Texas Data Privacy and Security Act and AI: TRAIGA and HB 300
· Written and maintained by Nonimo
Texas privacy law is not one statute but four, and all four end at the same desk: the attorney general’s. The Texas Data Privacy and Security Act covers consumer data with no revenue threshold. TRAIGA, the state’s AI law, took effect on January 1, 2026. HB 300 stretches health privacy to anyone who touches protected health information. And a breach involving 250 Texans goes to the attorney general within 30 days.
For a business that puts customer details into ChatGPT, Claude or Copilot, that adds up to a short list of duties and a long list of exposures. This page covers only what is Texan about it. The federal layer, from HIPAA to the FTC, is in our guide to which AI tools comply with US privacy law, and the other states are in the state by state overview.
The Texas Data Privacy and Security Act: who it covers
The TDPSA, chapter 541 of the Business and Commerce Code, has applied since July 1, 2024. Section 541.002 sets three conditions: the person conducts business in Texas or produces something Texans consume, processes or sells personal data, and is not a small business as the US Small Business Administration defines one. There is no revenue figure and no count of consumers.
| The TDPSA does not apply to | Section 541.002(b) |
|---|---|
| State agencies and political subdivisions | (1) |
| Financial institutions and data under Gramm-Leach-Bliley | (2) |
| HIPAA covered entities and business associates | (3) |
| Nonprofit organizations | (4) |
| Institutions of higher education | (5) |
| Electric utilities, power generation companies and retail electric providers | (6) |
Business and Commerce Code 541.002, as enacted by HB 4 (2023) and in force since July 1, 2024.
The SBA test is a federal yardstick, set industry by industry, not a Texas number, so a company has to check its own size standard rather than assume it is small. Even below it, section 541.107 keeps one duty: a small business may not sell sensitive data without the consumer’s prior consent, under the same penalty as everyone else.
Employees fall outside it
The act protects a “consumer”, defined in section 541.001(7) as a Texas resident acting only in an individual or household context. The same definition says the term does not include an individual acting in a commercial or employment context. TRAIGA copies it word for word in section 551.001(2).
So an HR team’s performance notes or a contractor’s invoice are outside both laws, which is the opposite of California, where employees have had CCPA rights since 2023, as our California page sets out. Employment rules on AI come from elsewhere, and our guide to AI for HR collects them.
Sensitive data and AI vendors under the TDPSA
Two duties in section 541.101 decide most AI questions. A controller must limit collection to what is adequate, relevant and reasonably necessary for the disclosed purpose, and it may not process sensitive data without the consumer’s consent. Consent has to be freely given, informed and unambiguous; the attorney general’s guidance adds that broad general terms and dark patterns do not count.
Sensitive data in section 541.001(29) is a short defined list, and it is not the same list Texas uses for breaches.
| TDPSA sensitive data | Where it turns up in an AI prompt |
|---|---|
| Racial or ethnic origin, religious beliefs | HR notes, customer complaints |
| A mental or physical health diagnosis | Claim files, leave emails, intake forms |
| Sexuality | Benefits and family details |
| Citizenship or immigration status | Onboarding, visa support letters |
| Genetic or biometric data used to identify someone | Face photos run through recognition |
| Data from a known child, and precise geolocation | School forms, delivery and field logs |
Business and Commerce Code 541.001(29).
A customer note mentioning a diagnosis is sensitive data and needs consent before it is processed. A Social Security number on its own is not on this list, though chapter 521 treats it as sensitive personal information when a breach happens.
The AI vendor is a processor, and HB 149 changed its duties
An AI provider that handles personal data for your business is a processor, and section 541.104(b) lists what the contract must contain: instructions, the nature and purpose of processing, the type of data, the duration, a duty of confidentiality, deletion or return at the end, information to show compliance, cooperation with assessments, and the same terms passed to subcontractors.
