---
title: What the New Texas Crackdown Means for Data Privacy Regulations
description: Read about the new Texas data security crackdown to learn what’s going on and why enforcement is the key to drive privacy-driven security spending.
image: https://shardsecure.com/hubfs/The%20Dallas%20skyline%20and%20the%20reflecting%20pool%20at%20City%20Hall%20at%20night%2c%20in%20Dallas%2c%20Texas.-1.jpeg
---

- [Home](https://shardsecure.com/)
- [Blog](https://shardsecure.com/blog)

# What the New Texas Crackdown Means for Data Privacy Regulations

![Picture of Bob Lam](https://shardsecure.com/hs-fs/hubfs/Staff%20headshots/Bob-Lam--2022--Resized%20(1).jpg?width=60&name=Bob-Lam--2022--Resized%20(1).jpg "Picture of Bob Lam")

[Bob Lam](https://www.shardsecure.com/team/bob-lam) CEO and Co-Founder, ShardSecure 

 June 16 2024 

![The Dallas skyline to illustrate our blog post about the new enforcement team for data privacy regulations in Texas.](https://shardsecure.com/hubfs/The%20Dallas%20skyline%20and%20the%20reflecting%20pool%20at%20City%20Hall%20at%20night%2c%20in%20Dallas%2c%20Texas.-1.jpeg "The Dallas skyline to illustrate our blog post about the new enforcement team for data privacy regulations in Texas.")

What the New Texas Crackdown Means for Data Privacy Regulations

In recent years, the data privacy landscape has become increasingly complex, with new regulations seeming to crop up every other month.

Laws like the [California Consumer Privacy Act](https://shardsecure.com/blog/ccpa-trends), the [Colorado Privacy Act](https://shardsecure.com/blog/colorado-privacy-act-guide), and the [Florida Digital Bill of Rights](https://shardsecure.com/blog/florida-digital-bill-of-rights) have created a patchwork of varied regulations that businesses must navigate. Vermont is the most recent to join their ranks, with state legislators passing [one of the nation’s toughest data privacy laws](https://www.politico.com/news/2024/05/18/vermont-data-privacy-law-tech-lobbyists-00158711) last month. (The bill has yet to be signed by the governor.)

Meanwhile, the EU’s GDPR may soon face scrutiny in a potential Schrems III case, following the approval of the [EU-US Data Privacy Framework](https://shardsecure.com/resources/white-papers/eu-us-data-privacy-framework). And other nations aren’t far behind, with laws like Brazil’s LGPD, China’s PIPL, and South Africa’s POPIA creating a complex web of cross-border data protection requirements that multinational corporations must adhere to.

Despite the abundance of legislation, though, enforcement has generally been weak. Other than some [high-profile GDPR and PIPL fines](https://shardsecure.com/blog/meta-fine-gdpr), we’ve seen a lack of resources or political will to hold companies accountable for data privacy violations.

Two weeks ago, however, the state of Texas launched a new team that might change the enforcement landscape. The team, housed within the Consumer Protection Division of the Texas Office of the Attorney General, is focused on the “aggressive enforcement of” both state and federal data privacy and security laws.

Today, we dive into the new Texas data security crackdown, explaining what’s going on and exploring why enforcement is the key to privacy-driven security spending.

## Overview: The new Texas data privacy team

Announced in early June, the new Texas unit will be part of larger consumer protection efforts in the state. The data privacy team, which could become the largest in the country, will focus primarily on state laws governing data privacy and security, identity theft, biometric information protection, and consumer protection. These include the [Texas Data Privacy and Security Act](https://shardsecure.com/blog/texas-data-privacy-security-act), the [Texas Identity Theft Enforcement and Protection Act](https://www.smartglobalgovernance.com/en/texas-identity-theft-enforcement-and-protection-act/), the [Texas Capture or Use of Biometric Identifier Act](https://www.hklaw.com/en/insights/publications/2022/11/texas-enforcement-of-biometric-law-focuses-on-artificial-intelligence) (CUBI), and the [Texas Deceptive Trade Practices Act](https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-rights) (DTPA).

