Law · Texas, United States
Texas Capture or Use of Biometric Identifier Act (CUBI)
Texas's 2009 biometric statute requires informed consent before a person's biometric identifier, including face geometry, is captured for a commercial purpose, and bans selling it. Only the Texas Attorney General can enforce it, at up to $25,000 per violation. Dormant for a decade, it produced the two largest biometric settlements in US history against Meta (2024) and Google (2025).
Updated November 6, 2026 · 3 min read · reviewed November 6, 2026
- $25,000
- Maximum civil penalty per violation
- $1.4bn
- Meta settlement, July 2024, first case under the Act
- $1.375bn
- Google settlement, May 2025, biometric plus other privacy claims
Tex. Bus. & Com. Code 503.001(d)
Texas Attorney General
Texas Attorney General
What does CUBI cover?
The Act defines a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry. A person may not capture an individual's biometric identifier for a commercial purpose without first informing the individual and obtaining consent. Anyone holding an identifier may not sell, lease or disclose it except in narrow circumstances, must protect it with reasonable care, and must destroy it within a reasonable time, no later than one year after the purpose for collecting it expires.
Unlike Illinois BIPA, consent need not be written, there is no retention-policy publication duty, and there is no private right of action. The statute is short, two subsections of definitions and duties and one of enforcement, which left most questions to the Attorney General's litigation.
Who enforces it?
The Texas Attorney General alone. For thirteen years nobody did. In February 2022 the Attorney General sued Meta over Facebook's tag suggestions and in October 2022 sued Google over Photos, Nest and Assistant. The Meta case settled on 30 July 2024 for $1.4 billion paid over five years, the largest settlement ever obtained by a single state. The Google case settled on 9 May 2025 for $1.375 billion, though that figure also resolved location-tracking and Incognito-mode claims, so it is not a pure biometric number.
What are the penalties?
| Measure | Figure |
|---|---|
| Statutory penalty per violation | Up to $25,000 |
| Captures alleged in the Meta complaint | Over one billion |
| Theoretical maximum cited by commentators | In the trillions of dollars; never a realistic recovery |
| Actual settlement | $1.4 billion |
What does it mean for face search?
A face search engine that computes a record of face geometry from public photos of Texans, for a commercial purpose, without informing them and obtaining consent, fits the statute's language as the Attorney General read it against Meta and Google. The difference from Illinois is who can act: a Texan cannot sue PimEyes, FaceCheck.ID, FaceSearch or any other engine under CUBI; only the Attorney General can, and so far the office has pursued platforms with hundreds of millions of users rather than search engines. The consent duty also applies to the person whose face is captured, not the person uploading the query photo, which is why an engine's terms asking users to search only their own face do not by themselves satisfy the Act.
What is pending or unsettled?
- No court has construed the statute's key terms; both headline cases settled before judgment.
- Whether the Attorney General will turn to smaller data collectors, including face search engines, after the Meta and Google settlements.
- Interaction with the Texas Data Privacy and Security Act (2024), which treats biometric data as sensitive data requiring consent and is also enforced by the Attorney General.
Questions
Can I sue under CUBI?
No. Only the Texas Attorney General can bring an action. Private suits over biometric data in Texas rely on other theories, such as the Texas Data Privacy and Security Act or common-law claims.
Does CUBI require written consent?
No. It requires that the individual be informed and consent; the form is not specified, unlike Illinois, which requires a written release.
Why was the Meta settlement so large?
The complaint alleged more than a billion captures of face geometry, each a potential $25,000 violation. Meta settled for $1.4 billion rather than litigate that exposure.
Does CUBI reach companies outside Texas?
The Attorney General has applied it to out-of-state companies serving Texans. No court has drawn the line because the cases settled.
Sources
- 1.Texas Business and Commerce Code, section 503.001 (checked November 6, 2026)
- 2.Spencer Fane, Meta reaches largest AG settlement in history, $1.4 billion, for alleged violations of Texas biometric privacy law (checked November 6, 2026)
- 3.Cybersecurity Law Report, Texas AG's billion-dollar settlement with Google highlights biometric data use compliance considerations (checked November 6, 2026)
Entry reviewed November 6, 2026. Found an error? Tell us.
Related entries
- Law Illinois Biometric Information Privacy Act (BIPA) Illinois BIPA (740 ILCS 14): consent before collecting face geometry, a private right of action, $1,000 to $5,000 per violation, the 2024 amendment, and face search.
- Law Washington biometric law and the My Health My Data Act Washington's two biometric laws: RCW 19.375 (2017, Attorney General only) and the My Health My Data Act (2023, private right of action), and face search.
- Law California Consumer Privacy Act (CCPA, as amended by the CPRA) California CCPA/CPRA: biometric data as sensitive personal information, the rights to know, delete and limit, CPPA and Attorney General enforcement, and face search.
- Term Biometric data Biometric data defined: identifying data from a face, fingerprint, iris or voice, when a photo becomes biometric data, and the GDPR, BIPA and DPDP rules.
- Engine Clearview AI Clearview AI: the law-enforcement face search built on scraped web images, its 100-billion-image claim, who may use it, and fines and orders from seven countries.
Cite this entry
FaceSearch Wiki editors. "Texas Capture or Use of Biometric Identifier Act (CUBI)". FaceSearch Wiki, updated November 6, 2026. https://facesearch.wiki/laws/us-texas-cubi/