Does Texas's Data Privacy Law Have a Revenue Threshold for Compliance?

No. The Texas Data Privacy and Security Act (TDPSA), in effect since July 1, 2024, sets no annual revenue or data-volume threshold for which businesses must comply — a design choice that sets it apart from most other state comprehensive privacy laws, which typically exempt companies below a set revenue or consumer-count line.

How TDPSA Decides Who's Covered

Instead of a dollar figure, TDPSA applies to any entity that conducts business in Texas or produces products or services consumed by Texas residents, processes or sells personal data, and does not qualify as a small business under the U.S. Small Business Administration's size standards. Because SBA size standards vary by industry — measured in either annual revenue or employee count depending on the sector — there's no single number a marketer can check against; the threshold depends on what kind of business it is.

The Small Business Exemption Isn't a Full Exemption

Qualifying as an SBA-defined small business doesn't take a company out of TDPSA's reach entirely. Small businesses are still required to get a consumer's affirmative consent before selling that consumer's sensitive personal data — things like precise geolocation, health information, biometric data, or data revealing racial or ethnic origin, sexual orientation, or immigration status. The exemption applies to the law's broader obligations, not to that one specific sensitive-data-sale rule.

Why This Trips Up Small and Mid-Size Advertisers

Because most other state privacy laws (Virginia, Colorado, Connecticut, and others) carve out companies below a consumer-count threshold such as 25,000 or 100,000 residents, marketers who've built compliance checklists around those numbers can wrongly assume the same logic applies in Texas. It doesn't. A small marketing agency or local business that would be exempt in a threshold-based state could still fall inside TDPSA's main obligations if it doesn't meet the SBA's small business definition for its specific industry.

What to Check Instead of a Revenue Number

Rather than comparing annual revenue to a privacy-law cutoff, Texas-facing businesses need to look up the SBA size standard that applies to their specific NAICS industry code, since that's the actual test. A company can have modest revenue by general standards and still fail to qualify as "small" under the SBA's threshold for its particular industry, especially in sectors where the SBA uses employee counts rather than revenue.

Enforcement Doesn't Change Based on Size, Either

TDPSA enforcement sits exclusively with the Texas Attorney General — there's no private right of action, so consumers and competitors can't sue directly. Before filing an enforcement action, the Attorney General must give written notice and a 30-day window to cure the violation; unlike some other states, Texas hasn't put a sunset date on that cure period, so it remains available regardless of company size. A business that doesn't cure in time, or that breaks a written statement given to the Attorney General, is liable for a civil penalty of up to $7,500 per violation.

Bottom Line

Don't budget TDPSA compliance around a revenue number — it doesn't exist. Instead, check your business against the SBA size standard for your specific industry code, and remember that even a confirmed small business still needs consumer consent before selling sensitive personal data in Texas.

Sources: the Texas Attorney General's official TDPSA guidance page (texasattorneygeneral.gov) on enforcement, penalties, and the cure period, and UpGuard's TDPSA compliance guide summarizing the law's applicability test and SBA-based small business exemption.