The Texas Data Privacy and Security Act usually doesn’t apply to a car dealership that arranges financing or leases vehicles, because it exempts Gramm-Leach-Bliley financial institutions as whole businesses. The FTC Safeguards Rule and Texas breach law still apply.
Last updated: October 19, 2026
Saturday afternoon at a store off I-45. A couple is in the F&I office signing a retail installment contract. Out on the service drive, a guy paying cash for brakes just typed his cell number into a tablet at the write-up counter. Somebody else is filling out a trade-in form on the website from her couch in Katy.
Three Texans. Three sets of personal data. One dealership. Normal Saturday.
Now the question Texas dealers keep asking: does the state privacy law cover all three of them? The short answer is no, at least not at the dealership itself. The longer answer is where the work is, and it’s not the work most people expect.
I started on a sales floor in the late ’90s, sold CRM to dealers for five years after that, and I’ve spent the past 20 years at Helion Technologies helping dealers make smarter technology decisions. When something isn’t going the way I want, I ask myself one question. What am I not doing? With Texas privacy, the honest answer is rarely “we missed the privacy law.” It’s usually “we never checked which of our companies the exemption actually covers.”
This is the Texas chapter of our guide to dealership privacy laws by state, which sorts every state’s law by how its exemption is written. Texas is one of the friendly ones. Friendly isn’t the same as finished.
What the Texas Data Privacy and Security Act Covers
The Texas Data Privacy and Security Act is the state’s consumer privacy law, Chapter 541 of the Business and Commerce Code, in force since July 1, 2024. It gives Texas residents the right to see, correct, delete, and take a copy of their personal data, and to opt out of its sale, targeted advertising, and profiling.
It reaches a business that does three things: operates in Texas or sells something Texans use, processes or sells personal data, and isn’t a small business under the U.S. Small Business Administration’s size standards. That’s the whole test. There’s no revenue floor and no customer count, which is unusual. California, Virginia, and Colorado all start with a size threshold. Texas starts with the SBA’s definition of a small business and stops there, which means a company with a few hundred Texas customers and a company with a few million can land on the same side of the line, depending only on how the SBA sizes their industry. Odd, but true.
The attorney general enforces it. Nobody else can sue under it. Before filing, the AG has to send written notice and give the business 30 days to fix the problem, and that cure window doesn’t expire the way it did in some other states. A violation that isn’t cured can cost up to $7,500 each, according to Section 541.155.
On paper, that looks like it covers every dealership in the state.
It doesn’t.
The One Sentence That Takes Most Dealerships Out
Section 541.002(b) lists who the chapter doesn’t apply to. Item two is “a financial institution or data subject to Title V” of the Gramm-Leach-Bliley Act. You can read it in the official Texas statute. Item one is state agencies. Item four is nonprofits. Dealers end up in item two whether they think of themselves as a financial institution or not.
The FTC settled that a long time ago. Its dealer FAQ on the Safeguards Rule says dealers that finance or help arrange financing are financial institutions, and so are dealers that lease vehicles for longer than 90 days. That’s nearly every franchised store in Texas, light-duty and heavy truck alike, because a store that never writes a retail installment contract or sends a credit application to a lender is rare enough that I can’t remember the last time I walked into one.
Texas wrote its exemption at the entity level, the same way Virginia, Colorado, and Maryland did. The whole business is out, not just the loan file. So the guy paying cash for brakes and the trade-in lead from Katy are outside the Texas privacy law too, because the company holding their data is exempt.
That’s the usual reading, and it’s the one we use with Texas dealers. Have your attorney put it in writing once. It’s a cheap letter. Worth it.
The store is out. That’s the easy part.
Where the Exemption Gets Thin
The law says “person,” and a person here is a legal entity. Not a rooftop, not a dealer group, not a family name on the sign. Each LLC stands on its own. Every one.
A lot of Texas groups are a stack of companies. One per franchise, plus a collision center, a rental counter, a management company that pays everybody, and sometimes a separate outfit that runs the BDC and the marketing lists. Some of those companies arrange financing. Some never touch a credit application in their lives, and nobody thinks twice about it, because the accountant set the structure up years ago for tax and liability reasons that had nothing to do with privacy law.
| Company in the group | Arranges financing or long-term leases? | Where it likely lands |
|---|---|---|
| Franchised store with an F&I office | Yes | Exempt as a financial institution. Safeguards Rule applies in full |
| Heavy truck store that sells, leases, and services | Usually | Same as above, if it arranges consumer financing or leases |
| Collision center or body shop set up as its own LLC | Rarely | Not exempt as a financial institution. The SBA small-business test decides it |
| Rental or loaner company | Only if it leases past 90 days | Check it on its own |
| Management, BDC, or marketing company that owns the CRM or email lists | No | The one to ask your attorney about first |
Look at the bottom row. That one matters.
I spent five years selling CRM to dealers, and the contract wasn’t always signed by the company whose customers were in it. Sometimes it was the store. Sometimes it was the management company, because that’s who paid the bills. If the company that holds your customer database doesn’t arrange financing, it’s probably not exempt as a financial institution, and the next question is whether it’s small enough under the SBA standards to fall out on that basis instead.
A small business still has one rule to follow. Section 541.107 says it can’t sell sensitive data without the consumer’s prior consent. Sensitive data in Texas includes precise geolocation. Keep that in mind for the next section.
