Privacy Law Library

Texas Data Broker Law

Texas Data Broker Law

Data brokers · Data security

Requires data brokers to register annually with the Texas Secretary of State, post a conspicuous data-broker notice, and keep a written comprehensive information security program. The 2025 session broadened the definition of data broker, added a TDPSA-rights link to the registration and website notice, and moved the law from chapter 509 to chapter 510.

Where

Texas

Citation

Tex. Bus. & Com. Code ch. 510 (510.001-510.010) (formerly ch. 509, redesignated 2025)

Status

In force

In force since

2023-09-01

Last amended

2025-09-01

Enforced by

Texas Attorney General; Texas Secretary of State administers registration and the registry

People can sue

No

Penalties

For notice or registration violations, at least $100 per day plus unpaid fees, capped at $10,000 per broker in a 12-month period (510.008); violations are also deceptive trade practices actionable by the attorney general (510.009).

Applies to

• Data brokers: business entities that collect, process, or transfer personal data they did not collect directly from the individual (510.001(4), as broadened by S.B. 2121, 2025)
• Only brokers that in a 12-month period derive more than 50% of revenue from such data, or derive revenue from such data about more than 50,000 individuals (510.003(a))
• Excludes service providers, affiliates sharing data under common control, government entities, and other listed entities; excludes deidentified data, employee data, publicly available information, and GLBA data (510.002(b), 510.003(b))