The team will also focus on the two federal laws that cover privacy for children (the Children’s Online Privacy Protection Act, COPPA) and for healthcare data (the Health Insurance Portability and Accountability Act, HIPAA).

“Any entity abusing or exploiting Texans’ sensitive data will be met with the full force of the law,” said Texas Attorney General Ken Paxton in a [statement](https://www.oag.state.tx.us/news/releases/attorney-general-ken-paxton-launches-data-privacy-and-security-initiative-protect-texans-sensitive). “Companies that collect and sell data in an unauthorized manner, harm consumers financially, or use artificial intelligence irresponsibly present risks to our citizens that we take very seriously. …With companies able to collect, aggregate, and use sensitive data on an unprecedented scale, we are strengthening our enforcement of privacy laws to protect our citizens.”

## A brief history of Texas’s data privacy laws

The AG’s announcement comes just before the Texas Data Privacy and Security Act goes into effect on July 1, 2024. It also indicates a particular concern about the illegal exploita­tion of consumer data by big tech, AI companies, and data brokers.

The Texas Attorney General has invited controversy with his indictment for securities fraud, his false claims of national voter fraud, and other accusations of wrongdoing. But on the data privacy score, his office has been at the forefront of enforcement. In 2022, it [sued Meta](https://www.texasattorneygeneral.gov/news/releases/paxton-sues-facebook-using-unauthorized-biometric-data) for Facebook’s practice of capturing and using Texans’ biometric data without consent, including storing millions of biometric identifiers about Texans’ facial geometry and voiceprints taken from Facebook photos and videos. The same year, it [sued Google](https://www.texastribune.org/2022/10/20/ken-paxton-google-lawsuit-biometric-data/) for collecting and indefinitely storing similar biometric information about Texans’ facial geometry and voiceprints without their consent.

Here are the state laws that we expect to generate the most scrutiny from the new Texas data privacy team.

**The Texas Data Privacy and Security Act. **As we’ve detailed in our blog post, the [Texas Data Privacy and Security Act](https://shardsecure.com/blog/texas-data-privacy-security-act) is one of the most broadly applicable of the US state data privacy laws. Signed into law in June 2023, it applies to any entity that 1) conducts business in Texas or produces products or services consumed by Texas residents, 2) processes consumer personal data, and 3) is not considered a “small business” by the US Small Business Administration (SBA). The TDPSA gives consumers the right to access and control certain aspects of their personal data, and it affords special protections to sensitive data. It also requires businesses to offer universal opt-out mechanisms, and it broadens the definition of personal data, making it one of the most consumer-friendly of the US data protection laws.

**The Texas Identity Theft Enforcement and Protection Act. **Passed in 2005, this law requires businesses to protect against the unlawful use or disclosure of any sensitive personal information they collect or maintain in the course of business. The act focuses specifically on personally identifiable information (PII) like Social Security, credit card, and driver’s license numbers.

**The Texas Deceptive Trade Practices Act (DTPA). **Enacted in 1973, this law protects consumers against false and misleading business and insurance practices. It mainly governs consumer transactions involving both goods and services, although it excludes professional services like consulting. The DTPA provides for both public enforcement by the Texas AG and private remedies. 

**The Texas Capture or Use of Biometric Identifier Act. **Known as [CUBI](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.503.htm), this law regulates the capture, receipt, possession, sharing, and retention of biometric identifiers, which includes retina and iris scans, fingerprints, voiceprints, and records of “hand or face geometry.” Under CUBI, organizations are generally prohibited from capturing biometric identifiers for commercial purposes unless they obtain consent first. Companies are also limited in their disclosures and retention of biometric identifiers. Although there is no private right of action, the law can impose civil penalties up to $25,000 per violation.

## What the Texas data crackdown tells us about data privacy enforcement

Worldwide, the reality of enforcement has often fallen short of what legislators and privacy advocates might hope for. In 2023, for example, only about [550 GDPR fines](https://www.enforcementtracker.com/) were issued across the entire EU, with many being for relatively small amounts. Similarly, the Federal Trade Commission (FTC) in the US has been [criticized for its limited authority](https://www.newamerica.org/oti/reports/enforcing-new-privacy-law/the-ftc-is-currently-the-primary-privacy-enforcer-but-its-authority-is-limited/) to pursue enforcement. Even when fines are issued, they often represent a small fraction of a company’s revenue, making them more of a cost of doing business than a true deterrent.

