Selling company data to AI companies in Texas

This guide covers Texas law for companies licensing records to AI buyers. Federal law and other states' laws still apply, as our US guide explains, and the general rules on rights and ownership are in our guide to whether you can legally sell company data.

Does the Texas Data Privacy and Security Act apply to your company?

The Texas Data Privacy and Security Act applies to your company if it does business in Texas or offers products or services used by Texans, processes or sells personal data, and is not a small business as defined by the US Small Business Administration. The Texas Attorney General says the Act took effect on July 1, 2024.

Unlike most state laws, the TDPSA has no volume or revenue threshold. Section 541.002 also exempts financial institutions and data subject to GLBA, and HIPAA covered entities and business associates.

Small businesses are not entirely outside it. Section 541.107 says a small business may not sell personal data that is sensitive data without the consumer's prior consent, and the Attorney General's page repeats that rule.

Is licensing data to an AI buyer a sale under Texas law?

Licensing personal data to an AI buyer for money or other value is a sale under Texas law. Section 541.001 defines a sale of personal data as the sharing, disclosing or transferring of personal data for monetary or other valuable consideration by the controller to a third party.

The definition excludes disclosures to processors, to affiliates, to provide a product the consumer requested, of information the consumer made public through mass media, and transfers as part of a merger or acquisition. A standalone license to an AI company fits none of these.

Two definitions narrow the problem. A consumer is a Texas resident acting only in an individual or household context, and the term does not include someone acting in a commercial or employment context. Deidentified data is data that cannot reasonably be linked to an identified or identifiable individual or a linked device.

• Section 541.106 says a controller holding deidentified data must take reasonable measures to ensure it cannot be associated with an individual
• It must publicly commit to keep and use the data without trying to reidentify it
• It must contractually oblige any recipient to comply with the chapter

Sensitive data, such as health, biometric and precise geolocation data, cannot be processed without consent. If you sell it, the Attorney General says your privacy notice must state NOTICE: We may sell your sensitive personal data, or the equivalent for biometric data.

Who enforces the TDPSA and what are the penalties?

The Texas Attorney General has exclusive authority to enforce the TDPSA, and there is no private right of action. Before suing, the Attorney General must give written notice and 30 days to cure.

Under section 541.155, a person who violates the chapter after the cure period, or breaches a written statement given to the Attorney General, faces a civil penalty of up to $7,500 per violation, plus injunctions and the Attorney General's fees.

Texas regulates biometric data in AI training through the Capture or Use of Biometric Identifier Act, Business and Commerce Code section 503.001, often called CUBI. It covers retina or iris scans, fingerprints, voiceprints and records of hand or face geometry.

A person may not capture a biometric identifier for a commercial purpose without informing the individual and getting consent. A person holding one may not sell, lease or otherwise disclose it except with consent for identification after disappearance or death, to complete a requested financial transaction, where law requires or permits it, or to law enforcement under a warrant. It must be destroyed within a year after the purpose for collecting it expires.

House Bill 149, effective January 1, 2026, changed the statute in three ways that matter to AI data. New subsection (b-1) says a public image of a person is not consent unless that person posted it. Subsection (e)(2) says the section does not apply to training, processing or storing biometric identifiers to develop or train AI models, unless a system is used to uniquely identify a specific person. Subsection (f) restores the full rules if identifiers captured for AI training are later used for another commercial purpose.

The Attorney General enforces CUBI, with civil penalties of up to $25,000 per violation. The office says it secured a $1.4 billion settlement with Meta over facial recognition data and a $1.375 billion settlement with Google over claims that included voiceprints and facial geometry.

What does the Texas Responsible AI Governance Act add?

The Texas Responsible Artificial Intelligence Governance Act, House Bill 149, took effect on January 1, 2026. MultiState describes it as an AI governance law rather than a comprehensive privacy law, and the statute history of section 503.001 shows that HB 149 is the source of the CUBI changes above.

For a seller, the CUBI amendments are the part that matters. The rest of the Act is aimed at how AI systems are developed and deployed, so it shapes buyers' obligations more than yours. Ask any Texas buyer how it applies the Act to the data it licenses.

Is Texas a one-party consent state for call recordings?

Texas is a one-party consent state for call recordings. It is not on the Reporters Committee for Freedom of the Press list of about 11 all-party consent states, which includes California, Florida and Illinois.

Texas call centers often handle callers from all-party states. Before licensing recordings, confirm where callers were and what they were told. Our call centers page covers the industry detail.

Which buyers accept Texas sellers?

Buyers that accept US sellers accept Texas companies. micro1 says demand is strongest in the US, Endless Data prioritizes the US, UK and Canada, and AWS Data Exchange lists the US as an eligible seller jurisdiction.

What are Texas's rules at a glance?

What should a Texas seller do before licensing?

A Texas seller should decide early whether each dataset will be de-identified or excluded, because consent for sensitive data is hard to get after collection. The steps below follow the TDPSA and CUBI.

1. 1

   Check your status

   Confirm whether you are a small business under the SBA definition and whether a GLBA or HIPAA exemption applies.

2. 2

   Separate staff and consumer data

   Staff data in an employment context sits outside the TDPSA, but consumer data does not.

3. 3

   Remove sensitive data

   Take out health, biometric and precise location data unless you hold consent for the sale.

4. 4

   Meet the deidentified data duties

   Apply reasonable measures, publish a commitment not to reidentify and bind the buyer by contract.

5. 5

   Review voice and face data

   Get advice on CUBI and its 2026 AI training exemption before licensing recordings or images.

For a view of which buyers fit your records and the rights issues to clear first, request a free data valuation.