Law note · Texas
Texas Data Privacy and Security Act, Attorney General enforcement
The Texas Attorney General has exclusive authority to enforce TDPSA. Before suing, the Attorney General must give an alleged violator 30 days' written notice identifying the specific provisions violated; curing the violation within that period and confirming the cure in writing bars the action. An uncured violation is subject to a civil penalty of up to $7,500 per violation, and the chapter expressly bars any private right of action.
The Attorney General filed the state's first TDPSA enforcement action against Allstate Corp. and Arity LLC on January 13, 2025, over the sale of geolocation and driving-behavior data collected through SDKs embedded in third-party apps, and that case remains pending.
What it asks of an app
- Expect TDPSA violations to be enforced exclusively by the Texas Attorney General, never by a private plaintiff.
- Cure a violation and confirm the cure in writing within 30 days of Attorney General notice to avoid a civil penalty of up to $7,500 per violation.
- Do not treat the absence of individual lawsuits as low risk. The Attorney General is actively litigating a TDPSA enforcement action over data sales through embedded SDKs.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Texas statute text, Business and Commerce Code chapter 541, Texas Constitution and Statutes System