Draw the org chart. Then draw where the data actually lives. They’re rarely the same picture.
The Data That Leaves Your Store
The exemption follows your company. It doesn’t follow your data out the door. Data travels.
Your website runs chat, a trade-in tool, a credit pre-qualification form, and probably a dozen tracking scripts from ad platforms and vendors. Your F&I and delivery teams may be enrolling buyers in an OEM’s connected-vehicle program. Every one of those sends a Texan’s information to a company that isn’t you. Some of those companies are covered by Chapter 541 on their own, whatever your status is, because the law looks at each company’s business and not at the dealership that sent the data their way, and the Texas attorney general has shown real interest in where vehicle and driving data goes.
Two cases make the point. In January 2025 the AG sued Allstate and its subsidiary Arity, alleging they collected and sold driving and location data from millions of phones through software built into other companies’ apps. It was the first lawsuit any state had brought under one of the new consumer privacy laws. Allstate denies it. Months earlier, in August 2024, the AG sued General Motors under the Deceptive Trade Practices Act over the sale of driving data to insurers, and the complaint alleges dealers were part of how buyers got enrolled, by leading them to believe enrollment was mandatory. GM’s response was that it was reviewing the complaint.
Neither case was brought against a dealership. Not one. Both describe things that happen on a dealership’s sales floor and website every day.
So the practical question isn’t “are we covered?” It’s “what do our scripts, vendors, and delivery checklists say to a Texan about their data, and is it true?” A privacy policy that doesn’t match what the site actually does is a deceptive-practices problem whether or not Chapter 541 applies.
Know what runs on your site. Know what your people say at delivery.
What Still Applies to Every Texas Store
Being exempt from one law doesn’t make the job smaller. It moves it. Here’s what a franchised Texas store answers to with the privacy law out of the picture.
- The FTC Safeguards Rule, 16 CFR Part 314, in full: a written security program, a qualified individual who owns it, multi-factor authentication, encryption, testing, vendor oversight, and an incident response plan.
- A federal breach notice to the FTC within 30 days when an incident touches 500 or more consumers. Our guide to the Safeguards Rule breach notice walks through that clock.
- Texas’s own breach law, Section 521.053. Customers hear from you within 60 days. If 250 or more Texans are involved, the attorney general hears within 30, through an online form, and the AG publishes a public list of the breach notices it receives. Your store’s name sits on that list for a year.
- Biometrics. Fingerprint time clocks, face scans at a key kiosk, voice ID on the phones. Texas’s biometric law has its own consent and retention rules, separate from Chapter 541, and the state settled a biometric case with Meta for $1.4 billion in 2024. Ask before you install. Then ask again.
- The Deceptive Trade Practices Act, which covers what you tell customers about their data, exempt or not.
One wrinkle I like, mostly because it shows the Legislature thought about dealers and banks at the same time and decided one federal security rule was enough for both of them. Texas’s general rule requiring “reasonable procedures” to protect sensitive personal information, Section 521.052, skips financial institutions entirely. The Legislature assumed the Safeguards Rule already covers you. It does, as long as your Safeguards program is a real program and not a binder from 2023.
Two clocks after an incident, plus the FTC’s. Put all three on one page.
What I’d Do This Quarter
None of this is a big project. Honestly. It’s an afternoon with the right people in the room, usually the dealer principal, the controller, whoever owns the website relationship, and your Safeguards qualified individual, and maybe a call to your attorney when you’re done.
- List every legal entity in the group and mark which ones arrange financing or lease past 90 days.
- Find out which company signed the CRM, website, chat, and email-marketing contracts. That’s where the customer data legally sits.
- For any company that isn’t a financial institution, check it against the SBA size standards and see whether it sells or shares anything that counts as sensitive data.
- Pull a list of every script and vendor on your website, then read your privacy policy against it. If they don’t match, fix the policy or fix the site.
- Look at what F&I and delivery say about OEM connected services. “You can turn this on if you want it” is a fine sentence. “You have to” usually isn’t true.
- Put the Texas customer clock, the Texas AG clock, and the FTC clock in your incident response plan, with a name next to each one.
Our dealership compliance services run the Safeguards side as a continuous program, and the vendor risk rating that comes with it is usually where the website and CRM questions get answered. If you’re in Houston or the Metroplex, our Houston dealership IT page and Dallas-Fort Worth dealership IT page cover the local side of all three rules.
Across the 2,000-plus dealerships we support, the stores with the most peace of mind about privacy aren’t the ones that read the most statutes. They’re the ones that know where their data is. That’s it.
What Texas Dealers Ask Us
Does the Texas Data Privacy and Security Act apply to car dealerships at all?
We’re a small store. Doesn’t the small business exemption cover us anyway?
Our collision center is its own LLC. Is it covered?
If we’re exempt, can we ignore privacy on the website?
Who enforces it, and do we get a warning first?
How fast does a Texas dealership have to report a breach?
If you want to know where your stores and your affiliated companies actually stand, our complimentary IT and cybersecurity assessment is where we start. We look at the entities, the systems, and the vendors holding your customers’ data, and tell you plainly what we’d fix first.
We manage the technology so you can sell and service cars and heavy trucks. Knowing where your data lives is part of that job.