Texas vs California: how state attorneys general enforce corporate ethics

What to take away

How Texas and California attorneys general build corporate misconduct cases

State attorneys general are the most active corporate enforcers most companies never plan for. They open cases from consumer complaints, whistleblower tips, multistate coordination and their own market monitoring.

The Texas Attorney General's Consumer Protection Division handles most corporate misconduct matters. It can open an investigation on its own initiative, issue a civil investigative demand, and sue under the Texas Deceptive Trade Practices Act, known as the DTPA.

The California Attorney General's Public Rights Division houses the Consumer Law Section, the Privacy Enforcement and Protection Unit and the Environmental Section. California's attorney general also sits on the state's privacy agency board and can bring actions under the Unfair Competition Law and the False Advertising Law.

Both offices coordinate through the National Association of Attorneys General, which lets a single state investigation become a multistate compliance problem. Federal agencies often run parallel tracks, and the Federal Trade Commission's enforcement program is the template many state offices follow on deceptive claims.

A case usually starts with a demand for documents, not a lawsuit. The investigative demand is broad, and the response becomes the record both sides argue from. Attorney general investigations rarely end in a public trial, but the documents produced in them travel.

Texas enforcement priorities: consumer protection, data and environmental claims

Texas attorney general enforcement priorities center on consumer deception, data security, environmental compliance and public fund management. The office has been among the most active states on financial marketing claims.

In 2024 Attorney General Ken Paxton sued BlackRock, State Street and Vanguard, three of the largest institutional investors, alleging that they conspired to artificially constrict the market for coal through anticompetitive trade practices. The case treats climate commitments by asset managers as conduct to be tested under state and federal law, not as a policy dispute.

Texas has also pursued major opioid manufacturers and distributors over marketing and distribution practices, including through the national settlements with the distributors McKesson, Cardinal Health and AmerisourceBergen and the manufacturer Johnson & Johnson, and has pursued data breach cases under the state's identity theft statute. Those cases produced consent terms that other states copied.

Data breach notification in Texas sits in the Business and Commerce Code, chapter 521. The office has treated delayed or incomplete notification as an independent violation, separate from the breach itself.

Environmental claims draw attention when a company markets a product as clean or sustainable without support. Texas has joined multistate actions against emissions defeat device makers, and it has taken its own actions on industrial air and water violations.

Public pension exposure matters in Texas. The attorney general can act on behalf of state retirement systems, which turns an investment marketing claim into a fiduciary issue for the fund board.

California enforcement priorities: privacy, climate and consumer statutes

California attorney general enforcement priorities run through privacy, climate, consumer protection and civil rights. The office has more statutory tools than most states and uses them in combination.

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives the attorney general civil penalty authority for violations affecting consumers. The office has settled with companies that failed to honor opt-out requests, starting with the retailer Sephora in 2022 and including a later settlement in which Disney agreed to implement opt-out methods that fully stop its sale or sharing of consumers' personal information.

In 2023 California sued ExxonMobil, Shell, Chevron, ConocoPhillips, BP and the American Petroleum Institute over climate deception, alleging decades of misleading statements about fossil fuel products. The case seeks abatement funds and injunctive relief, and it has drawn parallel actions from other states and cities.

Emissions cheating produced one of the largest state settlements in California history, over Volkswagen's diesel defeat devices. The state's Air Resources Board and the attorney general worked the case alongside federal regulators, and the resulting consent decree set compliance expectations for the whole auto industry.

California also enforces its False Advertising Law and Unfair Competition Law against companies that make unsupported environmental or health claims. The office has targeted recycling claims, carbon neutrality claims and green labels that lack substantiation.

The office runs a separate Charitable Trusts section, which polices nonprofit and corporate giving claims. That matters for companies that market a purchase as supporting a cause. Customer ethics questions about cause marketing usually start here.

Statutes each office relies on, from state deceptive trade laws to environmental codes

The two offices share a broad theory of deception but work from different code books. The table below maps the main tools.

