Texas
Capture or Use of Biometric Identifier Act (Bus. & Com. Code §503.001)
Texas passed CUBI a year after Illinois passed BIPA, and for over a decade it sat quietly. Then the Attorney General started using it. CUBI prohibits capturing a biometric identifier for a commercial purpose without informed consent, caps retention, and bans selling the data. Only the AG can enforce it, but when Texas enforces, it enforces: the $1.4 billion Meta settlement in 2024 is the largest privacy settlement by any single US state, and a similar suit against Google settled for $1.375 billion.
Key Provisions
- No capture of a biometric identifier for a commercial purpose without informing the person and getting consent
- Biometric identifiers must be destroyed within one year after the purpose for collection ends
- Sale or disclosure of biometric identifiers is prohibited except in narrow cases
- Reasonable care required in storing and transmitting biometric data
- Enforced exclusively by the Texas Attorney General, at up to $25,000 per violation
Penalties & Enforcement Record
Up to $25,000 per violation, enforced by the Attorney General. Meta paid $1.4 billion (2024) over face recognition on uploaded photos; Google paid $1.375 billion (2025) over Photos face grouping and related products.
What this means for your face
Texans cannot sue directly, but the AG has turned CUBI into the most expensive biometric statute in the country to violate. Our removal requests to face-search operators cite CUBI for Texas residents, backed by that enforcement record.
Get Protected