Texas CUBI Biometric Privacy Law and AI

CUBI is codified at Texas Business and Commerce Code §503.001. Its defined biometric identifiers include a retina or iris scan, fingerprint, voiceprint, and record of hand or face geometry. In general, a person may not capture a biometric identifier for a commercial purpose unless the person informs the individual before capture and receives consent. The statute restricts sale and disclosure, requires reasonable care, and requires destruction within a reasonable time, no later than one year after the purpose for collection expires, subject to statutory terms. The Texas Attorney General has exclusive enforcement authority; the statute provides civil penalties.

Texas HB 149, the Responsible Artificial Intelligence Governance Act, took effect January 1, 2026 and amended CUBI. Public availability alone is not notice or consent for commercial capture or storage unless the individual made the image or media public. The amendment also excludes specified training, processing or storage of biometric identifiers involved in developing, training, evaluating, disseminating or offering AI models or systems, unless the activity is performed to uniquely identify a specific individual. This is a defined carveout, not a blanket exemption for anything called AI.

A further limitation matters when data later changes purpose: if a biometric identifier captured for AI training is subsequently used for a commercial purpose, the statute applies its possession and destruction requirements and penalties to that later use. The amendments therefore require organizations to track both original collection purpose and downstream deployment. CUBI is not a general law governing every face image or all personal information processed by AI; the identifier definition, commercial-purpose trigger, exceptions and use history all matter.