Two Cases: The Whole Enforcement Record Under Texas's Biometric Statute

CUBI and Who Enforces It

The Capture or Use of Biometric Identifier Act is a single section: Tex. Bus. & Com. Code § 503.001, the whole of chapter 503. It defines a biometric identifier as a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry, and it governs capture for a commercial purpose.

Its enforcement provision is one sentence long. Subsection (d) states that a person who violates the section is subject to a civil penalty of not more than $25,000 for each violation, and that the attorney general may bring an action to recover the civil penalty.

The statute was added in 2007 and took effect on April 1, 2009, and it has been amended three times since, most recently by House Bill 149 in 2025. For the first thirteen years of its operation, the enforcement record was empty.

The Meta Settlement

The Office of the Attorney General announced on July 30, 2024 a $1.4 billion settlement with Meta Platforms, describing it as the first lawsuit brought and the first settlement obtained under the statute. The office had sued in February 2022, pleading claims under both CUBI and the Deceptive Trade Practices Act.

According to that release, Meta introduced a feature originally called Tag Suggestions in 2011, turned it on for all Texans by default, and for more than a decade ran facial recognition software on virtually every face contained in photographs uploaded to Facebook, capturing records of the facial geometry of the people depicted.

The operative document is the Agreed Final Judgment in Cause No. 22-0121, 71st Judicial District, Harrison County, filed July 30, 2024 and adopting a Settlement Agreement and Release executed the previous day. Its payment terms are precise:

• A first installment of $500,000,000, due within thirty days of the later of the agreement's effective date or Meta's receipt of complete payment instructions
• Of that first installment, $225,000,000 goes to satisfy outside counsel's fees and expenses as approved by the OAG under Texas Government Code sections 2254.104 and 2254.108, with any remainder deposited to the general revenue fund, and $275,000,000 goes directly to general revenue
• Four remaining installments of $225,000,000 each, payable respectively in 2025, 2026, 2027 and 2028, of which $3,000,000 goes to the OAG for partial satisfaction of its own attorneys' fees and $222,000,000 to general revenue
• The judgment states that the settlement amount represents the total extent of Meta's payment obligations, and that payment of the final installment fully discharges them

The Google Settlement

The second action came on October 20, 2022, when the office sued Google LLC alleging that it had collected millions of biometric identifiers, including voiceprints and records of face geometry, from Texans through products including Google Photos, Google Assistant and Nest Hub Max.

A settlement in principle of $1.375 billion was announced on May 9, 2025, and the office announced on October 31, 2025 that Google had signed the agreement.

That figure is not a CUBI figure. Both releases describe the settlement as resolving suits over geolocation tracking, incognito browsing activity and biometric identifiers, and the October release calls it the conclusion of two enforcement actions. Neither release apportions the amount among the claims, and this article cites no settlement document for the Google matter because none was located on the Attorney General's site. What the biometric case alone was worth is not established by anything published.

What the Petitions Alleged

The office published its Original Petition against Google, filed in the District Court of Midland County. It is brought under the authority of section 503.001(d) and pleads that Google captured Texans' biometric identifiers without consent and failed to destroy captured identifiers, conduct it identifies as unlawful under subsections 503.001(b), (c)(2) and (c)(3). It states that the Attorney General is authorized to seek civil penalties of up to $25,000 for each violation.

The factual allegations track particular product behaviour: that Face Grouping in Google Photos sorts images into groups based in part on the similarity of face geometry; that a Nest Hub Max indiscriminately captures the face geometry of any Texan who comes into view; and that Google Assistant captures and stores voiceprints, including those of guests.

The corresponding Meta pleading is not covered here. The Agreed Final Judgment refers to a First Amended Petition filed by the State, but that document was not published alongside the judgment, so the description of Meta's conduct above rests on the Attorney General's own release rather than on the pleading.

No Private Right of Action

Subsection (d) is the statute's only enforcement mechanism, and it names one enforcer. Nothing in chapter 503 creates a cause of action for an individual whose biometric identifier was captured, and nothing provides for statutory damages payable to that person. The penalty runs to the State.

That single design choice explains the shape of everything above. Texas has a substantive biometric statute of roughly the same vintage as the Illinois Act and a per-violation penalty larger than the Illinois liquidated damages figures, and its entire enforcement history is two cases, both brought by the same office, both settled before any court construed the statute.

What the Settlements Establish

As precedent, very little. The Meta judgment provides that it “shall not be deemed or construed to be an admission or evidence of any violation of any statute or law, of any liability or wrongdoing by Meta,” and that it is intended solely for the benefit of the parties, with no word, term, phrase or definition available to any litigant who is not a party. Neither action produced a ruling on what section 503.001 requires.

As a set of obligations, considerably more, though they bind one defendant. The Meta judgment installs a standing procedure for future biometrics enforcement. Meta may give the OAG notice of anticipated or ongoing conduct and confer about whether a biometrics law applies; the State answers in writing within thirty days, and may request further information, object, advise that it takes no action, or advise that it does not object, with further twenty-one day exchanges if information is requested.

For conduct Meta has not disclosed, the State must give written notice specifying the bases on which it contends the conduct violates each biometrics law, the parties then have sixty days to confer and attempt to reach agreement on the legality of the conduct or on modifications that would render it lawful, and the State may not bring a civil enforcement action or seek other relief until it has complied. The judgment also suspends the accrual of civil penalties, damages and interest during those notice and dispute-resolution periods, and during any additional period in which Meta makes commercially reasonable efforts to avoid or cease the disputed conduct as to people it knows or believes to be current Texas residents. The tolling falls away if the State establishes that Meta's initial disclosure was materially false or materially misleading.

Meanwhile the statute the two cases were brought under has changed. House Bill 149, effective January 1, 2026, added subsection (b-1), providing that the mere existence of an image containing biometric identifiers on the internet or another publicly available source does not establish that the individual was informed or consented, unless that individual made it public. It also added exemptions at subsection (e) for the training, processing or storage of biometric identifiers involved in developing or offering artificial intelligence models or systems, unless a system is used or deployed for the purpose of uniquely identifying a specific individual, and for AI developed or deployed for security, fraud and related purposes. Subsection (f) returns such an identifier to the section's possession, destruction and penalty provisions if it is later used for a commercial purpose the exemption does not cover.

Frequently Asked Questions