Consent (Texas Data Privacy and Security Act)

Consent under the TDPSA is a high bar by design. Tex. Bus. & Com. Code § 541.001 defines it as a clear affirmative act signifying a consumer's freely given, specific, informed and unambiguous agreement to process personal data relating to the consumer. Four adjectives, each doing work. Freely given rules out coercion. Specific rules out blanket permissions. Informed rules out burying the disclosure. Unambiguous rules out consent inferred from silence or inaction, though the definition counts a written statement or any other unambiguous affirmative action.

What does not count

The definition excludes acceptance of a general or broad terms of use document, or a similar document that contains descriptions of personal data processing alongside unrelated information. It excludes hovering over, muting, pausing or closing a given piece of content. And it excludes agreement obtained through a dark pattern, meaning a user interface designed or manipulated with the effect of substantially subverting or impairing user autonomy, decision-making or choice, including any practice the Federal Trade Commission refers to as a dark pattern.

That third exclusion is where consent programs fail. A pre-checked box is not consent. A modal where the accept button is styled prominently and the decline path sits three clicks deep invites the argument. So does a cookie banner offering only "Accept" and "Manage preferences" with no visible way to refuse. The statutory test looks to the design's effect on the user's autonomy, decision-making or choice.

Where the statute demands it

Three provisions require consent, and a fourth sets a similar standard. Under § 541.101(b)(1) a controller may not process personal data for a purpose that is neither reasonably necessary to nor compatible with the purpose disclosed to the consumer unless the consumer consents. Under § 541.101(b)(4) a controller may not process sensitive data without consent, and where the consumer is a known child must comply with the federal Children's Online Privacy Protection Act instead. Under § 541.107 a business exempt from the rest of the chapter because it is an SBA small business still may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer. And under § 541.055(f)(2), a technology used to designate an authorized agent under § 541.055(e) may not rely on a default setting and must require the consumer's affirmative, freely given and unambiguous choice to opt out.

The small business point surprises people. The carve-out in § 541.002(a)(3) is not a complete pass, and § 541.107(b) makes a violator subject to the same penalty under § 541.155 that a covered controller faces.

Proving it later

Chapter 541 does not prescribe how consent must be documented. A record that a consumer clicked a button may say little about what the consumer saw, so the screen text, the choices offered and the date can matter if the consent is later questioned.

Chapter 541 contains no express right to withdraw consent. The nearest consumer-facing exits are the opt-out rights in § 541.051(b)(5), which reach targeted advertising, sale and certain profiling, and the deletion right in § 541.051(b)(3), both exercised through the request methods in § 541.055. Under § 541.154, the attorney general must give written notice at least 30 days before suing and may not sue if the person cures the identified violation within that period and provides the required written statement.