trustifo

Effective 2024-07-01

Texas: data deletion and opt-out rights

Texas Data Privacy and Security Act provides covered residents with defined controls over personal data. Coverage, exemptions, authentication, and enforcement still determine how a request works in a specific case.

Current position: Texas Data Privacy and Security Act is included in Trustifo’s in-force state privacy map as of July 26, 2026. Its effective date is 2024-07-01. The authoritative starting point is the state source, which should control over any summary.

Rights relevant to a data-broker request

The law includes rights described in the official text as access, delete, correct, portability, opt out of sale, targeted advertising, and qualifying profiling. Labels are compressed here for comparison. The statute’s definitions matter: “sale,” “targeted advertising,” “consumer,” “personal data,” and “controller” can differ from ordinary usage and from the same terms in another state.

  • Access. Use the controller’s published request method and identify the right precisely. Keep the submission date and confirmation reference.
  • Delete. Use the controller’s published request method and identify the right precisely. Keep the submission date and confirmation reference.
  • Correct. Use the controller’s published request method and identify the right precisely. Keep the submission date and confirmation reference.
  • Portability. Use the controller’s published request method and identify the right precisely. Keep the submission date and confirmation reference.
  • Opt out of sale, targeted advertising, and qualifying profiling. Use the controller’s published request method and identify the right precisely. Keep the submission date and confirmation reference.

How to use the right with a broker

  1. Confirm that you are acting as a Texas resident in an individual or household context, where the statute uses that framing.
  2. Identify the legal entity and its first-party consumer-request channel. A brand name, parent, affiliate, and website operator may not be interchangeable.
  3. State the requested action—deletion, access, correction, or opt-out—without adding unnecessary identifiers.
  4. Complete reasonable authentication. If the controller cannot authenticate the request, ask what alternative matching information it accepts.
  5. Save the response. If the request is denied, follow any appeal instruction before contacting the enforcing authority.

The exact response period, extension rules, appeal mechanism, and authorized-agent conditions must be read in the source. Trustifo does not flatten those provisions into a universal deadline because the operative rule can depend on the request and later amendments.

Limits and exemptions

Comprehensive state privacy laws generally contain entity-level, data-level, or activity-level exemptions. Common examples involve government records, employment context, nonprofit organizations, financial institutions or data governed by the GLBA, health information under sectoral rules, and consumer-reporting activity governed by the FCRA. The presence of an exemption is not the same as a conclusion that it applies to a particular broker record.

Deletion can also be limited when information must be retained for security, fraud prevention, legal claims, transactions, or another purpose the statute permits. A controller may keep a narrow suppression record so deleted data is not immediately reintroduced. See suppression list and identity verification for the operational meaning of those terms.

Escalation and primary evidence

If a broker rejects a request, ask for the reason and preserve the response. Many state frameworks require a controller to provide an appeal channel, but the details vary. After completing that path, use the complaint or contact route supplied by the state attorney general or other enforcing body named in the law. Do not send a regulator more exposed personal information than is needed to explain the issue.

Return to the broker index for company-specific routes or compare all states in the rights matrix. California residents should also read the separate DELETE Act and DROP guide, because that system is directed specifically at registered data brokers.

Law and status reviewed July 26, 2026. Primary source: https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights. This explanation is general information, not legal advice or a determination of coverage.