Texas Biometric Law and AI Hiring: CUBI vs TRAIGA

Image: Unsplash.

If an AI interview, voice screening or ID-check tool in your hiring flow captures a Texas candidate's face geometry, voiceprint or fingerprint, the rule you need is Section 503.001 of the Business and Commerce Code, the Capture or Use of Biometric Identifier Act (CUBI). It has applied since April 1, 2009 (Texas statutes). TRAIGA, the Texas Responsible Artificial Intelligence Governance Act (HB 149), didn't create that rule. It amended it, from January 1, 2026.

An earlier version of this page blended the two laws and got the consent, retention and penalty rules wrong. The correction note at the end lists what changed. The checklist below follows the statute text as it stands today.

Two laws, one hiring flow

Screenshot: Texas Business and Commerce Code Sec. 503.001, Texas Constitution and Statutes.

What TRAIGA changed in the biometric law

Section 2 of HB 149 rewrote parts of Section 503.001 (enrolled text). Four changes matter for hiring:

• Online photos aren't consent. A person hasn't been informed or given consent "based solely on the existence of an image or other media" of them online, "unless the image or other media was made publicly available by the individual to whom the biometric identifiers relate" (Sec. 503.001(b-1)).
• AI training is carved out, identification isn't. The section doesn't apply to biometric identifiers used in "developing, training, evaluating, disseminating, or otherwise offering" AI, "unless a system is used or deployed for the purpose of uniquely identifying a specific individual" (Sec. 503.001(e)(2)).
• Security and fraud tools are carved out. It also doesn't apply to AI built or deployed for "preventing, detecting, protecting against, or responding to security incidents, identity theft, fraud," or other illegal activity (Sec. 503.001(e)(3)).
• Repurposed training data comes back in. Identifiers captured to train AI and later used for another commercial purpose fall under the full section, penalties included (Sec. 503.001(f)).

Screenshot: HB 149 enrolled text, Section 2, Texas Legislature Online.

TRAIGA also has its own biometric section, and it's easy to confuse with CUBI. Section 552.054 bars governmental entities from using AI to uniquely identify a person by biometric data without consent, and its definition of "biometric data" leaves out photographs, video and audio recordings and data generated from them. That definition doesn't replace CUBI's. The same section adds one line that ties the two laws together: "A violation of Section 503.001 is a violation of this section." Baker Botts reads the amendments the same way we do.

The checklist

1. Find the tools that capture identifiers

• List every tool that touches a candidate's face, voice or hands: video interview scoring, voice screening, selfie-to-ID checks, fingerprint time clocks at onboarding.
• For each one, ask whether it creates "a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry" (Sec. 503.001(a)(2)). The statute doesn't define "record of face geometry." We'd treat facial landmark or expression analysis as covered until the vendor shows in writing that no geometry is recorded.

2. Notice and consent, before capture

• Tell the candidate before the capture starts, and get their consent (Sec. 503.001(b)). The section doesn't require a written form. We'd still use a separate dated notice with a checkbox, shown before the interview or check begins, because you'll need to show it later.
• Don't rely on a photo the candidate has online. Under subsection (b-1) an image someone else posted is never consent, and nothing in the section says a self-posted photo is consent either. Ask.

3. Sharing

• Don't sell, lease or otherwise disclose a candidate's identifier unless one of four exceptions applies: consent to disclosure for identification if the person disappears or dies, completing a financial transaction they asked for, disclosure required or permitted by statute, or law enforcement acting on a warrant (Sec. 503.001(c)(1)).
• Check what your vendor contract says. The four exceptions don't mention service providers, and we found no Attorney General guidance on a vendor processing identifiers for an employer.

4. Storage and deletion

• Protect identifiers with reasonable care, at least as well as your other confidential information (Sec. 503.001(c)(2)).
• Destroy them within a reasonable time, and no later than one year after the purpose for collecting them expires (Sec. 503.001(c)(3)). The law doesn't say when a hiring purpose expires. For candidates you don't hire, we'd start the clock at the hiring decision.
• If another law makes you keep a record that contains an identifier, the year runs from when that record no longer has to be kept (Sec. 503.001(c-1)).
• For employees, an identifier collected for security purposes, such as door access, is presumed to have served its purpose when employment ends (Sec. 503.001(c-2)).

