Texas TDPSA in 2026 — AI Voice Enforcement After 18 Months in Force

Texas does not have a privacy commissioner; it has the Texas Attorney General. By 2026 his office has a dedicated privacy enforcement unit, and the TDPSA has matured from press release to subpoena.

What the law says

The Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code Chapter 541, took effect 1 July 2024. The TDPSA regulates controllers that conduct business in Texas or produce products or services consumed by Texans and process personal data — there is no consumer-count threshold like Virginia's; the small-business exemption tracks the federal SBA definition. Consumers have rights to access, correct, delete, port, and opt out of targeted advertising, sale, and profiling that produces legal or similarly significant effects.

Sensitive data — racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, citizenship, immigration status, genetic or biometric data, children's data, and precise geolocation — requires consent. The TDPSA introduced a unique notice requirement: businesses that sell sensitive personal data must publish a specific notice ("NOTICE: We may sell your sensitive personal data."). Data protection assessments are required for profiling, sensitive-data processing, sale, and targeted advertising. Civil penalties up to $7,500 per violation. The AG has a 30-day cure period that sunsets — he must give cure notice if the violation can be cured.

What AI voice/chat must do

Voice agents capturing precise geolocation, mental-health intent, biometric voiceprints, or immigration status must obtain consent. Profiling-for-significant-effect needs an opt-out and an assessment. The "NOTICE: We may sell your sensitive personal data" must appear if any tenant truly sells sensitive data — including via certain ad-tech sharing. The TDPSA's lack of a consumer-count threshold means even small Texas-facing operators are usually in scope. Right-to-cure responses must move within 30 days; document the cure or face penalties.

CallSphere posture

CallSphere — 37 agents, 90+ tools, 115+ DB tables, 6 verticals, 50+ businesses, 4.8/5, HIPAA and SOC 2 aligned — ships a Texas-aware consent flow that handles geolocation, biometric voiceprints, mental-health intent, and immigration status. The sale-of-sensitive notice is generated automatically when the tenant configuration enables any sale-of-sensitive flag. The data protection assessment template aligns with TDPSA Section 541.105. Pricing $149 / $499 / $1,499; 14-day trial; 22% lifetime affiliate at /affiliate; see /pricing; contact /contact; company at /about.

flowchart LR
A[TX Caller] --> B[Voice Agent]
B --> C[Sensitive Consent]
B --> D[Sale Notice?]
D --> E[Specific Wording]
B --> F[Profiling Opt-Out]
F --> G[541.105 Assessment]

Compliance checklist

1. Verify TDPSA scope — the SBA-tied exemption is narrow; assume in scope.
2. Capture consent for sensitive data before processing in every flow.
3. Publish the sale-of-sensitive notice if any tenant sells sensitive data.
4. Stand up the consumer-rights intake with a 45-day SLA.
5. Build the profiling opt-out into voice and web surfaces.
6. Complete data protection assessments for each in-scope category.
7. Track 30-day cure notices on a single dashboard.
8. Document training-data lawful basis — Texas does not exempt training.
9. Respect Universal Opt-Out where the AG has signalled enforcement.
10. Refresh annually as the AG's enforcement bulletins evolve.

FAQ

Does TDPSA apply if we have no Texas office? Yes if you produce products consumed by Texas residents or process Texan personal data. Geography is broad.

Is biometric voice data automatically sensitive? A biometric identifier processed for unique identification is sensitive. Mere recording for QA is debatable; default to consent.

What does "sale" mean under TDPSA? Exchange for monetary or other valuable consideration — broader than CCPA's, narrower than EU sale interpretations.

Are HIPAA-covered entities exempt? There are entity-level exemptions for HIPAA-covered entities and data-level for PHI. Many voice agents straddle both worlds.

Is there a private right of action? No — the AG has exclusive enforcement authority.

Sources

• TX AG TDPSA Consumer Page: https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act
• Texas DIR TDPSA Page: https://dir.texas.gov/technology-legislation/texas-data-privacy-and-security-act
• Goodwin TDPSA Effective-Date Alert: https://www.goodwinlaw.com/en/insights/publications/2024/06/alerts-practices-dpc-texas-new-privacy-law-goes-into-effect-enforcement
• White & Case TDPSA Summary: https://www.whitecase.com/insight-alert/texas-passes-comprehensive-data-privacy-law
• Tex. Bus. & Com. Code Chapter 541: https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm