HB 4423 expands and modernizes Texas law governing biometric identifiers and biometric information. It broadens the statutory definitions to cover additional forms of biometric data, including palm or vascular vein scans, heartbeat, keystrokes, signature, gait, and records or scans of hand or face geometry, while excluding ordinary photos and recordings unless they are used to identify a specific person. The bill also creates a parallel definition section for both Government Code and Business and Commerce Code provisions so the same terms apply across public and private-sector rules.
For governmental bodies, the bill prohibits selling, leasing, or otherwise disclosing biometric data except with consent, when authorized by another law, or for law-enforcement purposes, and it requires agencies to store and protect such data with reasonable care. It also makes biometric data held by a governmental body exempt from disclosure under the Public Information Act. For private persons collecting biometric data for a commercial purpose, the bill requires advance notice and consent before capture, limits disclosure, requires reasonable security protections, and generally requires destruction of the data within a reasonable time, no later than one year after the collection purpose expires, subject to exceptions for records required to be retained by law and for employer-collected security data after employment ends.
The bill also increases enforcement clarity by authorizing the attorney general to seek civil penalties of up to $25,000 per violation. It preserves an existing exception for voiceprint data retained by financial institutions and their affiliates. The act would take effect immediately if it receives a two-thirds vote in each chamber; otherwise, it would take effect on September 1, 2025.
The overall sentiment reflected in the available record is neutral to supportive, but limited, because there are no committee transcripts or recorded votes included. The bill was referred to the Delivery of Government Efficiency committee, suggesting it was treated as an administrative and privacy-governance measure rather than a highly controversial policy proposal. No formal opposition or amendments are shown in the provided materials.
The main points of potential contention are the expanded scope of covered biometric data, the consent and destruction requirements for businesses, and the new disclosure restrictions on governmental bodies. Businesses that use biometric systems for security, authentication, or commercial services may view the bill as increasing compliance burdens, while privacy advocates and public-sector transparency concerns may focus on the tradeoff between biometric privacy and access to government-held information.
HB 4423 would amend Chapter 560 of the Government Code and Chapter 503 of the Business and Commerce Code to broaden Texas biometric privacy law, align definitions across public and private sectors, and strengthen restrictions on collection, storage, disclosure, and retention of biometric identifiers and biometric information. It would also make biometric data held by governmental bodies exempt from Public Information Act disclosure and authorize attorney general enforcement with civil penalties for violations.
The available record suggests a generally neutral-to-supportive posture toward the bill, with no recorded votes or committee debate showing organized opposition. Its referral to the Delivery of Government Efficiency committee indicates it was handled as a governance and privacy measure, and the absence of transcripted controversy limits any stronger conclusion about legislative sentiment.
The likely areas of contention are the bill’s expanded definition of biometric data, the requirement that private entities obtain notice and consent before collection, the mandatory destruction timeline, and the limits on disclosure by both businesses and governmental bodies. Employers and commercial users of biometric systems may object to compliance costs and retention limits, while privacy advocates may support the tighter controls but could scrutinize exceptions for law enforcement, financial institutions, and legally required record retention.