The gap between legislation and enforcement has significant implications for corporate spending on privacy-driven security. If the perceived risk of enforcement is low, businesses are likely to do a basic cost-benefit analysis and choose to underinvest in privacy measures. This is particularly true for tech giants and data brokers, whose business models [rely heavily on large-scale data processing](https://www.theregreview.org/2022/03/12/saturday-seminar-data-privacy-through-lens-big-tech/). Without robust enforcement, these organizations have little incentive to alter their practices.

However, if enforcement becomes more consistent and penalties more severe — as they likely will in Texas under the new crackdown — businesses will start to reassess their privacy investments. With robust enforcement, the cost of non-compliance could quickly outstrip the cost of implementing strong data protection measures.

What’s more, consistent enforcement can motivate companies to avoid privacy violations in order to escape reputational risks. High-profile fines can lead to loss of consumer trust, decreased market share, and strained relationships with business partners. As consumers become more privacy-conscious, businesses that prioritize data protection may gain a competitive edge.

So far, the impact of our myriad data privacy laws has been blunted by inconsistent enforcement. But we seem to be on the verge of a landscape where enforcement will become a key driver of data privacy and security spending.

## ShardSecure: A robust solution for data privacy and protection 

As Texas’s enforcement efforts get underway, businesses will need to move beyond mere legal compliance to embrace data privacy and security as a fundamental part of their operations. The good news? Companies that act proactively may find themselves not only avoiding hefty fines but also earning the loyalty of their more security-conscious customers.

The [ShardSecure platform](https://shardsecure.com/resources/white-papers/advanced-file-level-protection-with-fewer-resources) offers robust data privacy, security, and resilience for data stored in on-prem, cloud, and multi-cloud architectures. Our technology safeguards critical data — including consumer personal data and sensitive data — against unauthorized third-party access.

The ShardSecure platform also reduces the risk of noncompliance with various state and international data privacy laws. For example, our technology [meets the European Data Protection Board’s requirements](https://shardsecure.com/resources/white-papers/gdpr-schrems-ii) as a supplemental technology to enable cross-border data transfers under the GDPR. 

Last year, ShardSecure was named a Gartner® Cool Vendor in the August 2023, Cool Vendors™ for Privacy report.

To learn more, visit our [resources page](https://shardsecure.com/resources) and explore our other [compliance blog posts](https://shardsecure.com/blog/tag/compliance).

### Sources

[Vermont’s data privacy law sparks state lawmaker alliance against tech lobbyists | Politico](https://www.politico.com/news/2024/05/18/vermont-data-privacy-law-tech-lobbyists-00158711)

[Texas Identity Theft Enforcement and Protection Act | Smart Global Governance](https://www.smartglobalgovernance.com/en/texas-identity-theft-enforcement-and-protection-act/)

[Texas Enforcement of Biometric Law Focuses on Artificial Intelligence | Holland & Knight](https://www.hklaw.com/en/insights/publications/2022/11/texas-enforcement-of-biometric-law-focuses-on-artificial-intelligence)

[Consumer Rights | Office of the Attorney General](https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint/consumer-rights)

[Attorney General Ken Paxton Launches Data Privacy and Security Initiative to Protect Texans’ Sensitive Data from Illegal Exploitation by Tech, AI, and Other Companies | Office of the Attorney General](https://www.oag.state.tx.us/news/releases/attorney-general-ken-paxton-launches-data-privacy-and-security-initiative-protect-texans-sensitive)

[Paxton Sues Facebook for Using Unauthorized Biometric Data | Office of the Attorney General](https://www.texasattorneygeneral.gov/news/releases/paxton-sues-facebook-using-unauthorized-biometric-data)

[Texas Attorney General Ken Paxton sues Google for compiling Texans' biometric data | Texas Tribune](https://www.texastribune.org/2022/10/20/ken-paxton-google-lawsuit-biometric-data/)