Texas also uses its Deceptive Trade Practices Act against insurance and financial services claims, and it can seek penalties for each affected consumer. California's Unfair Competition Law allows restitution and injunctive relief, and the False Advertising Law adds penalties for misleading advertising.

California's climate disclosure statutes, SB 253 and SB 261, require large companies doing business in the state to report greenhouse gas emissions and climate-related financial risks. Those reports create a paper trail that the attorney general can compare against marketing claims.

Both states sit inside federal frameworks. The Environmental Protection Agency's enforcement program sets the baseline that state environmental actions build on, and state offices often coordinate with EPA regional staff.

Workplace safety is a separate track. Texas and California both run OSHA-approved state plans, which means state agencies, not federal OSHA, inspect most private workplaces and set many of the penalties a company will actually face.

Recent actions and what they signal for multistate employers

Recent enforcement actions show both offices willing to test new theories and to coordinate across state lines.

Texas sued BlackRock, State Street and Vanguard in 2024 over their coordinated climate commitments, framing them as an anticompetitive scheme affecting the coal market. The case signaled that public commitments, not just conduct, are the target.

California's privacy settlements, from Sephora to Disney, turned on opt-out requests the companies failed to honor. The terms required changes to how each company handled privacy requests, not just a payment.

Both states joined multistate actions against opioid manufacturers and distributors. Those cases produced global settlements funded by state allocations, and they showed how a single state's investigation can pull in dozens of others.

California's climate suit against oil majors continues, and its outcome will shape how far state deception law can reach into national climate messaging. Texas has moved in the opposite direction on financial sector climate commitments, investigating whether net-zero pledges by banks and asset managers violate state law.

For multistate employers, the signal is that the same marketing sentence can be lawful in one state and actionable in the other. Supplier ethics claims travel the same way when a vendor's conduct is attributed to the buyer.

Comparing legal tools: investigative demands, penalties and injunctive relief

Both offices can compel documents, seek civil penalties and ask a court for injunctive relief. The differences are in scope, private enforcement and penalty design.

Texas issues civil investigative demands under its consumer protection statute. The demand can cover a broad set of documents, and failure to comply can lead to court enforcement. Texas penalties under the DTPA are set per violation, which lets the office multiply exposure by counting affected consumers.

California issues investigative demands and subpoenas, and its Unfair Competition Law allows courts to order restitution and injunctions. The False Advertising Law adds civil penalties per violation. Private plaintiffs can sue under the same statutes, which means a company can face parallel public and private cases.

California also has a private right of action under the Consumer Privacy Act for certain data breaches, which changes the risk calculation for security incidents. Texas has no equivalent general private right of action under the DTPA for most business defendants, though other statutes create specific ones.

Injunctive relief is where the two offices converge. Both seek consent judgments that govern future conduct, require compliance programs and impose reporting obligations. Those terms often outlast the penalty and apply nationwide.

Federal enforcement runs alongside both. The Department of Justice and the Securities and Exchange Commission pursue parallel corporate misconduct cases, and OSHA enforcement data feeds into how state offices evaluate safety culture during investigations.

What a company operating in both states should document now

Documentation is the defense. Both offices build cases from what a company said and when it said it, so the record should exist before the demand arrives.

A worked example shows why this matters. Suppose a retailer markets a product line as carbon neutral in both states. California can test the claim under its False Advertising Law and climate disclosure statutes.

Texas can test the same claim under the DTPA if the substantiation is thin or the offset accounting is unclear. One marketing sentence, two statutes, two penalty calculations.

The practical checklist before either office calls:

Compliance teams should also watch the federal layer. The EPA's compliance assistance resources set expectations that state environmental actions often mirror, and the FTC's approach to deceptive claims is the model state consumer protection offices follow.

Board reporting matters too. Corporate Political Spending Disclosure and employee ethics programs both generate records that attorneys general can request, so the quality of those records shapes the response.

Common questions