Does the Texas Data Privacy and Security Act require honoring browser opt-out signals?

Texas answers the browser-signal question in a roundabout way. The Texas Data Privacy and Security Act never uses the phrase "universal opt-out mechanism." Instead it routes browser signals through the authorized-agent rules, and the practical result is the same: if a Texas consumer's browser tells you to stop, you have to listen.

What Section 541.055(e) actually says

A consumer may designate another person to serve as their authorized agent and act on their behalf to opt out of processing under Sections 541.051(b)(5)(A) and (B). The statute then spells out how that designation can happen: through a technology, including a link to an internet website, an internet browser setting or extension, or a global setting on an electronic device, that allows the consumer to indicate the intent to opt out.

A controller must comply with an opt-out request received from an authorized agent under that subsection if it can verify, with commercially reasonable effort, the identity of the consumer and the agent's authority to act. That is an obligation, not an invitation.

Which rights the signal reaches

Section 541.051(b) gives Texas consumers five rights, and the fifth is the right to opt out of processing for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of a decision that produces a legal or similarly significant effect. The authorized-agent mechanism in Section 541.055(e) is limited to subparagraphs (A) and (B), so it covers targeted advertising and sale. Profiling opt-outs under subparagraph (C) still arrive through your ordinary request channels.

If you run advertising pixels or sell data, the signal is in scope for you. If you do neither, this obligation does not bite, though the rest of Section 541.055 still does.

The four grounds for declining

The statute names them. You are not required to comply where the agent fails to communicate the request in a clear and unambiguous manner, where you cannot verify with commercially reasonable effort that the consumer is a Texas resident, where you do not possess the ability to process the request, or where you do not process similar or identical requests received for the purpose of complying with similar or identical laws of another state.

Read that last one carefully. It is a consistency rule. A business that already honors Global Privacy Control for California cannot claim the exemption in Texas.

Conditions on the signalling technology

Section 541.055(f) sets three limits on the technology itself. It may not unfairly disadvantage another controller. It may not make use of a default setting, and must instead require the consumer to make an affirmative, freely given, and unambiguous choice indicating the intent to opt out. And it must be consumer-friendly and easy to use by the average consumer.

That second condition is the one to note operationally: a signal that ships switched on by default does not, on the face of the statute, represent the choice Texas requires.

Where this sits in the rest of the chapter

Section 541.055 came in with the original act, added by Acts 2023, 88th Legislature, Regular Session, Chapter 995 (House Bill 4), effective July 1, 2024. It sits alongside Section 541.055(a), which requires two or more secure and reliable request methods, and Section 541.102(a)(6), which requires your privacy notice to describe those methods. The Texas TDPSA overview covers who the chapter applies to, and the Texas and California comparison sets the two regimes side by side.

Next step

If you are not sure whether the TDPSA reaches your business or whether your ad stack is sending data in a way that triggers the opt-out, the free 2-minute Obligation Scan checks which state privacy laws apply to you and lists the signals and disclosures you owe. The US state privacy laws hub shows how Texas compares with the other enacted state laws.