[BUSINESS AND COMMERCE CODE - CHAPTER 503 | Texas Constitution and Statutes](https://statutes.capitol.texas.gov/Docs/BC/htm/BC.503.htm)

[GDPR Enforcement Tracker | enforcementtracker.com](https://www.enforcementtracker.com/)

[The FTC is Currently the Primary Privacy Enforcer but its Authority is Limited | New America](https://www.newamerica.org/oti/reports/enforcing-new-privacy-law/the-ftc-is-currently-the-primary-privacy-enforcer-but-its-authority-is-limited/)

[Data Privacy Through the Lens of Big Tech | The Regulatory Review](https://www.theregreview.org/2022/03/12/saturday-seminar-data-privacy-through-lens-big-tech/)

 

### Gartner Disclaimer

GARTNER is a registered trademark and service mark of Gartner and Cool Vendors is a registered trademark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and are used herein with permission. All rights reserved. Gartner does not endorse any vendor, product or service depicted in its research publications and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner's Research & Advisory organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

[Compliance](https://shardsecure.com/blog/tag/compliance) [Data privacy](https://shardsecure.com/blog/tag/data-privacy)

## Read on

![](https://shardsecure.com/hubfs/Picture2.jpg)

June 15 2026

### [ShardSecure MCP Secure Gateway](https://shardsecure.com/blog/shardsecure-mcp-secure-gateway-identity-aware-data-redaction-and-least-privilege-context-enrichment-for-ai-inference)

[Read more](https://shardsecure.com/blog/shardsecure-mcp-secure-gateway-identity-aware-data-redaction-and-least-privilege-context-enrichment-for-ai-inference)

![](https://shardsecure.com/hubfs/Keyboard%20with%20high%20tech%20user%20map%20icons%20and%20symbols-1.jpeg)

February 18 2026  | [Cloud](https://shardsecure.com/blog/tag/cloud)

### [Unstructured Data Left Exposed: A Cloud Breach That Should Worry Every Enterprise](https://shardsecure.com/blog/unstructured-data-left-exposed-a-cloud-breach-that-should-worry-every-enterprise)

[Read more](https://shardsecure.com/blog/unstructured-data-left-exposed-a-cloud-breach-that-should-worry-every-enterprise)

![](https://shardsecure.com/hubfs/Keyboard%20with%20high%20tech%20user%20map%20icons%20and%20symbols-1.jpeg)

November 12 2025  | [Cloud](https://shardsecure.com/blog/tag/cloud)

### [Can You Really Trust Hyperscalers with Your Data at Rest?](https://shardsecure.com/blog/can-you-really-trust-hyperscalers-with-your-data-at-rest)

[Read more](https://shardsecure.com/blog/can-you-really-trust-hyperscalers-with-your-data-at-rest)

![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/Acronis%20and%20ShardSecure%20unveil%20a%20groundbreaking%20technology%20partnership%20set%20against%20a%20backdrop%20of%20a%20sleek%20modern%20office%20filled%20with%20digital%20screens%20displaying%20dynamic%20data%20flows%20The%20atmosphere%20buzzes%20with%20excitement%20and%20anticipation%20illuminated%20by%20sof-1.png)

October 16 2025  | [Cloud](https://shardsecure.com/blog/tag/cloud)

### [Acronis + ShardSecure: Stronger data protection for modern threats](https://shardsecure.com/blog/acronis-shardsecure-stronger-data-protection-for-modern-threats)

[Read more](https://shardsecure.com/blog/acronis-shardsecure-stronger-data-protection-for-modern-threats)

![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/The%20image%20portrays%20a%20hightech%20digital%20landscape%20filled%20with%20abstract%20representations%20of%20data%20security%20concepts%20At%20the%20forefront%20a%20glowing%20vault%20symbolizing%20advanced%20filelevel%20encryption%20stands%20tall%20surrounded%20by%20intricate%20patterns%20of%20fragmented%20data.png)

October 1 2025  | [Data Sensitivity](https://shardsecure.com/blog/tag/data-sensitivity)

