Texas Capture or Use of Biometric Identifier Act (Bus. & Com. Code §503.001)
TX · Tex. Bus. & Com. Code §503.001 (2009)
Enacted in 2009, the Texas Capture or Use of Biometric Identifier Act (CUBI) was the second state biometric privacy law in the country (after Illinois BIPA). It requires consent before commercial biometric capture and caps damages at $25,000 per violation. AG Paxton used CUBI to secure a $1.4B Meta settlement (2024) and $1.375B Google settlement (2025) — making it the most-recovered state biometric statute.
Technical detail
Tex. Bus. & Com. Code § 503.001 (enacted 2009 by H.B. 2278, 81st Leg.) — prohibits commercial capture of biometric identifiers (retina/iris scan, fingerprint, voiceprint, hand or face geometry) without consent; restricts sale, lease, disclosure; requires destruction within reasonable time (no later than 1 year after purpose of collection expires). Enforcement is exclusively by the Texas Attorney General; civil penalty up to $25,000 per violation. No private right of action (distinguishing CUBI from BIPA). Major settlements: $1.4B with Meta (2024) and $1.375B with Google (2025).
Who is protected: Texas residents subject to biometric capture
Who must comply: Persons capturing biometric identifiers for commercial purpose
Key facts
| Jurisdiction | TX |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Stronger protection |
| Effective date | 2009-09-01 |
| Enacted | 2009-04-23 |
| Citation | Tex. Bus. & Com. Code §503.001 (2009) |
| Enforced by | Texas Attorney General |
| Private right of action | No — agency enforcement only |
| Penalties | Civil penalty up to $25,000 per violation |
| Topics | biometric data · facial recognition · consumer data privacy |
| Last verified | 2026-06-17 |
| Official source | Tex. Bus. & Com. Code §503.001 — Texas Statutes ↗ |
More AI rules in TX
- Texas v. Google · In effect
- Texas v. Allstate / Arity · In effect
- Texas v. Pieces Technologies · In effect
- TX SB 751 (2019, first state election deepfake law) · In effect
- Texas v. Google ($1.375B) · In effect
Related biometric data rules elsewhere
- Virginia § 15.2-1723.2 (facial recognition by local law enforcement, eff. July 1, 2026) · In effect
- Ban biometric recognition in public accommodations (Ban The Scan) · Proposed / pending
- Limit facial recognition in residential buildings (Ban The Scan) · Proposed / pending
- Attorney General Ellison releases consumer alert on DHS' digital surveillance an · In effect
- FTC Commercial Surveillance ANPR · Proposed / pending
- Montgomery County MD Police Directive FC 0627 · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.