• by Wendy Davis  @wendyndavis, June 21, 2023

Texas Governor Greg Abbott has signed a privacy bill that empowers residents to wield more control over data about themselves.

Among other requirements, the Texas Data Privacy and Security Act (HB 4) requires companies to allow residents to opt out of targeted advertising -- defined by the bill as serving ads to people based on their online activity over time and across nonaffiliated websites or apps.

Another provision requires companies to honor universal opt-out tools -- such as opt-out signals that consumers can send through their browsers -- provided the companies also honor those signals in other states.

Currently, four states -- California, Colorado, Connecticut and Montana -- require companies to allow people to reject targeted advertising via a universal opt-out tool.

The Texas law also prohibits companies that collect “sensitive” data -- including biometric information, precise geolocation data, or data revealing racial or ethic origin, religious beliefs, health diagnosis, sexuality and immigration status -- from processing that data without people's opt-in consent.

The law -- slated to take effect in July of 2024 -- exempts small businesses (as defined by the Small Business Association) from all provisions except for the one requiring businesses to obtain express consent to sell sensitive data.

The statute calls for penalties of $7,500 per violation and is only by the state attorney general. The law also only allows the attorney general to prosecute violators if they have been notified of a potential deficiency and given at least 30 days to remedy it.

The advocacy group Consumer Reports says the law includes “some important consumer rights,” but is urging state lawmakers to strengthen it in several ways, including by broadening its scope.

“We applaud the legislature for including universal opt-out, which will make it easier for Texas consumers to stop companies from selling or sharing their personal data and information,” Matt Schwartz, policy analyst at Consumer Reports, stated. “However, the law should apply to a broader swath of businesses and should include enforcement mechanisms that will actually incentivize them to comply the first time around.”

Texas is now the 11th state with a comprehensive privacy law, and the sixth state to enact such a law this year.