The Texas Data Privacy and Security Act took effect on July 1, 2024. It gives Texas consumers rights to access, correct, delete and obtain their personal data and to opt out of targeted advertising, data sales and certain profiling. It treats data revealing mental or physical health conditions as sensitive data, generally requiring consent to process it, and it is enforced by the Texas Attorney General. HIPAA-covered entities and HIPAA-governed information are exempt, but practices should not assume every marketing data flow is covered. This is marketing guidance, not legal advice.
Our team is based in Austin, so the Texas Data Privacy and Security Act is close to home. But its significance goes beyond Texas. It was one of a growing number of state privacy laws taking effect around 2024, and together those laws changed how practices nationwide should think about website data, advertising and consent.
For practices, privacy is not only about medical records. Websites collect information through forms, chat tools, analytics and advertising pixels. When that information reveals something about a person’s health, such as a search for a specific treatment, state privacy laws may treat it as sensitive.
This retrospective covers what the Texas law does, why it matters for practices and how to approach website data responsibly. This is marketing guidance, not legal advice. For the wider context, see our notes on predictable growth systems.
What actually happened in 2024
The effective date. The Texas Data Privacy and Security Act took effect on July 1, 2024. It is codified in Chapter 541 of the Texas Business and Commerce Code.
Consumer rights. The law gives Texas consumers rights to confirm whether their data is processed, to access, correct and delete it, to obtain a copy and to opt out of targeted advertising, the sale of personal data and certain profiling.
Sensitive data. The law defines sensitive data to include data revealing mental or physical health conditions or diagnoses, along with other categories such as genetic or biometric data and precise geolocation. Processing sensitive data generally requires consent.
Consent standard. According to the Attorney General’s summary, consent must be freely given, informed and unambiguous, and does not include agreement obtained through dark patterns or broad, general terms.
Exemptions. The law exempts certain entities, including those governed by HIPAA, and certain information, including information governed by HIPAA.
Enforcement. The Texas Attorney General enforces the law and accepts consumer complaints.
Why it mattered for practices
Many practices assumed privacy laws did not apply to them because of HIPAA. That assumption deserved a closer look. The Texas law exempts HIPAA-governed entities and information, but not every practice is a HIPAA-covered entity, and not every piece of marketing data is HIPAA-governed. Cash-pay practices, wellness businesses and med spas may have different obligations depending on how they operate.
Even for practices clearly covered by HIPAA, the Texas law was part of a broader trend. State privacy laws, federal guidance on tracking technologies and consumer expectations all pointed in the same direction: be careful with data that reveals health interests, get consent where required and be transparent.
The law also affected the vendors practices rely on. Advertising platforms, analytics tools and marketing agencies had to consider their own obligations, which in turn shaped what tools and settings they offered.
What typical agencies did
Many agencies treated state privacy laws as someone else’s problem. They installed the same tracking pixels on every practice website, ran retargeting campaigns based on visits to treatment pages and collected form data in tools without reviewing where that data went.
Others added a generic cookie banner and assumed that solved the issue. A banner that does not actually control tracking, or that relies on confusing design to push acceptance, does little to meet consent standards.
Few agencies mapped what data practice websites collected, where it went and whether it might be considered sensitive.
What it means for a practice today
Privacy can be a strength in marketing. Here is how we approach it.
1. Map your data flows
List every tool on the website and what data it collects, including forms, chat, analytics and ad pixels, and where that data goes.
2. Identify sensitive data
Consider whether page visits, form fields or ad audiences could reveal health conditions or treatment interests.
3. Get real consent where required
Use clear consent options that actually control tracking, without dark patterns.
4. Update the privacy notice
Describe what you collect, why, who receives it and how consumers can exercise their rights.
5. Prepare for requests
Set up a simple process to receive, verify and respond to privacy requests within required timeframes.
6. Review with counsel
Confirm with privacy counsel how HIPAA, Texas law and other state laws apply to your practice.
Website tracking and health interests
The most common privacy risk on practice websites is tracking. Analytics and advertising tools can record which pages a visitor viewed, what they searched for and what forms they filled out. On a practice website, that can reveal health interests: a visit to a page about weight loss, hormone therapy or mental health care says something about the visitor.
Under the Texas law, data revealing physical or mental health conditions is sensitive. That makes it important to review which tools receive that kind of information and on what basis. Our retrospective on cookies and HIPAA tracking covers related issues, and our post on the 2024 tracking ruling explains the federal side.
Practical steps include limiting advertising pixels on sensitive pages, using privacy-focused analytics configurations, avoiding sending form contents to advertising platforms and reviewing vendor agreements.
Retargeting and audiences
Retargeting, showing ads to people who visited a website, is a common marketing tactic. On practice websites, it can raise privacy concerns if audiences are built around treatment interests. An audience made up of people who viewed a specific condition page may effectively reveal health information.
Practices should review how audiences are built and whether consent is needed. In many cases, broader audiences, contextual targeting or first-party email marketing with clear consent can achieve similar goals with less risk. Advertising platforms also have their own health policies that limit some targeting.
