Texas Data Privacy Law and AI: What Small Businesses Need to Know

If you run a small business in Texas and haven't looked closely at the Texas Data Privacy and Security Act, you're not alone — and depending on your size, you may be exempt from most of it. But "may be exempt" and "definitely exempt" are different things, and the parts that apply even to exempt businesses are exactly the parts that intersect with how your team uses AI tools on customer data.

What the Texas Data Privacy and Security Act actually does

The TDPSA took effect on July 1, 2024, and it gives Texas residents a set of rights over the personal data companies hold about them: the right to know what data a company has, the right to correct it, the right to delete it, and the right to opt out of targeted advertising and the sale of their data. Companies covered by the law also have to provide a clear privacy notice, use "reasonable data security practices," and limit data collection to what's genuinely needed for the purposes they've disclosed.

Consumers can't sue a company directly under the TDPSA — enforcement sits exclusively with the Texas Attorney General, who can pursue civil penalties of up to $7,500 per violation.

The small business exemption — and its limits

Here's the detail most small-business owners actually need: businesses that meet the U.S. Small Business Administration's definition of a small business are generally exempt from most of the TDPSA's requirements. That covers a real share of the businesses this guide is written for.

But the exemption isn't unconditional. Even a business that qualifies as small under the SBA definition must still get consumer consent before selling sensitive personal data. "Sensitive" in Texas privacy law generally covers things like health information, biometric or genetic data, precise geolocation, and data revealing racial or ethnic origin, religious belief, or citizenship status. If your business touches any of those categories and monetizes them in any way, the exemption doesn't fully cover you.

Where AI tools fit into your TDPSA obligations

The TDPSA doesn't have a carve-out for data that happens to pass through an AI tool. If your business is a covered entity under the law, personal data of Texas residents is regulated the same way whether it sits in a spreadsheet, a CRM, or a prompt typed into a chatbot. A few practical implications follow from that:

• If a customer asks what data you hold on them, and some of that data lives in AI-tool logs or AI-generated summaries stored in your systems, that data is potentially in scope for their access request.
• If an AI vendor uses customer data to train its own models without your customers' knowledge, and that counts as a "sale" or transfer of personal data under the Act's definitions, that's a compliance question worth raising directly with the vendor — not assuming away.
• "Reasonable data security practices" applies to however you store AI outputs that contain customer data, the same as it applies to any other system holding that data.

This is one more reason the vendor's own data-use terms matter — see our guide on what happens to data typed into ChatGPT and similar tools for how consumer and business plans differ on this point.

Practical steps for a Texas small business using AI

How this fits with other data rules you might already follow

Texas isn't the only state with a comprehensive privacy law anymore, and if your business serves customers outside Texas, a similar law in another state may apply to those customers even while the TDPSA covers your Texas ones. The practical takeaway is the same either way: a data classification and vendor-vetting approach built once, at a reasonably high standard, tends to satisfy several state frameworks at once rather than needing a separate process per state.

If your business is also subject to HIPAA, GLBA, or another federal data rule, the TDPSA generally layers on top of those rather than replacing them — meeting one doesn't automatically satisfy the other. See our guides on HIPAA and AI for medical and dental offices and AI in financial and insurance offices if either applies to you, and our broader guide to protecting customer PII for a data classification approach that works across all of these frameworks at once.

What a Texas resident can actually ask your business for

For businesses that are covered by the TDPSA (not exempt as a small business, or exempt but still handling sensitive data sales), it helps to know what a consumer request actually looks like in practice. Under the Act, a Texas resident can ask a covered business to confirm what personal data it holds about them, correct inaccurate data, delete their data, and stop selling their data or using it for targeted advertising. Covered businesses are required to offer at least two secure, reliable ways for a resident to submit that kind of request, and must respond within 45 days, with one 45-day extension available if needed.

If your business is exempt as a small business but voluntarily wants to build customer trust, offering a simple way to ask "what do you have on me" — even informally, by email — costs little and heads off a more adversarial version of the same question later.

Why this needs a standing owner, not a one-time review

Texas privacy law, like most state privacy frameworks, tends to be amended and interpreted further over time — new sensitive-data categories can be added, thresholds can shift, and enforcement priorities from the Attorney General's office can change what actually gets scrutinized. Treating this as a "read once and file away" document is how businesses end up out of step with a law that looked settled a year earlier. Assign one person — often whoever already owns your privacy notice or your AI vendor list — to check for updates at least once a year, alongside the broader review described in our AI governance for small business guide.

Common mistakes

• Assuming "small business" is a self-evident label. The SBA's size standards are specific and vary by industry — check the actual threshold, not a gut feeling.
• Treating the exemption as total. The consent requirement for selling sensitive data applies even to exempt small businesses.
• Ignoring AI vendor terms. If an AI tool's data-use terms function like a data sale under the Act, your exemption status doesn't necessarily cover that specific practice.
• Never revisiting size status. A growing business can cross the small-business threshold without anyone noticing until an audit or complaint raises it.

This guide is general information, not legal advice. Have a qualified attorney review any policy before you adopt it.