the U.S. Small Business Administration from the law, except for the obligation to obtain consumer consent before selling sensitive data. This means that many companies not covered by other state regimes are likely to be swept up by the Texas law if they do business in the state.
The Texas measure also expands the definition of personal data to include pseudonymous data and bans the use of manipulative, coercive, or deceptive user-interface designs known as dark patterns to trick consumers into making unintended decisions, such as purchasing services or staying on a platform longer.
