Law note · Texas
Texas Capture or Use of Biometric Identifier Act (CUBI), publicly available media clause
What it asks of an app
- The mere existence of an image or other media containing someone's biometric identifiers on the Internet or another publicly available source does not, by itself, count as that person's informed consent to your capturing or storing their biometric identifier for a commercial purpose, unless they themselves made that image or media publicly available.
- A 2025 amendment (HB 149, TRAIGA) exempts biometric identifiers used to train, process, or store data for developing or evaluating an AI model, but this exemption is reported to end once the resulting system is deployed to uniquely identify a specific individual; its exact deployment boundary was not independently re-verified word for word in this research.
- Only the Texas Attorney General may sue under this Act, for a civil penalty of up to $25,000 per violation; there is no private right of action, unlike Illinois's BIPA.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics
What we found
CUBI, originally enacted in 2009 (exact enactment date not independently confirmed in this research) and amended by HB 149 (TRAIGA, 2025 Legislature, effective January 1, 2026), requires that a person inform an individual before capturing a biometric identifier (a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry) for a commercial purpose and receive that individual's consent.
The 2025 amendment adds a rule bearing directly on scraping: the mere existence of an image or other media containing someone's biometric identifiers on the Internet or another publicly available source does not, by itself, count as that person having been informed of or having consented to the capture or storage of their biometric identifier for a commercial purpose, unless the individual themselves made that image or media publicly available.
A separate 2025 amendment adds an exemption for biometric identifiers used in training, processing, or storing data to develop or evaluate an AI model, which the researched candidate reports lapses once the resulting system is deployed to uniquely identify a specific individual; this exemption's exact deployment boundary was not independently re-verified word for word in this research.
A civil penalty of not more than $25,000 per violation is recoverable solely by the Attorney General; CUBI carries no private right of action, unlike Illinois's BIPA.