Texas Residents Can Opt Out of Targeted Ads Thanks to New Privacy Bill

This week, Texas became the 10th state—and the fifth state this year—to pass a consumer privacy bill that gives the state’s residents more control over their data. With a population of over 30 million people, Texas will emerge as the second largest state after California to pass a bill of this kind. If enacted into law, the Texas Data Privacy and Security Act (SB 4) will go into effect in July next year. Other states, including Massachusetts and New York, are working on emulating a federal privacy bill that was stalled in Congress last year. But the existing patchwork of state-level laws poses massive compliance challenges and additional costs to marketers. Meanwhile, the number of requests from people to modify or delete their data held by companies is soaring, further limiting marketers’ ability to use data to target ads specific. However, for Texas, the bill isn't as specific about the businesses for whom this law would be applicable, causing some lack of clarity for organizations, despite being a win for people's data privacy rights. 4 More States Push for Tougher Privacy Laws, Spurring Self-Governing Standards Unless vetoed by Republican Governor Greg Abbott, the bill will let Texas residents opt out of targeted ads on websites and apps along with the sale of their personal data. Companies under the law are required to honor universal opt-out signals if people activate the tools in the browser or browser extension. Texas would become the fifth state to allow opt outs this year, alongside California, Colorado, Connecticut and Montana Largely modeled on Virginia’s privacy bill, SB 4 applies to companies that conduct business in Texas or produce a product or service that is consumed by Texas residents, that would process or engage in the sale of personal data. Previous bills from other states usually specify a business threshold for the law to be applicable, such as how many people’s personal data a business collects or their revenue. However, the Texas bill does not track these specifics making it tricky to ascertain who the law applies to. The lack of these specifics means “businesses will have a less straightforward way to determine whether they're covered under the scope of this act,” said Anokhy Desai, Westin Fellow at the International Association of Privacy Professionals. What Advertisers Need to Know About the Federal Privacy Law That lack of clarity is already playing out. Companies that meet the U.S. Small Business Association's definition of small business, which is "an independent business having fewer than 500 employees,” are exempt, according to the bill. But if a small business, such as an analytics startup with only 15 employees, collects, processes and sells or shares data, that startup would be exempt as a small business despite the nature of their business, according to Desai. "The question remains how many companies fit into this category," said David Stauss, an attorney with experience in data privacy at the law firm Husch Blackwell. "It's going to be hard to figure out the compliance." Under the law, companies are required to disclose what non-pseudonymous data they collect. Non-pseudonymous data is identifiable data, like a first middle last name, where IDs are replaced with pseudonyms. People can request the deletion of that data, under the terms of this new bill. Enforced by the Attorney General’s office, the bill contains no private right of action where people are allowed to sue over violations. Companies found violating the law will receive a notice by the AG prior to any enforcement actions and will have thirty days to remedy the violation.