TRAIGA reached into this section. Since January 1, 2026, section 541.104(a)(2) has required a processor to help the controller meet security requirements for personal data “collected, stored, and processed by an artificial intelligence system”. Which providers sign such terms, and on which plans, is set out in our guide to what ChatGPT does with your data and our Claude guide.
Data protection assessments, and pseudonymous data
Section 541.105 requires a documented data protection assessment for targeted advertising, sale, risky profiling, any processing of sensitive data, and any processing with a heightened risk of harm. Sending customers’ health diagnoses to an AI vendor is processing sensitive data, so the assessment comes with it. The processor has to supply what the controller needs to write it.
Section 541.106(c) is the one place the act rewards keeping identities apart. Several consumer rights and the section 541.101 controller duties do not apply to pseudonymous data where the controller can show the identifying information is kept separately, under effective controls. The detail matters, and our guide to data anonymization before AI explains what pseudonymizing does and does not achieve.
TRAIGA: what Texas’s AI law actually requires
The Texas Responsible Artificial Intelligence Governance Act, HB 149, was signed on June 22, 2025 and took effect on January 1, 2026. It adds Subtitle D to the Business and Commerce Code, chapters 551 to 554. It applies to anyone who promotes, advertises or conducts business in Texas, offers a product or service Texans use, or develops or deploys an AI system in the state.
Most of TRAIGA is a list of prohibited purposes, not a compliance program. A person may not develop or deploy an AI system with the intent to incite self harm, harm to others or crime, to infringe constitutional rights, or to unlawfully discriminate against a protected class.
Section 552.056(c) adds that a disparate impact is not enough by itself to show intent. Colorado took a different route, with duties on deployers of automated decisions, set out in our guide to the Colorado AI Act.
The disclosure duty, and who it falls on
For private businesses, TRAIGA’s disclosure duty is narrow. Section 552.051(b) requires governmental agencies to tell consumers they are interacting with AI. The only private sector duty is in subsection (f): a provider of health care services or treatment must disclose AI used in that care to the patient, or their representative, by the date the service is first provided, or as soon as reasonably possible in an emergency.
A health practice in Texas therefore carries two AI disclosures. SB 1188, in force since September 1, 2025, separately requires a practitioner who uses AI for diagnostic purposes to disclose it to patients and to review AI created records against Texas Medical Board standards, in Health and Safety Code chapter 183. Our guide to HIPAA compliant AI covers the federal side of the same workflow.
What the attorney general can demand
The working duty for an ordinary business is to be able to answer a civil investigative demand. Section 552.103(b) lets the attorney general ask, after a complaint, for a description of the system’s purpose and use, the data used to train it, the categories of input data, its outputs, performance metrics, known limitations, and post deployment monitoring and safeguards.
For a firm using a general chatbot, the input question is the uncomfortable one: which categories of client data staff type into it. A written answer to that belongs in a US AI policy, with the account, the plan and what may not be pasted.
| TRAIGA violation, after the 60 day cure period | Civil penalty |
|---|---|
| Curable, or a breach of the written cure statement | $10,000 to $12,000 each |
| Uncurable | $80,000 to $200,000 each |
| Continuing | $2,000 to $40,000 for each day |
Business and Commerce Code 552.105(a), as added by HB 149.
Cure periods, defenses and the NIST profile
The attorney general must first send written notice and wait 60 days; a business that cures, documents how and fixes its policies in that time cannot be sued.
Section 552.105(c) creates a rebuttable presumption of reasonable care, and subsection (e) bars liability where someone else misused the system or the business found the problem through red team testing, feedback, or an internal review while substantially complying with NIST’s generative AI profile or another nationally or internationally recognized AI risk management framework.
That last defense is the one a small business can prepare for. The NIST profile is voluntary, but in Texas following it, or a comparable framework, is part of a statutory defense. TRAIGA also sets up a sandbox for testing AI systems for up to 36 months and a Texas Artificial Intelligence Council of seven members, neither of which changes a business user’s duties.
