Texas on Sunday became the latest state to pass a privacy bill that aims to enable consumers to exert more control over data about themselves.
Unless vetoed by Governor Greg Abbott, the Texas Data Privacy and Security Act (HB 4) will require companies to allow residents to opt out of targeted advertising -- defined by the bill as serving ads to people based on their online activity over time and across nonaffiliated websites or apps.
The measure also will obligate companies to honor universal opt-out tools -- such as opt-out signals that consumers can send through their browsers -- but only if the companies honor those signals in other states.
Currently, four states -- California, Colorado, Connecticut and Montana -- have laws or regulations requiring companies to allow people to reject targeted advertising via a universal opt-out tool. As is the case in those other states, the Texas law only requires companies to honor universal opt-out mechanisms if consumers affirmatively activate the tools.
The Texas bill also requires companies to tell residents what non-pseudonymous data has been collected about them, and delete that data upon request.
Other states to pass comparable privacy laws this year are Iowa, Indiana, Montana, Tennessee and Florida. (The Florida bill hasn't yet been signed by Governor Ron DeSantis.)
While that group of states all allow residents to wield some control over their data, only Indiana and Montana require companies to allow consumers to reject ad targeting based on pseudonymous data, such as information tied to cookies.
Five other states -- California, Colorado, Connecticut, Utah and Virginia -- previously passed privacy laws that allow residents to reject behavioral ad targeting, including targeting based on pseudonymous data.
Washington state recently enacted a broad privacy law regarding health data. That measure requires website operators, app developers and others to obtain residents' consent before collecting, processing or sharing information about medical condition, prescriptions, “social” or “behavioral” interventions, reproductive or sexual health information, biometric data and genetic data.
The Texas law tasks the attorney general with enforcement, and doesn't empower consumers to sue over violations. If enacted, the law will take effect next July.