# Selling company data to AI companies in Texas

URL: https://sellmydatatoai.net/guides/sell-company-data-to-ai-in-texas
Reviewed: 2026-11-08

Texas lets companies license data to AI buyers, but the Texas Data Privacy and Security Act treats a transfer of personal data for monetary or other valuable consideration as a sale, and sensitive data needs consent. The CUBI biometric law bars most sales of biometric identifiers, although since January 1, 2026 it exempts AI training unless a system identifies individuals.

## Key takeaways

- The TDPSA has applied since July 1, 2024 to businesses that are not small businesses under the SBA definition, and small businesses still need consent to sell sensitive data.
- A sale under the TDPSA covers sharing, disclosing or transferring personal data for monetary or other valuable consideration.
- The TDPSA does not cover people acting in an employment context, so staff data about Texans falls outside it.
- CUBI allows civil penalties of up to $25,000 per violation, and the Texas Attorney General has used it in settlements with Meta and Google.

This guide covers Texas law for companies licensing records to AI buyers. Federal law and other states' laws still apply, as our [US guide](https://sellmydatatoai.net/guides/sell-company-data-to-ai-from-united-states) explains, and the general rules on rights and ownership are in our guide to [whether you can legally sell company data](https://sellmydatatoai.net/guides/can-you-legally-sell-company-data-for-ai).

> **Not legal advice** This guide summarizes Texas statutes and Attorney General materials. It is not advice on your situation. Take independent legal advice before licensing data.

## Does the Texas Data Privacy and Security Act apply to your company?

The Texas Data Privacy and Security Act applies to your company if it does business in Texas or offers products or services used by Texans, processes or sells personal data, and is not a small business as defined by the US Small Business Administration. The Texas Attorney General says the Act took effect on July 1, 2024.

Unlike most state laws, the TDPSA has no volume or revenue threshold. Section 541.002 also exempts financial institutions and data subject to GLBA, and HIPAA covered entities and business associates.

Small businesses are not entirely outside it. Section 541.107 says a small business may not sell personal data that is sensitive data without the consumer's prior consent, and the Attorney General's page repeats that rule.

## Is licensing data to an AI buyer a sale under Texas law?

Licensing personal data to an AI buyer for money or other value is a sale under Texas law. Section 541.001 defines a sale of personal data as the sharing, disclosing or transferring of personal data for monetary or other valuable consideration by the controller to a third party.

The definition excludes disclosures to processors, to affiliates, to provide a product the consumer requested, of information the consumer made public through mass media, and transfers as part of a merger or acquisition. A standalone license to an AI company fits none of these.

Two definitions narrow the problem. A consumer is a Texas resident acting only in an individual or household context, and the term does not include someone acting in a commercial or employment context. Deidentified data is data that cannot reasonably be linked to an identified or identifiable individual or a linked device.

- Section 541.106 says a controller holding deidentified data must take reasonable measures to ensure it cannot be associated with an individual
- It must publicly commit to keep and use the data without trying to reidentify it
- It must contractually oblige any recipient to comply with the chapter

Sensitive data, such as health, biometric and precise geolocation data, cannot be processed without consent. If you sell it, the Attorney General says your privacy notice must state NOTICE: We may sell your sensitive personal data, or the equivalent for biometric data.

## Who enforces the TDPSA and what are the penalties?

The Texas Attorney General has exclusive authority to enforce the TDPSA, and there is no private right of action. Before suing, the Attorney General must give written notice and 30 days to cure.

Under section 541.155, a person who violates the chapter after the cure period, or breaches a written statement given to the Attorney General, faces a civil penalty of up to $7,500 per violation, plus injunctions and the Attorney General's fees.

## How does Texas regulate biometric data in AI training?

Texas regulates biometric data in AI training through the Capture or Use of Biometric Identifier Act, Business and Commerce Code section 503.001, often called CUBI. It covers retina or iris scans, fingerprints, voiceprints and records of hand or face geometry.

A person may not capture a biometric identifier for a commercial purpose without informing the individual and getting consent. A person holding one may not sell, lease or otherwise disclose it except with consent for identification after disappearance or death, to complete a requested financial transaction, where law requires or permits it, or to law enforcement under a warrant. It must be destroyed within a year after the purpose for collecting it expires.

House Bill 149, effective January 1, 2026, changed the statute in three ways that matter to AI data. New subsection (b-1) says a public image of a person is not consent unless that person posted it. Subsection (e)(2) says the section does not apply to training, processing or storing biometric identifiers to develop or train AI models, unless a system is used to uniquely identify a specific person. Subsection (f) restores the full rules if identifiers captured for AI training are later used for another commercial purpose.

> **An open question for sellers** The 2026 exemption is written around developing and training AI. Whether it covers a seller's disclosure of voice or face data to a developer, as well as the developer's own training, is not settled. Take advice before licensing any archive with biometric identifiers.

The Attorney General enforces CUBI, with civil penalties of up to $25,000 per violation. The office says it secured a $1.4 billion settlement with Meta over facial recognition data and a $1.375 billion settlement with Google over claims that included voiceprints and facial geometry.

## What does the Texas Responsible AI Governance Act add?

The Texas Responsible Artificial Intelligence Governance Act, House Bill 149, took effect on January 1, 2026. MultiState describes it as an AI governance law rather than a comprehensive privacy law, and the statute history of section 503.001 shows that HB 149 is the source of the CUBI changes above.

For a seller, the CUBI amendments are the part that matters. The rest of the Act is aimed at how AI systems are developed and deployed, so it shapes buyers' obligations more than yours. Ask any Texas buyer how it applies the Act to the data it licenses.

