Does the Texas TRAIGA require biometric consent?
Answer
For private-sector employers, TRAIGA itself does not impose biometric consent — its biometric-identification ban applies to government entities only. The controlling law is Texas's CUBI statute (Tex. Bus. & Com. Code §503.001): before capturing face geometry or a voiceprint for a commercial purpose, you must give notice, obtain consent, protect the data, and destroy it on schedule. TRAIGA's 2026 amendments updated CUBI's AI provisions. The Attorney General enforces both.
For private-sector employers, no — TRAIGA itself does not impose the biometric consent obligation. Texas HB-149's (TRAIGA) prohibition on identifying individuals from publicly available biometric data without consent applies to government entities only. The controlling biometric consent law for private-sector employers is Texas's CUBI statute (Capture or Use of Biometric Identifier Act, Tex. Bus. & Com. Code §503.001): before capturing a biometric identifier — such as face geometry or a voiceprint in an AI video interview — for a commercial purpose, an employer must inform the individual and obtain consent, protect the data, and destroy it within a set period after the collection purpose ends. TRAIGA's 2025 amendments to CUBI, effective January 1, 2026, add an AI-model-training exception and clarify that media appearing publicly online does not by itself constitute consent unless the individual made it public. Enforcement of both TRAIGA and CUBI is exclusive to the Texas Attorney General; CUBI carries civil penalties up to $25,000 per violation. Employers already compliant with a strict biometric regime such as Illinois BIPA will generally meet CUBI's consent requirements.
Sources checked
Scope
Clarifies that for private-sector employers biometric consent flows from Texas's CUBI statute (Tex. Bus. & Com. Code §503.001), not TRAIGA, whose biometric ban is government-only. Covers CUBI's notice, consent, and retention duties and TRAIGA's 2026 CUBI amendments. Illinois BIPA is referenced only for comparison.
Operational implication
If a hiring AI extracts face geometry or a voiceprint, CUBI requires pre-capture notice, consent, protection, and timely destruction. Operationally that means a consent step before any biometric processing, a documented retention/destruction schedule, and vendor confirmation of how biometric data is handled — or the employer inherits the §503.001 exposure directly.
Applicable Regulations
Texas Responsible Artificial Intelligence Governance Act (TRAIGA)
Signed June 22, 2025; effective January 1, 2026. TRAIGA is Texas's primary comprehensive AI governance law from the 89th Legislature. It establishes prohibited AI practices applying to all entities that promote, advertise, or conduct business in Texas, produce products or services for Texas residents, or develop/deploy AI systems in the state. Key prohibitions cover behavioral manipulation (inciting self-harm, violence, or criminal activity), government social scoring, unlawful discrimination, government biometric identification from public sources without consent, and constitutional rights infringement via AI. Government agencies must disclose to consumers when they are interacting with an AI system, using clear and conspicuous language free of dark patterns; healthcare-provider AI disclosure to patients is governed separately by Texas SB 1188. Enforcement is exclusively by the Texas Attorney General; no private right of action exists. A 36-month regulatory sandbox program allows companies to test AI systems with certain requirements waived. The law also establishes the Texas Artificial Intelligence Council (seven members) to advise on ethical, privacy, and public safety implications — though the Council cannot adopt binding rules.
Key Requirements
Full State Analysis
Where this lands operationally
Gridex turns the compliance or coverage question into operated workflow controls: intake, review points, audit trails, and the places a person stays in the decision.
Map This Workflow With Gridex
Audit AI tools for biometric capture and stand up CUBI-compliant consent, retention, and destruction with Gridex's governed AI deployment workflow (/services/governed-ai-deployment/).
Map This Workflow With Gridex →Related Questions
- What AI rules apply to hiring in Texas? Texas does not currently have a private-sector AI hiring disclosure or candidate opt-out law comparable to Illinois, Colorado, or NYC Local Law 144. Texas HB-2060 was a state-agency AI advisory and inventory law, not an employer hiring rule. The main Texas AI law for private employers is HB-149 (TRAIGA), effective January 1, 2026: for hiring AI it matters mainly if the system is intentionally deployed to discriminate against protected classes or otherwise falls into TRAIGA's prohibited-practice categories. TRAIGA's biometric-identification and social-scoring prohibitions apply to government entities only — biometric consent for private-sector AI tools, such as video-interview face or voice capture, is governed by Texas's CUBI statute (Tex. Bus. & Com. Code §503.001), not TRAIGA. Employers using AI in Texas should still document the tool, human review points, bias controls, and any biometric consent process.
- What are the Texas TRAIGA private sector AI obligations? Texas HB-149 (the Texas Responsible Artificial Intelligence Governance Act, or TRAIGA) — effective January 1, 2026 — is structured as a prohibition-based statute, not an affirmative-obligation regime like Colorado's AI Act. Private-sector businesses that promote, advertise, or conduct business in Texas, produce products or services for Texas residents, or develop/deploy AI systems in the state are prohibited from: (1) using AI designed to incite self-harm, harm to others, or criminal activity (behavioral manipulation); (2) intentionally deploying AI to discriminate against protected classes (disparate impact alone is insufficient to prove intent); and (3) using AI to infringe constitutional rights or target individuals based on constitutionally protected characteristics. Two further TRAIGA prohibitions — biometric identification from publicly available sources, and social scoring — apply to government entities only; for private-sector employers, biometric consent for AI tools is governed by Texas's CUBI statute (Tex. Bus. & Com. Code §503.001), not TRAIGA. TRAIGA's consumer-disclosure duty (telling a person they are interacting with AI) applies to government agencies; healthcare-provider AI disclosure to patients is governed separately by SB 1188, not TRAIGA. There is no statewide mandate for risk assessments, governance policies, or high-impact-system recordkeeping. Enforcement is exclusive to the Texas Attorney General; no private right of action. A 36-month regulatory sandbox allows approved companies to test AI systems with certain requirements waived.
- Can I use AI for hiring in Illinois? Yes, but two distinct Illinois laws apply. HB-3773 (effective January 1, 2026) amended the Illinois Human Rights Act to prohibit employers from using AI that discriminates against protected classes or uses zip codes as a proxy, and it requires notice to employees that AI is being used in employment decisions (recruitment, hiring, promotion, discipline, tenure, or terms and conditions). Separately, the Illinois Artificial Intelligence Video Interview Act (PA 101-0260, 820 ILCS 42), in effect since 2020, applies specifically when AI analyzes applicant video interviews: employers must notify the applicant, explain how the AI works, obtain written consent, limit video sharing to necessary evaluators, delete videos within 30 days of an applicant's request, and — per the 2022 amendment (PA 102-47) — report applicant racial/ethnicity data annually to DCEO. If AI hiring tools also capture biometric identifiers (e.g., facial geometry from video), the separate Illinois Biometric Information Privacy Act (BIPA) creates additional consent and liability obligations. Illinois employers using AI for any form of employment decision should map their process against all three regimes.
- Which states have AI hiring laws? Illinois and Colorado have the most direct state-level AI hiring rules. Illinois HB-3773 and the AI Video Interview Act cover notice, consent, non-discrimination, video-interview limits, and reporting. Colorado's AI Act (SB 26-189, with obligations beginning January 1, 2027) covers ADMT used for consequential employment decisions through interaction notice, adverse-outcome disclosure, data correction, and meaningful human review. Minnesota HF-4757 can reach employment profiling through privacy and data-protection-assessment obligations. Texas should be tracked for TRAIGA (HB-149) prohibited practices, especially intentional discrimination and biometric identification, but HB-2060 is not a private-employer AI hiring disclosure law.