Health information: HB 300 and chapter 181
HB 300, in force since September 1, 2012, rewrote Health and Safety Code chapter 181 and made Texas health privacy wider than HIPAA in its reach. A “covered entity” in section 181.001(b)(2) is any person who, for commercial, financial or professional gain, or on a nonprofit or pro bono basis, assembles, collects, analyzes, uses, stores or transmits protected health information, or simply comes into possession of it.
The list in the definition names business associates, health care payers, schools, health researchers and “information or computer management” entities, and it extends to their employees, agents and contractors. A personal injury firm, a billing company and an IT vendor all qualify once they hold PHI. Our PHI and PII guide explains which records are PHI in the first place.
Training within 90 days, and a signed statement
Section 181.101 requires every covered entity to train employees on state and federal law on protected health information as their duties require. New employees must finish within 90 days of being hired, and when a material change in the law affects their duties, training follows within a year of it taking effect. Each employee signs a statement, electronically or on paper, and the entity keeps it for six years.
Electronic disclosure needs an authorization
Section 181.154 is the clause an AI workflow runs into. A covered entity must give notice that PHI is subject to electronic disclosure, and may not disclose it electronically to any person without a separate authorization for each disclosure, unless it goes to another covered entity for treatment, payment, health care operations or an insurance function, or another law allows it.
Whether a chatbot vendor counts as another covered entity, and whether the use is health care operations, are questions for counsel. Section 181.153 separately bars disclosing PHI for remuneration outside those purposes. Civil penalties under section 181.201 reach $5,000 per negligent violation a year, $25,000 if knowing or intentional, and $250,000 when PHI is used for financial gain.
SB 1188 adds a location rule from January 1, 2026: covered entities must keep electronic health records containing patient information physically in the United States or its territories, including records held by a cloud provider. An AI tool that stores a chart summary is worth checking against it, alongside the safe harbor list in our HIPAA guide.
Biometrics: CUBI and the Meta settlement
Texas has had a biometric privacy law since 2009, the Capture or Use of Biometric Identifier Act, in Business and Commerce Code 503.001. It bars capturing a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry for a commercial purpose without informing the person and getting consent, and sets a civil penalty of up to $25,000 per violation, recoverable only by the attorney general.
HB 149 rewrote parts of it. Training AI on biometric identifiers is now excluded unless the system is used to identify a specific person, and an image posted online does not count as consent unless the person posted it. A photo of a driver’s license carries face geometry, which is why our tool to watermark a Texas driver’s license works on the image in your browser and never uploads it.
Breach notice in Texas: 60 days to people, 30 to the attorney general
Business and Commerce Code 521.053 gives a business that owns or licenses computerized sensitive personal information 60 days, from the date it determines the breach occurred, to notify the individuals affected. Texas requires notice to any individual affected, wherever they live, and lets a resident of a state with its own law be notified under that state’s rules instead.
The attorney general’s deadline is shorter. Since SB 768 took effect on September 1, 2023, a breach involving at least 250 Texans must be reported electronically through the office’s online form as soon as practicable and no later than 30 days after the determination. The report gives the number of Texans affected and notified, the measures taken and whether law enforcement is involved.
| Deadline or duty | Trigger |
|---|---|
| Individuals: 60 days | Any breach of sensitive personal information |
| Attorney general: 30 days, online form | 250 or more Texans |
| Nationwide credit bureaus | More than 10,000 people at once |
| Up to $100 per person per day, capped at $250,000 | Failing to notify individuals |
Business and Commerce Code 521.053 and 521.151(a-1), read October 13, 2026.
“Sensitive personal information” in section 521.002 means a name with a Social Security, driver’s license or government ID number, or an account number with its access code, or information identifying someone and relating to their health or health care.
