Texas Data Privacy Act: What Lead Buyers Should Know

The short answer

The Texas Data Privacy and Security Act (TDPSA), Chapter 541 of the Business and Commerce Code, has been in effect since July 1, 2024. It applies to companies that do business in Texas (or serve Texas residents), process or sell personal data, and aren't a small business as the U.S. Small Business Administration defines it. Small businesses are mostly exempt, but the Texas Attorney General notes one rule that still applies to them: a small business must get the consumer's consent before selling sensitive data. If you buy, route, or resell leads, the questions to ask are simple: does the act cover you, what does your privacy notice say, and can a consumer reach you with a request?

This post is general information, not legal advice. We used the Texas Attorney General's TDPSA overview and the statute text via Texas.Public.Law, a public mirror of the official code. Confirm the current text on statutes.capitol.texas.gov and talk to your attorney about your own situation.

Who the act covers

Section 541.002 says the chapter applies only to a person that:

1. conducts business in Texas or produces a product or service consumed by Texas residents,
2. processes or engages in the sale of personal data, and
3. is not a small business as defined by the SBA (except for the small-business rule on selling sensitive data).

The same section lists exclusions, including state agencies, financial institutions and data subject to Gramm-Leach-Bliley, HIPAA covered entities and business associates, nonprofits, and higher-education institutions.

"Personal data," the AG explains, generally means information linked or reasonably linkable to an identified or identifiable person. A lead record with a name, phone number, and address fits that description. "Sensitive data" includes things like precise geolocation and the personal data of a child under 13.

Whether you're a "small business" under SBA standards depends on your industry and size. That's a question for your accountant or attorney, not a guess.

What consumers can ask for

Under Section 541.051, a consumer can ask a covered company to:

• confirm whether it's processing their personal data and give them access to it,
• correct inaccuracies,
• delete personal data provided by or obtained about them,
• get a portable copy of data they provided, and
• opt out of targeted advertising, the sale of their personal data, and certain profiling.

The AG's overview says a company must respond without undue delay and no later than 45 days, with one 45-day extension when reasonably necessary if the company tells the consumer within the first 45 days.

Privacy notice and request methods

Covered companies need a privacy notice that is "reasonably accessible and clear." Section 541.102 lists what it must include: the categories of personal data processed, the purpose, how to exercise rights and appeal, the categories of data shared with third parties, the categories of those third parties, and how to submit requests. A company that sells sensitive data must post: "NOTICE: We may sell your sensitive personal data."

Section 541.103 adds that a company selling personal data to third parties, or using it for targeted advertising, must clearly and conspicuously disclose that and explain how to opt out.

Section 541.055 requires two or more secure and reliable methods for consumers to submit requests, and a company can't make someone create a new account to use them. A company that operates only online and has a direct relationship with the consumer only has to provide an email address.

Enforcement

The Attorney General enforces the act. Under Section 541.154, the AG must give written notice at least 30 days before suing, and can't bring the action if the company cures the violation within that period and provides a written statement describing the fix. After the cure period, Section 541.155 allows civil penalties of up to $7,500 per violation.

A practical checklist for lead buyers

• Decide whether the act covers you. Check the SBA small-business question with your advisor.
• Know your data flows. Write down what lead fields you receive, where they're stored, who else gets them, and whether you resell or share them.
• Read your privacy notice against Section 541.102. Does it name the categories, the purpose, the third parties, and how to submit a request?
• Set up request intake. A web form plus an email or phone line covers the "two or more methods" rule for most businesses.
• Log and route requests. Put the 45-day clock on your CRM tasks the same way you'd track lead quality by source.
• Keep contact rules separate. Privacy law doesn't replace calling and texting rules. See our posts on lead calling hours in Texas and Do Not Call rules.

How TX Lead Forge fits in

Automotive seller enquiries through TX Lead Forge are competing offers: a seller may hear from more than one dealer, so treat that lead data with care and contact the seller promptly. Roofing and real-estate leads are exclusive. Lead-quality issues are reviewed case by case, and we don't promise credits or replacements for any category. Learn more about automotive leads.

Bottom line

The TDPSA covers companies that process or sell Texans' personal data, unless they're SBA small businesses, and even small businesses need consent to sell sensitive data. If you're covered, you need a clear privacy notice, opt-out disclosures if you sell data or run targeted ads, two ways to submit requests, and a 45-day response process.

Looking at lead sources? Ask about competing auto seller enquiries, or exclusive roofing and real-estate leads, through TX Lead Forge.