The Texas Rulebook Your Austin Website Is Already Subject To
Texas privacy, biometric, telemarketing and accessibility law reaches the website itself. Here is what an Austin business site has to get right before design is discussed.
Most website quotes an Austin business receives talk about layouts, page counts and a CMS. Almost none mention that the finished site is a regulated object. In Texas that regulation is real, recent, and mostly enforced by the Attorney General alone. It decides what your forms, consent banner and analytics stack may do, so it belongs at the start of the project.
The Texas Data Privacy and Security Act reaches your tag manager
The Texas Data Privacy and Security Act, passed as HB 4 and in force since 1 July 2024, is the law most Austin sites are quietly out of step with. It applies to businesses processing Texas residents' personal data that are not small businesses under the Small Business Administration definition. A contact form, a Meta pixel and a Google Analytics 4 property amount to that. Three duties land on the build, not on a lawyer's document:
- A clear, reasonably accessible privacy notice listing the categories of data processed, the purposes, what is shared with third parties, and how to exercise rights. Boilerplate that does not match the trackers actually firing is worse than none, because the mismatch is the evidence.
- Opt-in consent before sensitive data is processed. That covers precise geolocation, biometric identifiers, health data and the data of anyone under 13. A store locator grabbing precise location on load is in scope.
- Recognition of universal opt-out signals, enforceable since 1 January 2025. The site has to read Global Privacy Control and suppress targeted advertising for that visitor. Few cookie plugins do this correctly unconfigured.
Texas also has a requirement with no parallel in most states. If you sell sensitive personal data, the statute prescribes the exact wording, posted in the same place and manner as your privacy notice: "NOTICE: We may sell your sensitive personal data." There is a matching sentence for biometric data. The law specifies a literal string your CMS must render.
The Attorney General enforces the act exclusively, with a thirty day cure period and civil penalties of up to 7,500 dollars per violation. There is no private right of action, so pressure arrives as one letter, not a stream of demands.
Biometrics: the feature nobody thinks of as a feature
Texas has had a biometric privacy statute since 2009, the Capture or Use of Biometric Identifier Act, in Chapter 503 of the Business and Commerce Code. It covers retina and iris scans, fingerprints, voiceprints and records of hand or face geometry. Capturing any of them commercially without informing the person and obtaining consent is a violation, and the Attorney General can seek up to 25,000 dollars each time.
This matters because face and voice processing now arrives inside ordinary product decisions. A virtual try-on widget. A gym site with face-scan check-in. A photo upload routed through a vendor doing face detection. None of it is sold to you as biometric collection. All of it can be.
SMS opt-in is now a Texas liability, not just a federal one
Senate Bill 140 took effect on 1 September 2025 and extended the Texas telephone solicitation rules in Chapter 304 to text messages. The change that matters is the remedy: violations are actionable by consumers under the Texas Deceptive Trade Practices and Consumer Protection Act, with trebling for willful conduct. That is a private right of action, and text campaigns produce messages by the thousand.
So the phone field on your lead form is a legal control. Consent must be captured at submission, logged with a timestamp and the exact disclosure shown, and kept separate from email consent. That record cannot be manufactured afterwards.
Accessibility here is a litigation question, not a checkbox
Title III of the Americans with Disabilities Act covers places of public accommodation, and courts have applied it to websites for years without the Department of Justice ever setting a technical standard for private businesses. The benchmark courts and settlements use is WCAG at Level AA. Federal web accessibility filings passed three thousand in 2025, and online retail is the most targeted.
Selling to government is different: the DOJ rule finalised in 2024 under Title II sets a real standard for state and local entities, which here means the City of Austin, Travis County, Capital Metro and the University of Texas at Austin. That procurement asks for a conformance report.
Accessibility is the one item here where doing it properly makes the site better for everyone. Keyboard focus order, real labels, contrast and semantic headings also help search engines and old devices.
Regulators that write rules about specific pages
Several Texas regulators specify what must appear on a website. Real estate, healthcare, legal services and hospitality all sit near the centre of Austin's economy.
- Real estate. Texas Real Estate Commission Rule 531.20(b) requires a homepage link to the Information About Brokerage Services form, labelled as TREC specifies, in at least ten point font in a readily noticeable place, plus a link to the Consumer Protection Notice.
- Healthcare. Texas Occupations Code Chapter 111 and Texas Medical Board rules shape what a telemedicine site may offer. Under the Texas Responsible Artificial Intelligence Governance Act, in force since 1 January 2026, providers must disclose AI used in diagnosis or treatment.
- Legal services. Part VII of the Texas Disciplinary Rules of Professional Conduct governs lawyer advertising, policed by the State Bar's Advertising Review Committee. Claims about outcomes and specialisation are what it examines.
- Alcohol and venues. Texas Alcoholic Beverage Commission rules govern how licensed premises advertise, reaching the music venues and breweries of East Sixth and Red River.
- Short-term rentals. Austin city code requires a valid licence number in listings, and platform obligations tightened through 2025 and 2026. A direct booking site counts as an advertisement.
The federal floor underneath all of it
Section 5 of the Federal Trade Commission Act is the broadest exposure a US website has, because it reaches any deceptive claim or unfair practice. Pricing that hides mandatory fees until checkout, a hard-to-cancel free trial, testimonials without disclosed connections, an auto-renewal buried in the terms: all of it lives in the design. CAN-SPAM separately requires a working unsubscribe and a postal address in commercial email.
Age verification is worth watching because Texas has been the test case. The Supreme Court upheld HB 1181 in Free Speech Coalition v. Paxton in June 2025, while HB 18, the SCOPE Act, has had significant provisions enjoined. If your product is aimed at teenagers, make the gate configurable rather than hardcoding today's rule.
What Austin visitors bring to the page
Compliance shapes the skeleton; the audience shapes the rest. Austin is a bilingual city with a large Spanish-speaking population, and for a home services, healthcare, restaurant or trades business a properly written Spanish version is not optional. Machine translated Spanish reads as machine translated Spanish, and here it costs trust. State hours in Central Time. Local discovery runs through Google Maps and the Business Profile more than the homepage, so consistent name, address and phone data and a page per location beat a hero animation.
The Austin calendar produces real load too. South by Southwest in March and Austin City Limits in October fill the city with people searching for food, transport and rooms on phones, on strained networks, on foot. Test against that, not a desktop on office fibre. One tax note as well: Texas taxes data processing and information services, with a partial exemption on the charge. If you sell software through your own site, that shapes checkout and invoicing, so settle it before the payment integration is written.
A sensible order to do this in
- 01Inventory what the site collects and what actually fires. Most teams find trackers nobody remembers installing.
- 02Decide, before design, which regulated features you want: SMS, biometrics, precise location, age gating, accounts.
- 03Write the privacy notice from that inventory and wire consent to real enforcement in code.
- 04Build to WCAG Level AA from the first component.
- 05Keep records of consent, the disclosure shown, and when each version went live.
FuturByte is a Dubai studio working with Austin clients remotely. We build to the requirements above and expect your Texas counsel to sign off on wording. That split works: we can say which product decisions create legal surface and how to build them defensibly, and a local attorney can say whether the words are right. For a straight read on what your site exposes you to, tell us about it.