### [Revolutionizing Data Security: How Agentless File Level Encryption Makes Stolen Data Useless](https://shardsecure.com/blog/sensitive_data)

[Read more](https://shardsecure.com/blog/sensitive_data)

![unstructured data](https://shardsecure.com/hubfs/Digital%20image%20of%20globe%20with%20conceptual%20icons.%20Globalization%20concept.jpeg)

September 15 2025  | [Cybersecurity News](https://shardsecure.com/blog/tag/cybersecurity-news)

### [Elevating unstructured data security: ShardSecure® and Entrust® Join Forces!](https://shardsecure.com/blog/entrust_partnership)

[Read more](https://shardsecure.com/blog/entrust_partnership)

![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/scales%20%20ransomware%20attack%20to%20pay%20the%20money%20or%20risk%20the%20attack.jpeg)

July 29 2025  | [Ransomware](https://shardsecure.com/blog/tag/ransomware)

### [CISOs on Strategic Considerations in Ransomware Response](https://shardsecure.com/blog/ransomware-fine)

[Read more](https://shardsecure.com/blog/ransomware-fine)

![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/Image%20for%20AI%20data%20types-1.jpeg)

July 29 2025  | [Data security](https://shardsecure.com/blog/tag/data-security)

### [The Growth of AI is driving the Imperative of Securing Unstructured Data](https://shardsecure.com/blog/ai-unstructured-data)

[Read more](https://shardsecure.com/blog/ai-unstructured-data)

![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20hightech%20digital%20landscape%20showcasing%20a%20sleek%20modern%20office%20environment%20illuminated%20by%20soft%20blue%20and%20white%20lighting%20In%20the%20foreground%20a%20large%20computer%20screen%20displays%20intricate%20graphs%20and%20charts%20related%20to%20data%20security%20while%20a%20gr.jpeg)

July 22 2025  | [Data security](https://shardsecure.com/blog/tag/data-security)

### [How to make your SharePoint data of zero value in a zero day attack!](https://shardsecure.com/blog/sharepoint_breach)

[Read more](https://shardsecure.com/blog/sharepoint_breach)

[![ShardSecure®](https://shardsecure.com/hubfs/ShardSecure%20brand%20assets/Logo%20(2022)/ShardSecure-Logo__Horizontal--White.svg "ShardSecure®")](https://shardsecure.com/)

101 Avenue of the Americas, 9th Floor, New York, NY 10013, United States of America

[![linkedin](https://shardsecure.com/hubfs/_2023/li.svg) ](https://www.linkedin.com/company/shardsecure) [![tweeter](https://shardsecure.com/hubfs/_2023/tweeter.svg) ](https://www.twitter.com/ShardSecure) [![facebook](https://shardsecure.com/hubfs/_2023/facebook.svg) ](https://www.facebook.com/ShardSecure/) [![facebook](https://shardsecure.com/hubfs/_2023/youtube.svg) ](https://www.youtube.com/@shardsecure877)

© 2026 ShardSecure®. All rights reserved.   
[Privacy Policy](https://shardsecure.com/privacy-policy)

![websights](https://ws.zoominfo.com/pixel/62e7bb6d62a6b2008e071c83) ![](https://px.ads.linkedin.com/collect/?pid=5456580&fmt=gif)

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Bob Lam",
    "url" : "https://shardsecure.com/blog/author/bob-lam"
  },
  "dateModified" : "2024-06-16T13:00:00.879Z",
  "datePublished" : "2024-06-16T13:00:00.000Z",
  "headline" : "What the New Texas Crackdown Means for Data Privacy Regulations",
  "image" : [ "https://shardsecure.com/hubfs/The%20Dallas%20skyline%20and%20the%20reflecting%20pool%20at%20City%20Hall%20at%20night%2c%20in%20Dallas%2c%20Texas.-1.jpeg" ],
  "mainEntityOfPage" : {
    "@id" : "https://shardsecure.com/blog/texas-crackdown-data-privacy",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://shardsecure.com/hubfs/ShardSecure-Logo__Horizontal--Purple-Inverted.svg"
    },
    "name" : "ShardSecure"
  }
}
```