Image: Pexels, used under the Pexels License.

5. Exemptions, read narrowly

• Don't lean on the AI training exemption for hiring. A selfie-to-ID match exists to identify one specific person, which is the exact case subsection (e)(2) leaves in.
• An identity check aimed at candidate fraud may fit the fraud and identity theft carve-out in subsection (e)(3). That's our reading of the text, not a ruling. Write down why the tool is a fraud control before you rely on it.
• If a vendor trained on identifiers and then uses them for something else commercial, the full section applies to it again (Sec. 503.001(f)).

6. TRAIGA's own hiring rule

• Make sure no AI tool in hiring is built or used "with the intent to unlawfully discriminate against a protected class in violation of state or federal law" (Sec. 552.056(b)). Disparate impact alone doesn't show intent under TRAIGA (Sec. 552.056(c)), but federal and Texas anti-discrimination law still apply on their own terms.
• The rest of TRAIGA (the other bans, the cure process, the NIST-linked defense) is in our Texas TRAIGA compliance checklist.

Questions to send your vendor

Send these in writing and keep the answers with your AI tool register.

1. Does your tool create a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry of a candidate, at any step, including steps that don't store the result?
2. At what moment does capture start, and can our notice and consent screen run before it?
3. Do you disclose identifiers to anyone else, including subprocessors, and under which of the four Section 503.001(c)(1) exceptions?
4. How do you protect them, and can you delete them on our schedule, within a year of the purpose expiring?
5. Do you use identifiers from our candidates to train or evaluate your models? If yes, are those models used to identify individuals?

A vendor that can't answer the first question plainly isn't ready for Texas candidates.

How enforcement has looked so far

The Attorney General has exclusive authority to enforce CUBI (Texas AG). The office's first lawsuit under it ended in a $1.4 billion settlement with Meta, announced July 30, 2024, over capturing Texans' biometric data without the authorization the law requires (press release). That case wasn't about hiring, but it shows the office uses this statute.

Screenshot: Office of the Texas Attorney General, press release of July 30, 2024.

What this checklist doesn't cover

• Other states. Illinois has its own biometric law; our BIPA checklist for Illinois employers covers it.
• Federal hiring law. Background-check and anti-discrimination rules apply on their own terms. Our FCRA and AI hiring guide covers the disclosure side.

What we could not confirm: we found no Attorney General guidance and no court ruling on AI video interview tools under Section 503.001, and no guidance on how Section 552.054's link to Section 503.001 works for private employers. The statute doesn't define "record of face geometry" or when a hiring purpose expires; where the checklist fills those gaps, it says so.

Correction (October 20, 2026): Earlier versions presented Business & Commerce Code Section 503.001 as part of TRAIGA. It is the Capture or Use of Biometric Identifier Act, in force since 2009; TRAIGA amended it from January 1, 2026. They also said consent must be written and state a retention period (the section requires notice and consent before capture, with no written-form rule), that identifiers may be kept up to three years (the limit is one year after the purpose expires), that "per violation" means per applicant in Attorney General practice, and that the Attorney General has named biometric data a priority (we found no source for either). They quoted a "publicly available" definition and exclusions for photographs and security access that the section doesn't contain, and attributed Illinois BIPA settlement figures we couldn't source. Those passages were removed or rewritten from the statute text.

Related Reading

• Texas Sues OpenAI and Sam Altman: What the Suit Demands
• Texas TRAIGA compliance checklist
• Texas TRAIGA safe harbor: what the NIST defense covers
• Texas TRAIGA complaint portal is live
• BIPA AI hiring compliance checklist for Illinois employers
• AI hiring tool compliance across US state laws
• NYC Local Law 144 AI bias audit employer guide
• FCRA and AI hiring: the disclosure requirement
• AI vendor due diligence checklist

References

1. Texas Constitution and Statutes, Business & Commerce Code Chapter 503
2. Texas Legislature Online, HB 149, enrolled text
3. Office of the Texas Attorney General, Biometric Identifier Act and Meta settlement release
4. Baker Botts, Texas Enacts Responsible AI Governance Act: What Companies Need to Know