Topic
Privacy and Biometrics
What Texas privacy and biometric law requires when an AI system collects, infers or trains on information about people.
Law checked through
Short Answer
The Texas Data Privacy and Security Act governs covered businesses that process consumer personal data. It requires privacy notices, rights processes, security and assessments for specified processing. Its consumer definition excludes employment and commercial contexts, and its entity exemptions matter. The separate biometric statute covers retina or iris scans, fingerprints, voiceprints and records of hand or face geometry captured for a commercial purpose. An ordinary photograph is not automatically a biometric identifier. The Texas Responsible Artificial Intelligence Governance Act (TRAIGA) added exceptions for specified AI activities and security uses, with conditions that must be read separately. The Attorney General announced a $1.4 billion Meta settlement on July 30, 2024 and finalized a $1.375 billion Google settlement on October 31, 2025. The Google resolution also covered location and incognito-mode allegations. Those settlements are enforcement outcomes, not decisions that every AI use violates biometric law. Minors bring additional app, platform and Children’s Online Privacy Protection Act (COPPA) duties. A security incident requires analysis under Texas breach law even when the affected system is an AI tool. Begin with the data, the purpose, the parties and the applicable exemption; then select the Guide below. A useful inventory includes prompts, recordings, retrieved documents and vendor copies, with a retention purpose for each.
Key Authorities
Guides
Personal Data and Biometric Information in AI Systems
How the Texas Data Privacy and Security Act and the biometric identifier statute apply when AI systems collect, infer or train on information about people.
Texas AI Processor Duties
What the TDPSA requires of AI vendors that process personal data for a business, and what HB 149 added.
Minors, Apps, and AI
The Texas and federal rules that apply when children and teenagers use apps, platforms and AI services.
AI Security Incidents and Breach Notification
When an AI system leaks or exposes data, Texas’s ordinary breach rules apply, and the clock starts when the business determines a breach occurred.
Insights
AI Data Duties in Texas Processor Contracts
HB 149 added AI to a processor’s security assistance duty under the Texas Data Privacy and Security Act (TDPSA). It did not add a new mandatory contract clause.
SB 2420 at the Fifth Circuit and the Supreme Court
The June 4, 2026 stay allowed enforcement of the app-store law; the July 6, 2026 Supreme Court order left that stay in place.