Chapter 521’s general penalty runs from $2,000 to $50,000 per violation. Whether putting such data into an AI tool triggers any of it is a separate question, covered in our guide on whether putting client data into ChatGPT is a data breach.
Who enforces Texas privacy and AI law
The attorney general enforces every law on this page, with licensing boards adding discipline under chapter 181, and the two newest rule out private lawsuits in so many words: section 541.156 for the TDPSA and section 552.101(b) for TRAIGA. The office runs online complaint channels for both, and TRAIGA required it to post its AI complaint mechanism by September 1, 2026.
The office has used these powers. On January 13, 2025 it sued Allstate and its subsidiary Arity under the TDPSA over driving data collected through other companies’ apps, and called it the first enforcement action filed by a state attorney general under a comprehensive privacy law. On September 18, 2024 it settled with Pieces Technologies, a Dallas company selling generative AI to hospitals, over its advertised accuracy, as our HIPAA guide recounts.
The cure periods differ by law
Before suing under the TDPSA, the attorney general must give 30 days’ written notice under section 541.154, and a business that cures and confirms in writing cannot be sued; after that, penalties reach $7,500 per violation under section 541.155. TRAIGA’s notice period is 60 days. The national guide compares how other states enforce.
A Texas checklist for AI at work
In the order a Texas business can work through it:
- Check the size test. Look up your SBA size standard; below it, only the rule on selling sensitive data applies.
- Get consent or keep it out. A diagnosis, immigration status or precise location in a prompt is sensitive data under section 541.101(b)(4).
- Paper the processor. The AI vendor’s contract needs the section 541.104(b) terms, and a data protection assessment covers the sensitive data.
- Write the TRAIGA answer. Record which AI systems you use, what data goes in and what safeguards apply, in case of a civil investigative demand.
- Train for HB 300. Anyone handling PHI trains within 90 days of hire and signs a statement you keep six years.
- Time the breach letters. Thirty days to the attorney general for 250 Texans, sixty to the people affected.
Items 2 and 3 are where your AI policy earns its keep, and item 5 pairs with the 18 HIPAA identifiers.
Nonimo in a Texas office
Nonimo is an app for Mac and Windows that works on the text before it reaches ChatGPT, Claude or Copilot. A paralegal at a Houston personal injury firm highlights a demand letter and presses one key, and the client’s name, address and Social Security number become placeholders on that computer. When the answer comes back, the real details go back in on the same machine.
In Texas terms, that means less sensitive data and less PHI going to a processor, a shorter answer to the attorney general’s question about input data, and fewer identifiers in a vendor’s systems if a breach ever happens there. It does not replace the processor contract, the consent or the HB 300 training.
The diagnosis stays in the letter, so the chapter 181 duties still apply on your side. The conversation stays on the computer, encrypted, and what the app sends out is a daily usage count with no text, as the security page sets out. Start from Nonimo for US teams, or see the Nonimo page for law firms if your files carry medical records.
Sources
Read October 13, 2026.
- Texas Legislature Online, HB 4, 88th Legislature, enrolled: TDPSA, Business and Commerce Code 541.001(7) and (29), 541.002, 541.101, 541.104(b), 541.105, 541.106, 541.107, 541.154 to 541.156; effective July 1, 2024.
- Texas Legislature Online, HB 149, 89th Legislature, enrolled and its history: TRAIGA, sections 551.001 to 552.106, 553.053, the amendments to 503.001 and 541.104(a)(2); signed June 22, 2025; effective January 1, 2026.
- Texas Constitution and Statutes, Business and Commerce Code chapter 541: current text of 541.104 as amended by HB 149.
- Texas Constitution and Statutes, Business and Commerce Code chapter 521: 521.002, 521.053 and 521.151.
- Texas Legislature Online, SB 768, 88th Legislature, enrolled: 30 days to the attorney general; effective September 1, 2023.
- Texas Constitution and Statutes, Health and Safety Code chapter 181: 181.001, 181.101, 181.153, 181.154 and 181.201.