Forms and intake
Website forms often collect sensitive information: symptoms, treatment interests, medication history or insurance details. Practices should collect only what is needed at each step, use secure tools and make sure form data does not flow to marketing systems that do not need it.
Where forms feed into email marketing or follow-up sequences, consent should be clear. A patient requesting an appointment has not necessarily agreed to receive marketing emails about other services.
Privacy as a trust signal
Patients care about privacy, especially for sensitive treatments. A clear privacy notice, a consent banner that respects choices and a website that does not follow visitors around with treatment ads all signal that the practice takes privacy seriously.
That trust can support marketing. Patients are more willing to fill out forms, call and book when they feel their information is handled carefully. For premium practices, privacy is part of the experience.
Other states
Texas was not alone. Several other states had comprehensive privacy laws in effect or taking effect around 2024, and some, such as Washington, passed laws focused specifically on consumer health data. Our retrospective on Washington’s health data law covers that example. Practices that serve patients in multiple states, including through telehealth, should consider the laws that apply where their patients live.
The safest approach is to build privacy practices that meet the stricter standards, rather than tailoring settings state by state.
Vendors and contracts
Practices depend on vendors for websites, booking, chat, email, analytics and advertising. Each vendor that receives personal data plays a role in compliance. Practices should know which vendors receive what data, review contracts for privacy terms and confirm that vendors support consent and data request processes.
Marketing agencies are part of that picture. An agency that installs tools on a practice website should be able to explain what each tool collects and why.
Handling consumer requests
The law gives consumers the right to make requests about their data, and businesses subject to the law must respond within set timeframes. Even practices that believe they are exempt may receive requests from patients who have read about privacy rights. A clear process helps: a contact method listed in the privacy notice, a way to verify identity, a person responsible for responses and a record of each request.
Handling requests well builds trust. A patient who asks what data the practice holds and receives a prompt, clear answer is more likely to remain a patient than one who receives no response.
A privacy review checklist
Practices can start with a short review. Which tools run on the website, and what does each collect? Do advertising pixels load on pages about specific conditions or treatments? Does the consent banner actually stop non-essential tracking until a visitor agrees? Does the privacy notice describe current tools and data uses accurately? Is there a working way for consumers to submit privacy requests, and does someone own the responses? Do form submissions stay within secure systems, or do they flow into marketing tools?
Answering those questions often reveals tools that nobody remembers installing, such as an old chat widget, a retired advertising pixel or an analytics script from a previous agency. Removing what is not needed reduces risk and often speeds up the website too.
The review should be repeated whenever the website changes, a new vendor is added or a new campaign launches. A yearly review with privacy counsel helps keep the practice current as laws and guidance evolve.
Marketing that works with less tracking
Some practices worry that limiting tracking will hurt marketing results. In practice, many effective tactics depend little on invasive tracking. Strong local search visibility, a well-maintained Business Profile, genuine reviews, helpful content, email marketing with clear consent and referral programs all bring patients without following them around the internet.
Measurement can adapt too. Call tracking, booking system data and first-party analytics configured with privacy in mind can show which channels produce appointments. The goal is to understand what works without collecting more sensitive data than necessary.
What 2024 does not tell us
The Texas law was new in 2024, and enforcement patterns were still developing. We do not know how the Attorney General will prioritize enforcement involving practices, or how courts will interpret the HIPAA exemptions in edge cases. We also lack reliable data on how many practices changed their tracking because of the law. Practices should watch for guidance and enforcement actions and review their approach regularly.
The premium practice advantage
A premium practice treats privacy as part of patient care. Its website collects only what it needs, respects consent and explains clearly how data is used. That earns trust before the first visit.
That is how we build growth systems: privacy-conscious websites, consent-aware tracking and visibility through Google Maps and AI search, connected by a practice operating system. See our services and who we help. Our team works from Austin with practices nationwide.
The bottom line
The Texas Data Privacy and Security Act took effect July 1, 2024, treating health-related data as sensitive and giving consumers new rights. For practices, the lesson was to map website data, limit tracking of health interests, get real consent where required and confirm with counsel how the law applies. This is marketing guidance, not legal advice.
Check if your market is open. We take one practice per specialty per market. Request a market check or call (716) 400-0084.
Frequently asked questions
When did the Texas Data Privacy and Security Act take effect?
The Texas Data Privacy and Security Act took effect on July 1, 2024.
What rights does it give consumers?
Texas consumers can request access to, correction of, deletion of and a copy of their personal data, and can opt out of targeted advertising, the sale of personal data and certain profiling.
Is health information treated differently?
Yes. The law defines sensitive data to include data revealing mental or physical health conditions or diagnoses, and processing sensitive data generally requires the consumer's consent.
Are medical practices exempt?
The law exempts entities governed by HIPAA and information governed by HIPAA. Whether a particular practice or data flow is exempt depends on its circumstances, so practices should confirm with counsel.
Who enforces the law?
The Texas Attorney General has enforcement authority. Consumers can file privacy complaints with the Attorney General's office.
Is this legal advice?
No. This is marketing guidance, not legal advice. Practices should consult qualified privacy counsel about how the law applies to them.