“Individuals own the personal data generated by them, about them, or attributable to them. Companies don't own it. People own it.”
Texas Insider Report: AUSTIN, Texas – Texas lawmakers examining the state's landmark data privacy law heard a remarkably consistent message Wednesday: the next step in protecting Texans online may be treating personal data like private property.
House Delivery of Government Efficiency Committee Chairman Giovanni Capriglione convened an interim hearing Wednesday to study the implementation and effectiveness of the Texas Data Privacy and Security Act and determine whether the law provides adequate protection for Texas residents and businesses. The hearing was part of the committee's official interim charge on data privacy and security.
Witnesses repeatedly praised Capriglione's Texas Data Privacy and Security Act as a major achievement that established Texas as a national leader on privacy, while arguing that rapidly changing technology, particularly artificial intelligence, has created an opportunity to build on that foundation.
The central question that emerged was deceptively simple: Who owns your data?
Ron Yokubaitis, co-founder of Texas.net and Data Foundry, argued that Texas should become the first state to clearly recognize personal data as the property of the individual who generates it.
“Texas has spent nearly two centuries defending one simple principle: If it's yours, you should own it,” Yokubaitis told the committee. “Individuals own the personal data generated by them, about them, or attributable to them. Companies don't own it. People own it.” Yokubaitis stressed that such a framework would not prevent technology companies from using data or offering free services. Instead, consumers would remain owners while granting companies permission to use their information for agreed purposes, much like other forms of private property.
Scott McCullough, general counsel for Texas.net, provided the legal argument behind that approach.
“The data you create, the data that's about you is your property,” McCullough said. “Not the platforms, not the brokers, not the governments, yours.”
McCullough noted that Texas law already incorporates property concepts into the digital world, including provisions treating data as property and technology companies as custodians of digital assets. He argued that a property framework could provide greater certainty than the decades-old legal test asking whether an individual has a “reasonable expectation of privacy.”
“Property asks the question courts know how to understand,” McCullough said. “Whose is it? Simple question. That's the virtue of property.”
Joel Thayer, president of the Digital Progress Institute, approached the issue from the economics of the modern internet. He argued that current privacy rules have failed to properly align incentives because personal information has become an enormously valuable asset to technology companies.
“The answer should be obvious: us,” Thayer said when asking who should own personal data. “We own the data, not the tech companies.”
He suggested policymakers consider mechanisms that give consumers greater control—and potentially compensation—when companies monetize their information.
A recent report by the Web3 Foundation estimated that an American’s personal data generates roughly $6500 in commercial value each year—nearly $400,000 over a 60-year digital lifetime. The estimate underscores the economic stakes behind what can otherwise seem like an abstract privacy debate.
David Dunmoyer of the Texas Public Policy Foundation similarly argued that Texas should “flip the script” from a system in which consumers must continually ask companies not to use their information.
Dunmoyer noted that TPPF had raised the property concept years earlier while developing recommendations for a Texas digital bill of rights: “The legislature should codify data as property of the user to acquire, use and dispose freely of this digital property.” He added that the principle “holds even truer today in the days of AI than it did in 2022.”
The discussion quickly caught lawmakers' attention.
Rep. Tony Tinderholt expressed surprise at how companies use consumer information, remarking that some of it “truly should be my data.” Rep. Briscoe Cain questioned why consumers should have to rely on private companies to resist government demands for their information.
That question followed Yokubaitis' account of operating data centers, where he said government entities sometimes requested customer information without first presenting a warrant. Yokubaitis said his companies insisted that government obtain appropriate legal authority, but warned that consumers should not have to depend on every technology company making the same decision.
Committee members also wrestled with how property rights would interact with existing contracts, what types of information should qualify as personal data, and how rapidly advancing AI is making supposedly anonymous information increasingly easy to reconnect to an individual.
By the end of the panel, the property-rights concept had clearly resonated.
After discussing existing protections for sensitive location information, Rep. Rhetta Bowers member thanked the witnesses “for seeing data as property rights.”
The testimony suggested a potential direction for the 2027 Legislature: rather than replacing the Texas Data Privacy and Security Act, lawmakers could build upon Capriglione's framework by answering the ownership question the current law leaves unresolved.
For Yokubaitis, the answer is straightforward: “If it's yours, you should own it.”
