CUBI
Texas Capture or Use of Biometric Identifier Act
Notice and consent before capturing biometric identifiers, limits on sale and disclosure, and destruction within a set period. Enforced by the Attorney General, which has obtained large settlements.
The law in brief
The Texas Capture or Use of Biometric Identifier Act (CUBI) requires notice and consent before a business captures a person's biometric identifiers for a commercial purpose, restricts selling or disclosing them, and sets a deadline for destroying them.
Unlike Illinois' BIPA, CUBI has no private right of action; only the Attorney General can enforce it. That has not made it a quiet law: the Attorney General has used it for some of the largest privacy settlements in US history, including a $1.4 billion settlement with Meta in 2024 over facial recognition.
Who it applies to
- Any person who captures a biometric identifier for a commercial purpose, including employers and technology providers.
- Biometric identifiers are a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry.
- Texas' comprehensive privacy law (TDPSA) separately treats biometric data as sensitive data requiring consent, so both laws can apply to the same processing.
What it requires
Notice and consent before capture
Do not capture a biometric identifier for a commercial purpose unless you inform the individual before capture and receive their consent.
No sale or disclosure
Do not sell, lease or otherwise disclose biometric identifiers except in the limited circumstances the statute lists, such as completing a financial transaction the individual requested or when required by law.
Reasonable care
Store, transmit and protect biometric identifiers with reasonable care, in a manner at least as protective as for other confidential information.
Destroy on schedule
Destroy a biometric identifier within a reasonable time, and no later than the first anniversary of the date the purpose for collecting it expires, subject to limited exceptions.
People's rights
Individuals must be informed and give consent before their biometric identifiers are captured for a commercial purpose.
Enforcement and penalties
Civil penalties of up to $25,000 for each violation, recoverable by the Attorney General. There is no private right of action.
What's changing
Amended in 2025. The Texas Responsible Artificial Intelligence Governance Act amended CUBI, including provisions on biometric data in publicly available media and its use in AI training. Check the current text before relying on older guidance.
What to do first
- Find every biometric capture: time clocks, door access, identity verification, voice systems, photo features and vendors' tools.
- Inform and get consent before capture, and keep a record of it.
- Stop any sale, lease or disclosure outside the statute's exceptions.
- Set destruction dates: within a reasonable time and no later than the first anniversary of the date the purpose expires.
- Protect biometric data with at least the care you use for other confidential information.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Sources
- Texas Business and Commerce Code 503.001, Capture or Use of Biometric Identifier Texas Legislature · Official text or regulator