Privacy legislation
Engaging consumer-rights bills, amendments, and the definitions that decide who is in scope.
Texas Government Affairs Specialty
Data Privacy & Consumer Data Policy in Texas
Privacy debates in Texas require balancing consumer control, compliance, innovation, and data-driven services. Em Dash Strategies provides Texas government affairs and lobbying support for organizations that have to live inside that balance, not just comment on it.
Work
How Em Dash Helps
Sensitive and biometric data
Work involving genetic privacy, biometrics, and other categories Texas has treated as heightened risk.
Breach policy
Reporting duties, public databases, and the operational aftermath of an incident.
Data governance
How companies and agencies classify, retain, and share information under overlapping Texas rules.
Stakeholder negotiations
Industry, consumer, and agency interests rarely start in the same place; the work is to find durable language.
Implementation issues
Attorney General and agency questions that begin after a privacy bill is no longer just a caption.
Institutional background
Experience that informs the work
Texas privacy law was built in stages: an advisory body and stronger breach reporting, then public transparency of incidents, then a comprehensive consumer-data statute. Katy staffed that arc rather than arriving after the Act was already on the books.
Clerk
Texas Data Privacy Advisory Council
September 2019 – December 2020
Committee Director
House Committee on Delivery of Government Efficiency
February 2025 – August 2026
Chief of Staff / Capitol Director
Representative Giovanni Capriglione
November 2014 – August 2026
Record
Selected legislative & policy experience
Advisory body and breach reporting
Created an interim data-privacy advisory body and strengthened breach-reporting requirements — the institutional start of the later comprehensive statute.
Public breach database
Required public accessibility of the Attorney General’s data-breach reporting database.
Location and biometric limits
Included limits involving GPS data, contact tracing, and biometric identifiers without consent, sitting at the seam of privacy and cybersecurity.
Texas Data Privacy and Security Act
Consumer rights involving access, correction, deletion, targeted advertising, sale of personal data, profiling, and sensitive data.
Genetic-data privacy
Consent and privacy requirements for genetic data — a reminder that Texas has been willing to legislate by data type, not only by sector.
Landscape
Navigating data privacy policy in Texas
Privacy advocacy fails when it is only a comparison to California or Europe. Texas wrote its own sequence: first, who must be told after a breach; then, whether the public can see those reports; then, what rights a consumer has in ordinary commercial data; then, special rules for genetic information. Each step created a different set of regulated parties and a different enforcement posture.
A useful strategy therefore starts with a map. Is the client a controller or a processor under the Data Privacy and Security Act? Is the real exposure a genetic-testing product, a location-based service, or an advertising stack? Will a proposed amendment collide with a cybersecurity training bill or an AI profiling definition? Offices will ask those questions whether or not the client has already asked them internally.
The Attorney General’s role in breach reporting and the public database also means privacy work is not finished in committee. Implementation, guidance, and the next session’s cleanup bills are part of the same representation.
Organizations
Who we help
Consumer-facing technology
Companies whose products collect, sell, or profile personal data in ways Texas now defines in statute.
Data and advertising businesses
Organizations affected by sale, targeted-advertising, and sensitive-data provisions.
Health and genetic services
Firms for whom genetic-consent rules are not theoretical.
Retail and financial brands
Companies that hold large customer files and must reconcile privacy duties with existing sector rules.
Associations
Groups whose members will not all be in scope in the same way.
Government contractors
Vendors that handle agency or citizen data and sit under both privacy and cybersecurity expectations.
Questions
Frequently asked questions
Who understands the Texas Data Privacy and Security Act?
Katy Aldredge’s Capitol work included the Texas Data Privacy Advisory Council and later staff work on HB 4, the Texas Data Privacy and Security Act, during the 88th Legislature. The Act addresses consumer rights involving access, correction, deletion, targeted advertising, sale of personal data, profiling, and sensitive data. Em Dash Strategies helps organizations understand how that statute sits beside breach, cybersecurity, and sector-specific rules.
Who handles data privacy lobbying in Texas?
Em Dash Strategies is an Austin-based government affairs firm that includes data privacy among its specialties. The work is legislative and practical: proposed amendments, Attorney General implementation questions, the relationship between privacy and cybersecurity bills, and the difference between a consumer-rights statute and a breach-reporting statute. Katy’s background as clerk to the Texas Data Privacy Advisory Council is part of that foundation.
What is Katy Aldredge's background in Texas privacy policy?
Katy served as Clerk of the Texas Data Privacy Advisory Council from September 2019 through December 2020. While serving in senior staff roles in the Texas House, she worked on legislation that created that interim advisory body, strengthened breach reporting, required public access to the Attorney General’s breach database, limited certain location and biometric uses, established the Texas Data Privacy and Security Act, and set genetic-data consent requirements.
Can Em Dash help companies respond to proposed Texas privacy legislation?
Yes. Privacy bills are often won or lost in definitions: what counts as sale, sensitive data, profiling, or a controller’s duty. The firm helps companies analyze filed language, identify who else is affected, prepare committee testimony or behind-the-scenes explanation, and coordinate with offices and agencies that will have to enforce whatever passes.
How are privacy and cybersecurity policy connected in Texas?
Texas treated them as related long before they shared a news cycle. Breach reporting, agency data governance, biometric limits, and consumer rights statutes all answer a version of the same question: who may use which information, and what happens when control is lost. A government-affairs strategy that separates them completely will miss amendments that travel from a cyber bill into a privacy bill, or the reverse.
Continue
Related specialties
Facing a Texas policy or legislative issue in data privacy?
Em Dash Strategies helps businesses and organizations understand the landscape, develop a strategy, and navigate Texas government.
Discuss Your Issue