On this page
The Texas Data Privacy and Security Act (TDPSA) mostly does not apply to HIPAA-regulated healthcare. It exempts HIPAA covered entities, their business associates and nonprofits, and it exempts protected health information and health records. But it has no revenue or consumer-count threshold. It applies to any business that does business in Texas or serves Texans and processes personal data, unless it is a small business as defined by the U.S. Small Business Administration, and even a small business needs consent before selling sensitive data. That can bring in consumer health apps, direct-to-consumer wellness and supplement brands, and med spas or cash-pay practices that are not covered entities. For advertisers that do fall under it, Curve Compliance sends conversions to ad platforms server-side, with consent management, a fixed list of fields per platform and a BAA on every plan.
Is this legal advice? No. This page summarizes the statute and the Texas attorney general's guidance, with links to both. Talk to your counsel about how the law applies to your business.
For every state in one place, see the state health privacy laws reference table. Our guides to Montana, Indiana and Tennessee answer the same question, and managing overlapping state laws covers multi-state setups.
The TDPSA at a glance
| Question | Answer |
|---|---|
| Statute | Texas Business and Commerce Code, Chapter 541 (House Bill 4 of 2023) |
| In effect | July 1, 2024; opt-out signals through authorized agents since January 1, 2025 |
| Who must comply | Businesses that do business in Texas or make products or services Texans use, that process or sell personal data, and that are not small businesses under SBA definitions |
| Small businesses | Exempt, except they need consent before selling sensitive data |
| Exempt in healthcare | HIPAA covered entities and business associates; protected health information; health records |
| Nonprofits | Exempt |
| Health data | Sensitive data if it reveals a health diagnosis; consent required |
| Targeted advertising | Opt-out right and a required disclosure |
| Enforcement | Attorney general only; no private right of action |
| Penalty | Up to 7,500 dollars per violation after the cure period |
| Cure period | 30 days, with no end date in the text |
Who is exempt
Section 541.002(b) says the chapter does not apply to "a covered entity or business associate governed by the privacy, security, and breach notification rules" that HHS issued under HIPAA and the HITECH Act, or to "a nonprofit organization." Section 541.003 exempts "protected health information under the Health Insurance Portability and Accountability Act of 1996," "health records," and substance use disorder patient records under 42 U.S.C. 290dd-2. The attorney general's overview lists the same exemptions.
A covered entity outside the TDPSA is still inside HIPAA. HHS says covered entities "must comply with the Rules' requirements to protect the privacy and security of health information."
Which health and wellness businesses it can reach
Montana, Indiana and Tennessee all start with a headcount of residents. The TDPSA does not. Section 541.002(a) applies it to a person that "conducts business in this state or produces a product or service consumed by residents of this state," "processes or engages in the sale of personal data," and "is not a small business as defined by the United States Small Business Administration." The attorney general adds that if a small business "sells the sensitive data of a consumer, it must first obtain the consumer's consent."
In health and wellness, the question is HIPAA status. HHS says a health care provider is a covered entity "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard." If a business is neither a covered entity nor a business associate, "it does not have to comply with the HIPAA Rules." Businesses outside HIPAA that are not small businesses can include:
- Consumer health, fitness and cycle-tracking apps.
- Direct-to-consumer wellness, nutrition and supplement brands.
- Med spas, cash-pay clinics and subscription telehealth brands that are not covered entities.
- Marketing agencies, analytics companies and ad-tech vendors that process personal data for those brands. Under section 541.104, a processor "shall adhere to the instructions of a controller," and a contract must govern its processing.
Health data is sensitive data, and sensitive data needs consent
Section 541.001 defines sensitive data to include personal data revealing a "mental or physical health diagnosis," genetic or biometric data used to identify a person, data from a known child, and precise geolocation, meaning location accurate "within a radius of 1,750 feet." Section 541.101(b)(4) says a controller may not "process the sensitive data of a consumer without obtaining the consumer's consent." Consent must be "a clear affirmative act," and excludes "agreement obtained through the use of dark patterns."
If you sell sensitive data, section 541.102 requires this exact line, posted with your privacy notice: "NOTICE: We may sell your sensitive personal data." A sale is sharing personal data "for monetary or other valuable consideration" with a third party; disclosure to your own processor is not one. The attorney general's overview adds that data protection assessments are required for targeted advertising, sales of personal data and the processing of sensitive data.
Targeted advertising: the opt-out, the disclosure and opt-out signals
Section 541.051 lets consumers opt out of processing for "targeted advertising," "the sale of personal data," and certain profiling. Targeted advertising means ads selected from a consumer's activities "over time and across nonaffiliated websites or online applications." It excludes ads based on activity on your own sites, ads based on the current search or page, and "the processing of personal data solely for measuring or reporting advertising performance, reach, or frequency." If you sell personal data or process it for targeted advertising, section 541.103 says you "shall clearly and conspicuously disclose that process" and how to opt out.