## Is Texas a one-party consent state for call recordings?

Texas is a one-party consent state for call recordings. It is not on the Reporters Committee for Freedom of the Press list of about 11 all-party consent states, which includes California, Florida and Illinois.

Texas call centers often handle callers from all-party states. Before licensing recordings, confirm where callers were and what they were told. Our [call centers](https://sellmydatatoai.net/sell-your-data/call-centers) page covers the industry detail.

## Which buyers accept Texas sellers?

Buyers that accept US sellers accept Texas companies. [micro1](https://sellmydatatoai.net/data-buyers/micro1) says demand is strongest in the US, [Endless Data](https://sellmydatatoai.net/data-buyers/endless-data) prioritizes the US, UK and Canada, and AWS Data Exchange lists the US as an eligible seller jurisdiction.

## What are Texas's rules at a glance?

| Area | Rule | Enforced by |
| --- | --- | --- |
| Scope | TDPSA applies to non-small businesses doing business in Texas, with no volume threshold | Texas Attorney General |
| Sale | Sharing, disclosing or transferring personal data for monetary or other valuable consideration | Texas Attorney General |
| Sensitive data | Consent required, plus a sale notice in the privacy notice | Texas Attorney General |
| Small businesses | Consent required before selling sensitive data | Texas Attorney General |
| Staff data | Outside the TDPSA's definition of consumer | Not applicable |
| De-identified data | Reasonable measures, public commitment and contract terms | Texas Attorney General |
| Biometric identifiers | CUBI consent and sale limits, AI training exemption from 2026 | Texas Attorney General, up to $25,000 per violation |
| Call recordings | One-party consent | Prosecutors |

## What should a Texas seller do before licensing?

A Texas seller should decide early whether each dataset will be de-identified or excluded, because consent for sensitive data is hard to get after collection. The steps below follow the TDPSA and CUBI.

1. **Check your status**: Confirm whether you are a small business under the SBA definition and whether a GLBA or HIPAA exemption applies.
2. **Separate staff and consumer data**: Staff data in an employment context sits outside the TDPSA, but consumer data does not.
3. **Remove sensitive data**: Take out health, biometric and precise location data unless you hold consent for the sale.
4. **Meet the deidentified data duties**: Apply reasonable measures, publish a commitment not to reidentify and bind the buyer by contract.
5. **Review voice and face data**: Get advice on CUBI and its 2026 AI training exemption before licensing recordings or images.

For a view of which buyers fit your records and the rights issues to clear first, request a free [data valuation](https://sellmydatatoai.net/data-valuation).

## Frequently asked questions

### Does the Texas privacy law apply to small businesses?

The Texas Data Privacy and Security Act mostly does not apply to small businesses as defined by the US Small Business Administration. Section 541.107 makes one exception: a small business may not sell sensitive personal data without the consumer's prior consent. Health, biometric and precise location data are examples of sensitive data.

### Is licensing employee data to an AI buyer covered by the TDPSA?

Licensing employee data is generally outside the TDPSA, because the Act defines a consumer as someone acting in an individual or household context and excludes people acting in an employment context. Other rules still apply, such as CUBI for biometric data, federal law, contracts and the laws of states where staff live. Take advice.

### Can I sell voice recordings for AI training in Texas?

Voice recordings can contain voiceprints, which CUBI treats as biometric identifiers. Since January 1, 2026, CUBI does not apply to training AI models unless a system identifies specific people, but it is not settled whether that covers a seller's disclosure. Callers' consent and other states' laws also matter. Take advice first.

### What penalties apply under Texas privacy laws?

Under the TDPSA, the Texas Attorney General can seek civil penalties of up to $7,500 per violation after a 30-day cure period. Under CUBI, penalties reach $25,000 per violation. The Attorney General says it obtained a $1.4 billion settlement with Meta and a $1.375 billion settlement with Google in biometric and data privacy cases.

## Sources

- [Texas Data Privacy and Security Act](https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-privacy-rights/texas-data-privacy-and-security-act), Texas Attorney General, accessed November 2026
- [Texas Business and Commerce Code chapter 541: consumer data protection](https://tcss.legis.texas.gov/resources/BC/htm/BC.541.htm), Texas Legislature, accessed November 2026
- [Texas Business and Commerce Code chapter 503: biometric identifiers](https://tcss.legis.texas.gov/resources/BC/htm/BC.503.htm), Texas Legislature, accessed November 2026
- [Attorney General Ken Paxton secures historic $1.375 billion settlement with Google related to Texans' data](https://texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-secures-historic-1375-billion-settlement-google-related-texans-data), Texas Attorney General, accessed November 2026
- [Introduction to the Reporter's Recording Guide](https://www.rcfp.org/introduction-to-reporters-recording-guide/), Reporters Committee for Freedom of the Press, accessed November 2026
- [All of the comprehensive privacy laws that take effect in 2026](https://multistate.us/insider/2026/2/4/all-of-the-comprehensive-privacy-laws-that-take-effect-in-2026), MultiState, accessed November 2026
- [Data partnerships](https://www.micro1.ai/data-partnerships), micro1, accessed November 2026
- [Endless Data homepage and FAQ](https://endless-data.com/), Endless Data, accessed November 2026
- [Seller eligibility requirements](https://docs.aws.amazon.com/marketplace/latest/userguide/seller-eligibility.html), Amazon Web Services, accessed November 2026

---

Book a free consultation: https://sellmydatatoai.net/book-a-consultation