Texas CUBI Act: definition
The Texas CUBI Act is the common name for Texas’s biometric data law, the Capture or Use of Biometric Identifier Act. The law was enacted in 2009 and is codified in Texas Business and Commerce Code, Chapter 503. It governs the commercial capture, storage, use, and disclosure of biometric identifiers. In practice, compliance teams most often analyze it in connection with facial recognition systems, because a facial image can be used to extract a biometric template for identifying an individual.
In the context of photo and video anonymization, the Texas CUBI Act does not prohibit face blurring itself. The key issue is whether, before the image is blurred, the organization performs operations that could be considered the capture or use of a biometric identifier. If an AI system analyzes footage only to detect a face as an object and immediately applies a blur mask, the regulatory risk is usually lower than when the system creates persistent facial templates, compares individuals across recordings, or identifies specific people. In practice, the line is drawn between object detection for anonymization purposes and biometric identification or verification of a person.
From the perspective of primary legal sources, the most important references are the text of Texas Business and Commerce Code, Chapter 503, guidance and enforcement actions by the Texas Attorney General, and, for comparison, case law and practice surrounding the Illinois BIPA statute. The Texas CUBI Act is a state law, not a federal one, and applies to commercial activity in Texas.
Scope of the Texas CUBI Act
The law applies to commercial entities that capture a biometric identifier for a commercial purpose. It is not limited to the surveillance or AI sector. It may also be relevant to image analysis software vendors, CCTV integrators, providers of photo processing tools, and administrators of video materials.
From a legal standpoint, three elements are especially important: the type of data involved, the purpose of the processing operation, and the obligations imposed on the company. Under the Texas CUBI Act, a biometric identifier includes a retina or iris scan, fingerprint, voiceprint, or a record of hand or face geometry. The last category is especially important for image processing systems.
Area
Practical significance for photos and video
Face geometry
May be created when a system calculates a facial feature vector to identify or match a person
Face detection
Simply detecting the face area for redaction does not always mean a biometric identifier has been created, but it requires analysis of the model architecture and processing logic
Storage
Risk increases when facial features are saved, indexed, or linked with a person’s metadata
Disclosure
Sharing biometric templates with third parties is subject to separate restrictions
Company obligations under the Texas CUBI Act
The law imposes substantive obligations on companies and should be interpreted strictly. For teams responsible for video anonymization, the most important issue is identifying the point at which the technical pipeline begins generating biometric data within the meaning of the law.
In simplified terms, a commercial organization may not capture a biometric identifier without first informing the individual and obtaining consent. In addition, the law restricts the sale, lease, and disclosure of such data unless a specific legal basis applies. It also requires companies to protect biometric data using reasonable care and to destroy it within a reasonable time, but no later than one year after the purpose for collecting it has been satisfied.
- informing the individual in advance that a biometric identifier will be captured,
- obtaining consent before capturing the data,
- prohibiting the sale, lease, or other disclosure of a biometric identifier in most cases,
- limiting disclosure of biometric data to third parties,
- using reasonable safeguards, at least comparable to those used for other confidential data,
- deleting the data within a reasonable time, no later than 1 year after the purpose for collection has been fulfilled.
For photo and video materials, this means compliance does not depend solely on whether the final file contains blurred faces. It also depends on what happens along the way. If the model creates a face embedding, stores it, and uses it to recognize the same person again, compliance obligations are much more extensive than in the case of one-time face detection used only for anonymization.
Why the Texas CUBI Act matters for face anonymization in photos and video recordings
In practice, the goal of image anonymization is to reduce the identifiability of an individual. This usually supports privacy protection, but it does not automatically eliminate the need for a regulatory analysis at the input processing stage. A face blurring system typically relies on deep learning models that detect a face in a frame, define a bounding box or segmentation mask, and then apply blur, pixelation, or a solid mask. Such an AI model must first be trained on image datasets containing faces. The mere use of deep learning does not by itself determine that biometric identifiers of a specific person from production footage are being processed, but the architecture of the solution is decisive.
The safest operating model for anonymization is one in which the system:
- detects faces locally or in a controlled environment,
- does not create persistent facial templates linked to an individual,
- does not compare faces across files for identification purposes,
- does not store logs containing biometric data or person recognition results,
- limits retention of source material after anonymization in line with the organization’s policy.
This distinction is also important when evaluating tools in practice. Anonymization software such as Gallio PRO automatically blurs faces and license plates, but it is not designed for biometric identification of individuals. It also does not anonymize a video stream or operate in real time. For assessment under the Texas CUBI Act, the key question is whether the system is deployed as an image redaction tool or as an identity recognition tool.
Differences between the Texas CUBI Act and Illinois BIPA
The Texas CUBI Act is most often compared with Illinois BIPA, the Biometric Information Privacy Act, 740 ILCS 14, which has been in force since 2008. Both laws regulate biometric data, but their practical consequences for businesses are different.
Criterion
Texas CUBI Act
Illinois BIPA
Year
2009
2008
Scope
Commercial capture of a biometric identifier and its storage, use, and disclosure
Collecting, capturing, purchasing, receiving through trade, and otherwise obtaining biometric data
Private right of action
Generally no private right to sue comparable to BIPA
Yes — the main reason for the high litigation risk
Retention
Deletion within a reasonable time, no later than 1 year after the purpose for collection has been fulfilled
Requires a public retention policy and a schedule for data destruction
Enforcement significance
Stronger enforcement risk from the state authority
Very high risk of class actions and statutory damages
The most important compliance difference is that BIPA created an exceptionally strong civil litigation framework, whereas the Texas CUBI Act is primarily a public enforcement tool. That does not mean the risk is low. It simply means the legal risk profile is different and compliance must be documented differently.
Key compliance assessment criteria for anonymization systems
When evaluating a tool for processing photos and video, it is useful to translate legal requirements into measurable technical features. Face detection accuracy alone is not enough. You should determine whether the solution generates and preserves biometric data, how long it retains that data, and where the processing takes place.
- data retention — maximum storage period for source material, masks, metadata, and any face embeddings,
- deployment model — on-premises or controlled environments reduce data exposure,
- detection accuracy — face recall and precision affect the risk of leaving an individual unredacted in the frame,
- false negatives — missed faces create privacy and compliance risk,
- no identification — it should be verified that the system is not intended for identity recognition,
- logging — logs should not contain personal data or biometric templates unless strictly necessary.
In practice, a simple rule can be applied: the fewer operations that go beyond one-time face detection for redaction, the lower the risk of falling within the biometric regulatory framework. This does not replace legal analysis, but it helps structure the solution architecture.
Legal references and sources
Definitions and obligations should be verified primarily against primary legal sources. In the event of interpretive discrepancies, the statutory text and official enforcement practice take precedence.
- Texas Business and Commerce Code, Chapter 503 — Biometric Identifiers, the law in force in Texas
- Illinois Biometric Information Privacy Act — 740 ILCS 14
- Materials and guidance from the Texas Attorney General regarding enforcement of biometric laws
- Technical documentation for the image processing system — necessary to determine whether biometric templates are being created
See also
- GDPR
- Data anonymization
- Face blurring
- Privacy protection