Since January 1, 2025, section 541.055(e) has let consumers name an authorized agent to opt out through "an Internet browser setting or extension, or a global setting on an electronic device." A controller must comply if it can verify the consumer's identity and the agent's authority with commercially reasonable effort.
Book a call. Curve's team will go through what your site sends to ad platforms today and set up server-side conversions with consent rules for each state. Book a call with Curve.
Enforcement, penalties and the cure period
The attorney general "has exclusive authority to enforce this chapter" (section 541.151) and must post an online complaint form. Before suing, the office must give written notice at least 30 days ahead. A business that cures the violation within that period and provides a written statement, including any policy changes, avoids the action (section 541.154). The text sets no end date for that cure period. Section 541.155 sets a civil penalty of up to 7,500 dollars for each violation, plus injunctions and attorney's fees, and section 541.156 rules out a private right of action.
The billion-dollar settlements were not TDPSA cases
Texas's largest privacy recoveries came under other laws, from suits filed in 2022, before the TDPSA took effect. Per the attorney general's own releases:
| Case | Dates | Law | Outcome |
|---|---|---|---|
| Meta (Facebook): capturing face geometry from photos without consent | Sued February 2022; settled July 30, 2024 | Capture or Use of Biometric Identifier Act (CUBI) and the Deceptive Trade Practices Act | 1.4 billion dollars over five years |
| Google: location tracking, Incognito mode and biometric data | Suits filed or amended in January, May and October 2022; settled in principle May 9, 2025; signed October 31, 2025 | Deceptive Trade Practices Act (location and Incognito claims) and CUBI (biometric claims) | 1.375 billion dollars |
| Allstate and Arity: collecting and selling driving and location data from apps | Sued January 13, 2025 | TDPSA | Lawsuit filed; allegations, not findings |
The attorney general called the Allstate suit "the first enforcement action ever filed by a State Attorney General to enforce a comprehensive data privacy law." The release says the law "requires clear notice and informed consent regarding how a company will use Texans' sensitive data." For health marketers, the link is the data type: precise location and health diagnoses are both sensitive data under the TDPSA.
A working checklist for brands in scope
- Decide with counsel whether each business is a covered entity, a business associate, a nonprofit, a small business or none of these.
- List what your tags and SDKs send, and flag events tied to a diagnosis or precise location.
- Collect consent before processing sensitive data.
- Disclose targeted advertising, offer an opt-out and honor browser and device signals.
- Sign processor contracts and document assessments.
Where Curve Compliance fits
For brands in scope in Texas, Curve Compliance replaces browser ad pixels with one script and sends conversions from Curve's servers to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn. Each platform receives a fixed list of fields, and anything else is stripped. Page titles, free text and form answers are never sent, and contact identifiers are off by default and SHA-256 hashed when enabled.
Curve's consent management gives every US state its own opt-in or opt-out rule, records each decision in an audit log, and holds back tracking and ad forwarding for visitors who have not allowed it. Global Privacy Control is honored in every region as a decline of advertising. Curve also flags PHI-like patterns, such as condition names in URLs, before data reaches an ad platform. See what to configure in a consent banner, run the free compliance scanner to see which trackers your site loads, or read about conversion tracking.
Book a call. Curve signs a BAA on every plan, so the same setup serves covered entities and the brands these laws reach. Curve's team does the setup, typically live in about a week. Book a call with Curve.
Frequently Asked Questions
Does the TDPSA apply to healthcare providers?
Not to HIPAA covered entities, business associates or nonprofits. It can apply to health and wellness businesses outside HIPAA that are not small businesses.
Does the TDPSA apply to small businesses?
Generally no. Small businesses as defined by the SBA are exempt, except that they must get consent before selling a consumer's sensitive data.
Was the 1.4 billion dollar Meta settlement under the TDPSA?
No. The attorney general sued Meta in February 2022 under Texas's Capture or Use of Biometric Identifier Act and the Deceptive Trade Practices Act. The TDPSA took effect July 1, 2024.
Is health data sensitive data under the TDPSA?
Personal data revealing a "mental or physical health diagnosis" is sensitive data, and processing it requires the consumer's consent.
What is the penalty for violating the TDPSA?
Up to 7,500 dollars per violation, plus injunctions and attorney's fees, after a 30-day notice and cure period.
Can consumers sue under the TDPSA?
No. Section 541.156 rules out a private right of action. Consumers can complain to the attorney general instead.