Sensitive Data (Texas Data Privacy and Security Act)
A defined class of personal data a Texas controller may not process without the consumer's consent, or, for a known child, without following the federal Children's Online Privacy Protection Act. The categories are data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, or citizenship or immigration status; genetic or biometric data processed to uniquely identify an individual; personal data collected from a known child; and precise geolocation data.
Sensitive data is the category a Texas controller generally cannot process on a business-need theory. Consent comes first, subject to the chapter's general exemptions. Tex. Bus. & Com. Code § 541.101(b)(4) prohibits processing the sensitive data of a consumer without obtaining the consumer's consent, and where the consumer is a known child, requires compliance with the federal Children's Online Privacy Protection Act instead.
The four categories
Section 541.001 defines sensitive data to include personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, or citizenship or immigration status. It also covers genetic or biometric data that is processed for the purpose of uniquely identifying an individual, personal data collected from a known child, and precise geolocation data.
Two of those catch businesses that never thought of themselves as handling anything sensitive. Precise geolocation data means location identified within a radius of 1,750 feet, which ordinary mobile location output satisfies without effort. Biometric data processed to uniquely identify an individual reaches fingerprint and voiceprint login features a product team added for convenience. Face-matching is less clear, because the definition of biometric data excludes data generated from a photograph or video recording.
Notice the drafting choices. The category is health diagnosis rather than health data at large, and sexuality rather than the longer sex life and sexual orientation formulation other states use. Neither narrowing is wide enough to rely on, because symptom descriptions and intake forms can reveal a diagnosis.
Selling it carries a script
If a controller engages in the sale of sensitive personal data, § 541.102(b) requires this exact notice: "NOTICE: We may sell your sensitive personal data." If it sells biometric personal data, § 541.102(c) requires: "NOTICE: We may sell your biometric personal data." Both must appear in the same location and in the same manner as the privacy notice required by § 541.102(a).
The statute prescribes the words. The attorney general's January 2025 petition against Allstate and Arity alleged that the Arity defendants did not provide the sensitive-data sale notice.
Small businesses do not escape this piece. Section 541.107 bars a person exempt under § 541.002(a)(3) from engaging in the sale of personal data that is sensitive data without prior consent from the consumer, with the penalty in § 541.155 attached to a violation.
Assessments and the practical fix
Section 541.105 requires a documented data protection assessment for the processing of sensitive data, alongside targeted advertising, sale of personal data, certain profiling, and any processing that presents a heightened risk of harm to consumers. The attorney general can demand the assessment through the investigative authority in § 541.153, so the assessment may end up in a regulator's hands.