HB 1426 prohibits law enforcement from seeking or obtaining an individual's menstrual health data through search warrants, subpoenas, or court orders. The bill defines "menstrual health data" as any information - stored digitally or otherwise - relating to a person's menstrual cycles, including data from apps, devices, or medical records. It makes any data collected in violation inadmissible in criminal cases and takes effect September 1, 2025. This directly affects law enforcement agencies, courts, and individuals whose menstrual health data might otherwise be accessed by authorities.
HB 4976 requires digital service providers (like social media platforms) operating in Texas to verify the age of users before creating accounts. Specifically, providers must collect a user’s age during sign-up and verify it using reliable methods for anyone 18 or older. Users under 18 are treated as minors until they turn 18 and their age is verified. The law applies only to new accounts created on or after September 1, 2025, and does not affect existing accounts. It directly impacts digital platforms serving Texas residents.
HB 5046 requires businesses that sell consumers' personal data to third parties or use it for targeted advertising to clearly disclose these practices and provide an opt-out option. It directly affects businesses engaging in these data sales or targeted advertising activities within Texas. The bill mandates that businesses pay consumers 10% of the gross proceeds from data sales within 60 days of the transaction. The law takes effect on September 1, 2025, creating a new financial obligation for covered businesses.
HB 4456 requires social media platforms to verify the age of Texas residents before they can create new accounts. Platforms must use reasonable methods (like public or private data) to confirm users are 18+ and cannot retain or misuse the personal information collected during verification. Parents or guardians can request deletion of a minor’s account within 10 days, and platforms must comply. The law takes effect January 1, 2026, applying only to new accounts created after that date, with violations treated as deceptive trade practices under Texas law.
SB 2682 creates a new civil cause of action for victims of online impersonation in Texas. It defines online impersonation as using someone's name, voice, photo, or likeness on social media without consent (or parental consent for minors) to create a false identity with intent to harm, defraud, intimidate, or threaten. Victims can seek actual damages for related costs (like counseling or identity theft recovery), at least $500 in punitive damages, and court-ordered injunctions to stop the impersonation. The law excludes satire, parody, and law enforcement activities from liability.
HB 4636 requires businesses that sell consumers' precise geolocation data or real-time driving data (including location, speed, and trip details) to include a specific notice: "NOTICE: We may sell your precise geolocation data." This notice must appear alongside the business's standard privacy notice. The bill classifies both precise geolocation data and real-time driving data as "sensitive data" under Texas law. It takes effect on September 1, 2025, directly affecting apps and services that collect or sell this type of consumer data.
SB 2490 defines biometric identifiers (like fingerprints, facial scans, or voiceprints) used in artificial intelligence systems. It specifies that Texas law governing biometric data storage and destruction applies only when companies collect biometrics *specifically to identify individuals* for AI, not for general AI training. Crucially, if a company uses captured biometric data for a second commercial purpose (e.g., marketing), they must follow the law's rules for handling that data. The bill takes effect September 1, 2025, and directly affects businesses collecting biometric data for AI applications.
HB 5496 requires businesses using artificial intelligence in Texas to be transparent with residents. It mandates that companies implement industry best practices, provide tools for individuals to detect AI use, explain AI-driven decisions, and prevent biased or discriminatory outcomes. The law directly affects businesses offering goods, services, social media, political ads, or financial services to Texas residents. Violations would be treated as deceptive trade practices under existing law, with the bill taking effect September 1, 2025.
HB 5495 requires online companies to honor browser-based "global privacy controls" (like privacy settings in browsers) that signal a consumer's request not to sell or share their personal data. It directly affects businesses collecting consumer data online in Texas, mandating they treat these signals as valid opt-out requests. The bill establishes civil penalties of up to $5,000 per violation for failing to comply, with higher penalties for repeated offenses. The law takes effect September 1, 2025.
HB 3285 would require smart device manufacturers and service providers (like those making smart speakers, wearables, or home appliances) to provide consumers with clear, mobile app-based summaries about how their personal data is handled. The bill mandates that operators explain what data is collected (including biometrics or recordings), why it's collected, how it's captured, where it's stored (locally or sent to others), and the security policies protecting it. This directly affects users of smart devices and operators who sell, manufacture, or process data from these devices in Texas. The law would apply to most commercial smart devices but exclude state agencies, local governments, and utility providers.
