Texas Children’s Privacy Laws (2026)

SB 2420

In force · App store · effective 2026-01-01 · binds app stores, developers

Ages: Under 18 (parental consent required for minors; age categories: child, younger teen, older teen, adult)

Requires: App stores must verify the age of every account holder at account creation; minors' accounts must be linked to a parent/guardian account; parental consent is required before a minor may download or purchase an app or make in-app purchases; app stores must share age-bracket and parental-consent signals with developers, who must apply them.

Litigation: Students Engaged in Advancing Texas v. Paxton and CCIA v. Paxton (W.D. Tex. Nos. 1:25-cv-1662 and 1:25-cv-1660). Dec 23, 2025: the district court issued preliminary injunctions in both cases barring enforcement of the entire Act after applying First Amendment strict scrutiny (blocking the Jan 1, 2026 effective date). June 4, 2026: a Fifth Circuit panel stayed the preliminary injunctions pending appeal in a published order that superseded its earlier administrative stay, finding Texas made a strong showing that it is likely to succeed on the merits. June 10, 2026: the challengers applied to the Supreme Court to vacate the stay (25A1389, 25A1390); Texas responded on June 22. July 6, 2026: the Court denied both applications with no noted dissents, so the Fifth Circuit's stay remains in effect and the Act is enforceable. The Fifth Circuit heard merits argument on the underlying appeal on 2026-08-04 (No. 25-51073, consolidated with No. 26-50001); no decision has issued.

Entry last reviewed 2026-10-01

HB 18

In force · Social media · effective 2024-09-01 · binds operators, platforms

Ages: Under 18 (known minors)

Requires: Social-media-style digital service providers must have every user register an age before opening an account and treat users who register as under 18, or whom a parent reports as minors, as known minors. Unless a verified parent provides otherwise, for a known minor they must limit collection of personal identifying information to what is reasonably necessary and its use to the purpose collected, and may not allow purchases or other financial transactions, share, disclose or sell that information, collect precise geolocation data, or display targeted advertising; they must also verify a parent's identity and relationship, give verified parents tools to control the minor's settings, change those defaults and limit time on the service, honor parents' requests to review, download and delete the minor's data, and disclose in their terms or privacy policy how any algorithms they use for known minors rank and filter content. The Act has no parental-consent requirement for opening an account. (Monitoring and filtering, 509.053 with 509.056(1), the targeted-advertising ban, the unlawful-ads duty, 509.055, and the 18+ age verification that 509.057 requires of any provider whose material is more than one-third harmful or obscene are enjoined until the Fifth Circuit's mandate issues, which it has withheld pending Texas's rehearing petitions; if the panel ruling stands, the last three then bind and monitoring and filtering stays enjoined only for CCIA and NetChoice members. See litigation.)

Litigation: Computer & Communications Industry Association v. Paxton, No. 24-50721, consolidated with Students Engaged in Advancing Texas v. Paxton, No. 25-50096 (5th Cir.), from W.D. Tex. Nos. 1:24-cv-849 and 1:24-cv-945. Decided 2026-07-24 (Douglas, joined by Higginbotham; Ho concurring in the judgment in part and dissenting in part). The panel AFFIRMED the Aug 30, 2024 injunction won by CCIA and NetChoice, which bars enforcement of the monitoring-and-filtering requirement (Tex. Bus. & Com. Code 509.053, together with the algorithm provision 509.056(1)) against those associations and their members, holding that requirement preempted by 47 U.S.C. 230(c)(1); it expressly declined to reach the First Amendment and vagueness questions. It VACATED the separate Feb 7, 2025 injunction, which is not limited to the plaintiffs, holding the SEAT plaintiffs lack standing to challenge monitoring-and-filtering, targeted advertising (509.052(2)(D)) and unlawful ads (509.055), and that their age-verification challenge (509.057) is foreclosed by Free Speech Coalition v. Paxton, 606 U.S. 461 (2025); that case was remanded and the panel noted the standing defect may be curable. The panel judgment has not taken effect. The docket first set the mandate for 2026-08-14; Texas then petitioned for rehearing en banc of the Section 230 holding in No. 24-50721 and, conditionally, for panel rehearing in No. 25-50096, and the mandate date was canceled. On 2026-09-14 the court ordered that 'A judge of this Court withholds issuance of the mandate in this appeal' and requested a response to the en banc petition, which CCIA and NetChoice filed on 2026-09-24. No ruling on either petition appears on the docket. Net effect: until the mandate issues, the Feb 7, 2025 injunction keeps monitoring-and-filtering, targeted advertising, unlawful ads and age verification enjoined for all providers; if the panel judgment stands, the mandate ends that injunction, the targeted-advertising, unlawful-ads and age-verification duties become enforceable, and monitoring-and-filtering stays enjoined only as to CCIA and NetChoice members. Status stays in_force rather than enacted_enjoined because the Act's core was never enjoined: age registration, the data-minimization, no-sale, no-purchase and no-geolocation defaults, parent verification, parental tools and parents' access and deletion rights remain enforceable. Distinct from the App Store Accountability Act (SB 2420) appeals, Nos. 25-51073 and 26-50001.

Entry last reviewed 2026-10-01

HB 4 (88th Leg., R.S.)

In force · Privacy law (minors) · effective 2024-07-01 · binds operators

Ages: Children under 13 (a 'known child'); no separate heightened opt-in tier for teens 13-17

Requires: Personal data collected from a known child is classified as 'sensitive data' (Sec. 541.001(29)(C)), and a controller must process a known child's sensitive data in accordance with the federal Children's Online Privacy Protection Act (COPPA) rather than via ordinary consent (Sec. 541.101(b)(4)). Texas does not impose a minor-specific opt-in for selling/sharing or targeted advertising to teens (those remain general consumer opt-out rights), so the only heightened minor-specific duty is COPPA-compliant handling of under-13 data.

Entry last reviewed 2026-10-01