B2B website visitor identification in Texas

Generally, no. The TDPSA defines a 'consumer' as a Texas resident acting only in an individual or household context, and it expressly excludes anyone acting in a commercial or employment capacity — for example, an employee requesting a demo on a company's behalf or a procurement contact exchanging business details. That exclusion means routine B2B contact data, such as a work email submitted through a lead form or a company representative's name tied to a business inquiry, typically sits outside the statute's consumer rights provisions, even though the same company might separately be a covered controller for other data it holds. Whether a specific dataset qualifies still depends on how it was collected and used, and the line between commercial and individual context is not always obvious in mixed data sets. This is not legal advice; a Texas business should have counsel review its actual data flows against the statutory definition before relying on the exclusion.

No, and this is what makes the TDPSA unusual compared with Virginia, Colorado, Connecticut and most comparable state laws. Those statutes typically exempt smaller businesses through a revenue floor or a minimum count of consumer records processed annually. The TDPSA instead applies to any entity that conducts business in Texas, processes or sells personal data, and does not meet the U.S. Small Business Administration's definition of a small business — a standard that varies by industry and is based on factors like employee count or annual receipts, not a single dollar figure written into the privacy statute itself. That means a company that would be exempt under Virginia's or Colorado's revenue thresholds could still be a covered controller in Texas, so applicability has to be checked against SBA size standards for that company's specific industry rather than assumed from experience with other states' laws.

Enforcement of the TDPSA sits exclusively with the Texas Attorney General; there is no private right of action, meaning individual consumers cannot sue a company directly for an alleged violation, and there is no separate dedicated privacy agency the way California has the CPPA. Before the Attorney General can bring an enforcement action, the statute requires that the controller or processor be given written notice and a 30-day period to cure the alleged violation, giving a business a defined window to correct a practice before facing penalties. That cure period is written directly into the statute rather than left to prosecutorial discretion, which is a meaningfully different enforcement posture than states without a mandatory cure provision. None of this changes whether a given data practice is compliant in the first place, only how an alleged violation would be addressed procedurally.

The difference is structural, not incidental. Under CCPA/CPRA, the temporary exemptions that once excluded B2B and employee personal information expired on 1 January 2023, so business contact and employment-related data are now fully within scope of California's consumer rights and are enforced jointly by the California Privacy Protection Agency and the Attorney General. The TDPSA never carried an equivalent exemption to expire — its definition of 'consumer' excludes commercial and employment-context activity from the outset, so the exclusion is permanent and built into the statute's core definitions rather than a lapsed transitional carve-out. A company selling only into Texas therefore faces a narrower personal-data compliance question for its B2B contact records than an equivalent company selling into California, though both should still document their data flows carefully rather than rely on a general impression of either state's law.

lead.box resolves the organisation behind a website visit from network-level and firmographic signals — the visiting company's name, industry and size band — rather than identifying a named person, setting a persistent device identifier, or building a profile of an individual's browsing across unrelated sites. Because the TDPSA's 'consumer' definition centres on an identified or reasonably identifiable individual acting in an individual or household context, company-level identification is designed to sit outside that category by not resolving a person at all, which is a separate and arguably more fundamental distinction than the commercial-context exclusion discussed elsewhere on this page. Confirming that against your own privacy notice and your own specific implementation remains your responsibility as the controller; this is general information, not a legal opinion on your deployment.

From 1 January 2025, TDPSA amendments require controllers processing sensitive data categories or biometric identifiers to give consumers clear notice of that processing, generally disclosed before or at the point of collection, alongside the statute's broader universal opt-out mechanism recognition requirement for larger controllers and processors. Company-level visitor identification does not process biometric identifiers such as fingerprints or facial geometry, and it does not process the TDPSA's defined sensitive categories tied to an identified individual, so these specific notice obligations are not triggered by that activity on their own. They remain relevant background, though, for any Texas site that separately collects sensitive data through other tools, forms or account features, and a site's overall privacy notice should reflect the full set of data collected across all its tools, not just this one.

Starting 1 January 2025, larger Texas controllers and processors must recognise an opt-out preference signal a consumer sends through their browser or device — comparable to the Global Privacy Control signal recognised under California law — and treat it as a valid request to opt out of the sale of personal data or targeted advertising, where those activities apply. Because lead.box does not sell personal information or use visitor data for targeted advertising, and because company-level identification does not depend on advertising identifiers or cross-site tracking that a universal opt-out signal is designed to stop, this requirement generally does not change how the product operates. It is still worth documenting in your own privacy notice how your site as a whole responds to such signals, particularly if other tools on the same site do rely on advertising-related data sharing.

Texas buyers in energy services, industrial manufacturing and logistics tend to run vendor review through a practical lens rather than a compliance checklist: a data flow description, a signed data processing agreement, confirmation of where data is stored, and a straight answer on whether personal data or advertising identifiers are involved. Procurement teams accustomed to long sales cycles and multi-stakeholder sign-off, common in energy and industrial sectors, generally move faster when a vendor volunteers this documentation upfront rather than waiting to be asked. lead.box provides a written processing agreement, discloses that processing happens in ISO-certified EU data centres, and explains plainly that it identifies the visiting company rather than a named individual — the same documentation a European buyer would expect, adapted for the Texas review process, and not a substitute for the buyer's own legal review.