- Texas Legislature Online, HB 300 history: effective September 1, 2012.
- Texas Legislature Online, SB 1188, 89th Legislature, enrolled: Health and Safety Code 183.002 and 183.005; effective September 1, 2025, with storage applying from January 1, 2026.
- Texas Constitution and Statutes, Business and Commerce Code chapter 503: CUBI, consent and $25,000 per violation.
- Texas Attorney General, Consumer AI Rights and the TDPSA page: overview, penalties, consent and complaints.
- Texas Attorney General, data breach reporting: 250 Texans, 30 days, electronic form.
- Texas Attorney General, Allstate and Arity lawsuit, January 13, 2025; Meta settlement, July 30, 2024; Pieces Technologies settlement, September 18, 2024.
Common questions
What is the Texas privacy law?
There is no single one. The Texas Data Privacy and Security Act covers consumer personal data from July 1, 2024; the Responsible Artificial Intelligence Governance Act, TRAIGA, covers AI systems from January 1, 2026; Health and Safety Code chapter 181, as rewritten by HB 300, covers health information; and Business and Commerce Code chapter 521 sets the breach rules. The attorney general enforces all four. Nonimo reduces what reaches an AI vendor under any of them.
Does the TDPSA apply to small businesses?
Mostly not. Section 541.002 applies the act to a person doing business in Texas that processes or sells personal data and is not a small business as the US Small Business Administration defines it. There is no revenue or volume test. The one rule that still reaches small businesses is section 541.107: they may not sell sensitive data without the consumer's prior consent. Nonimo works the same for a firm of any size.
Does the TDPSA cover employee data?
No. The act defines a consumer as a Texas resident acting only in an individual or household context, and expressly leaves out anyone acting in a commercial or employment context. TRAIGA uses the same definition. Chapter 181 largely exempts employers too, but its bans on selling protected health information or disclosing it electronically without authorization still apply to them. Nonimo redacts names and identifiers on the computer first.
What does TRAIGA require of a business using ChatGPT?
Very little directly. TRAIGA mainly bans developing or deploying AI with a prohibited intent, such as manipulating someone toward self harm or unlawfully discriminating, and disparate impact alone does not prove intent. A business must disclose AI use if it provides health care services with it. The practical duty is records: the attorney general can demand a description of the system, its data inputs and its safeguards.
What are the penalties under TRAIGA?
After written notice and 60 days to cure, a court can impose $10,000 to $12,000 for each curable violation, $80,000 to $200,000 for each uncurable one, and $2,000 to $40,000 a day for a continuing violation. Only the attorney general can sue, and there is no private right of action. One listed defense covers a violation found through an internal review while substantially complying with NIST's generative AI profile or another recognized framework.
Who is a covered entity under Texas HB 300?
Almost anyone who handles protected health information. Health and Safety Code 181.001 covers any person who assembles, collects, analyzes, uses, stores or transmits it for commercial, financial or professional gain, or who simply comes into possession of it, and names information or computer management entities. That reaches law firms, billing companies and IT vendors that HIPAA would not treat as covered entities. Nonimo keeps patient identifiers on the workstation.
How fast must a Texas business report a data breach?
Individuals must be told without unreasonable delay and no later than 60 days after the business determines the breach occurred. If at least 250 Texans are involved, the attorney general must be notified electronically as soon as practicable and no later than 30 days after that determination, using the form on its website. Above 10,000 people, the nationwide credit bureaus are notified too.
Can a customer sue a business under Texas privacy law?
Not under the TDPSA or TRAIGA: section 541.156 and section 552.101 both rule out a private right of action, so enforcement runs through the attorney general. The office uses it: on January 13, 2025 it sued Allstate and Arity, in what it called the first enforcement action by a state attorney general under a comprehensive privacy law. Keeping identifiers out of AI tools with Nonimo lowers what such an investigation would find.