TX HB4

Establishes the Texas Data Privacy and Security Act, granting Texas residents rights to access, correct, delete, and obtain portable copies of their personal data, as well as opt out of targeted advertising, data sales, and certain profiling by data controllers.

Applies to non-small businesses that conduct business in Texas or serve Texas residents and process or sell personal data; exempts state agencies, nonprofits, higher education institutions, electric utilities, and entities already governed by HIPAA or the Gramm-Leach-Bliley Act.

Requires controllers to provide clear privacy notices, obtain consumer consent before processing sensitive data (including biometric data, precise geolocation, data revealing race/ethnicity/health/religion, and data from children under 13), conduct data protection assessments for high-risk processing activities, and prohibits the use of dark patterns to obtain consent.

Grants the attorney general exclusive enforcement authority with a 30-day cure period before action; imposes civil penalties of up to $7,500 per violation and allows injunctive relief, with no private right of action for consumers.

Takes effect July 1, 2024, with the authorized agent/universal opt-out mechanism provision taking effect January 1, 2025; requires the Department of Information Resources to publish an implementation review report by January 1, 2025.