Law note · Texas
Capture or Use of Biometric Identifier Act (CUBI), as amended by HB 149
CUBI is Texas's dedicated biometric-identifier statute. It defines 'biometric identifier' as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry, with no exclusion for an identifier derived from a photograph, video, or audio recording.
A person may not capture an individual's biometric identifier for a commercial purpose without first informing the individual and obtaining consent, may not sell, lease, or disclose a captured identifier outside narrow statutory exceptions, must store and transmit it with reasonable care equal to or better than its other confidential information, and must destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.
HB 149 (89th Legislature, 2025), effective January 1, 2026, added that an individual's biometric identifiers appearing in publicly available online media do not by themselves establish consent to capture unless that individual made the media publicly available, and added exemptions for biometric identifiers used only to train, process, or store data for developing or evaluating an AI model, and for AI systems used to prevent fraud, harassment, or other illegal activity.
What it asks of an app
- Inform an individual and obtain consent before capturing their retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry for a commercial purpose in Texas.
- Do not treat an individual's biometric identifiers appearing in publicly available online media as consent to capture them unless that individual made the media publicly available themselves.
- Do not sell, lease, or disclose a captured biometric identifier except for the narrow statutory exceptions covering identification of a missing or deceased person, a requested financial transaction, legal compulsion, or a law enforcement warrant.
- Store and transmit a captured biometric identifier with reasonable care equal to or exceeding the protection given your other confidential information, and destroy it within a reasonable time, no later than the first anniversary of when the collection purpose expires.
- Confirm any AI training use of biometric identifiers stays within the training, processing, or evaluation exemption. It ends once the AI system is deployed to uniquely identify a specific individual.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, trains_models
Primary source: official Texas statute text, Business and Commerce Code chapter 503, Texas Constitution and Statutes System