Texas data broker law

Texas' data broker law (Senate Bill 2105, 2023, Business and Commerce Code Chapter 509) requires data brokers to register with the Secretary of State, post a prominent notice on their website and apps, and maintain a comprehensive information security program. The Attorney General enforces it and has opened investigations into data brokers.

• Data brokers: businesses whose principal source of revenue comes from collecting, processing or transferring personal data they did not collect directly from the individual, or that meet the law's volume test.
• Exclusions include consumer reporting agencies under the Fair Credit Reporting Act, financial institutions under the Gramm-Leach-Bliley Act, and some businesses that only process data of their own customers or employees.

The Attorney General can seek civil penalties, including per-day penalties for failing to register subject to an annual cap, and injunctions. A violation is also a deceptive trade practice.

1. Check the definition against your revenue sources and the data you buy or license.
2. Register with the Secretary of State each year and pay the fee.
3. Post the required notice clearly on your website and mobile apps.
4. Maintain a written information security program with administrative, technical and physical safeguards.
5. Watch Attorney General activity; it has targeted brokers selling location and sensitive data.