What Is
What Is the Texas Data Broker Law
The Texas data broker law, Business and Commerce Code chapter 510, regulates businesses that collect, process, or transfer personal data they did not collect directly from the people the data identifies (§510.001(4)). It was enacted in 2023 as SB 2105 and took effect September 1, 2023. In 2025, HB 1620 moved it from chapter 509 to chapter 510, and SB 2121 and SB 1343 amended it; all three changes took effect September 1, 2025.
The chapter applies to a data broker that, in a 12-month period, derives more than half its revenue directly from processing or transferring indirectly collected personal data, or derives revenue directly from processing or transferring such data about more than 50,000 Texas residents (§§510.001(9), 510.003(a)). Entity and activity exemptions include service providers, governmental entities, and qualifying GLBA financial institutions. The FCRA exemption covers consumer reporting agencies and specified furnishers or users only to the extent they engage in activity regulated or authorized by that Act (§510.003(b)(5)). Employee data and publicly available information are among the excluded data (§510.002).
A covered data broker must:
- post a clear, conspicuous notice on its website or app stating that it is a data broker, using language set by Secretary of State rule and explaining how consumers can exercise their rights under the Texas Data Privacy and Security Act (§510.004);
- register with the Secretary of State and pay a $300 fee; the registration certificate expires on the first anniversary of its date of issuance, and the broker may renew it by filing a renewal application and paying a $300 renewal fee (§510.005); the Secretary of State keeps a public, searchable registry (§510.006); and
- maintain a written, comprehensive information security program with administrative, technical, and physical safeguards suited to its size and data (§510.007).
The Attorney General may sue for civil penalties for notice and registration violations: at least $100 a day plus unpaid fees, capped at $10,000 against one broker in a 12-month period (§510.008). A failure to maintain the security program is a deceptive trade practice actionable under the DTPA (§510.009).
Pinpoint: Tex. Bus. & Com. Code ch. 510. Related term: Data broker (Texas data broker law).