Tracks devices, in Texas

Tex. Penal Code § 16.03 · Read the law's page

• Do not knowingly install or use a pen register or trap and trace device to record or decode electronic or other impulses for the purpose of identifying telephone numbers dialed or otherwise transmitted on a telephone line.
• It is a defense that you are a communication common carrier's officer, employee or agent recording numbers in the normal course of the carrier's business to protect its property or services or to assist a peace officer you reasonably believe is authorized, an officer, employee or agent of a lawful enterprise acting as a necessary incident to its services or the protection of its property and not to gather information for a law enforcement or private investigative agency (other than about theft of its communication or information services), or a person authorized under Code of Criminal Procedure chapter 18B.

Tex. Bus. & Com. Code sec. 521.052 · Read the law's page

• This binds any business that collects or maintains sensitive personal information (an individual's name combined with a Social Security number, driver's license or government-issued identification number, or a financial account, credit, or debit card number together with any required access code; or information that identifies an individual and relates to the individual's physical or mental health, health care, or payment for health care) in the regular course of business; a financial institution as defined by 15 U.S.C. § 6809 is exempt.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect that sensitive personal information from unlawful use or disclosure. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy or arrange for the destruction of customer records containing sensitive personal information no longer to be retained, by shredding, erasing, or otherwise modifying the information to make it unreadable or indecipherable through any means.
• There is no private right of action for a violation of this duty; only the attorney general may enforce it, seeking a civil penalty of $2,000 to $50,000 per violation and injunctive relief under Section 521.151.

Consumer Protection Against Computer Spyware Act, Tex. Bus. & Com. Code ch. 324 · Read the law's page

• If you are not the owner or operator of a computer (its owner or lessee, or an individual using it with the owner's or lessee's authorization), do not knowingly cause software to be copied to a computer in Texas and use it to do any of the acts below; you act knowingly if you have actual knowledge of the facts that constitute the violation or consciously avoid information that would establish that knowledge, and causing software to be copied means distributing or transferring it or a component of it, not merely transmitting, routing, caching, hosting through a website or giving a link to it.
• Do not use that software to collect personally identifiable information (a name, home address, e-mail address, card or bank account number, password or access code, government identification number, or account balances, overdraft history or payment history that identify the person) through intentionally deceptive means by a keystroke-logging function that records all keystrokes and transfers them to another person, or in a manner that correlates it with all or substantially all of the websites the owner or operator visits other than your own.
• Do not use that software to cull, through intentionally deceptive means, a card number, bank account number, password or access code for a card or bank account, social security number, account balance or overdraft history from the hard drive for a purpose wholly unrelated to any purpose of the software or service you described to the owner or operator.
• Do not use that software to modify, through intentionally deceptive means, the page that appears when an Internet browser is launched, the default provider or web proxy used to access or search the Internet, or the list of bookmarks.
• Do not use that software to take control of the computer by using its modem or Internet service to cause damage or to make the owner, operator or a third party incur financial charges for a service not previously authorized, or by opening, without the owner's or operator's consent, advertisements in multiple, sequential or stand-alone form that an ordinarily reasonable person cannot close without closing the browser or shutting down the computer.
• Do not use that software to modify settings that relate to access to or use of the Internet and the protection of information for the purpose of stealing the owner's or operator's personally identifiable information, or security settings for the purpose of causing damage to one or more computers.
• Do not use that software to prevent, through intentionally deceptive means, the owner's reasonable efforts to block or disable software by making software the owner has properly removed or disabled reinstall or reactivate itself; do not misrepresent to another that software will be uninstalled or disabled by the owner's actions; do not remove, disable or render inoperative, through intentionally deceptive means, security, antispyware or antivirus software; do not offer an option to decline installation knowing the installation will proceed anyway, or misrepresent that software has been disabled; and do not change the software's name, location or other designation, or create randomized or deceptive file names, folders, formats or registry entries, to keep the owner from locating or removing it.
• Do not induce the owner or operator of a computer in Texas to install a software component by intentionally misrepresenting the extent to which installation is necessary for security or privacy reasons, to open or view text, or to play musical or other content, and do not copy and execute, or cause the copying and execution of, a software component in a deceptive manner with the intent that the owner or operator use it in a way that violates the chapter.
• Do not knowingly cause or offer to cause a computer you do not own or operate to become a zombie or part of a botnet (a computer compromised without the owner's or operator's knowledge and consent so that a program or person other than the owner or operator has access or control); do not knowingly create, have created, use or offer to use a zombie or botnet to send unsolicited commercial electronic mail, cause a loss of service, send data from a computer without the owner's or operator's authorization, forward software designed to damage or disrupt another computer or system, collect personally identifiable information, or perform an act for another purpose the owner or operator has not authorized; and do not purchase, rent or otherwise gain control of a zombie or botnet created by another person, or sell, lease or otherwise provide another person access to or use of one.
• Section 324.052 other than its subdivision (1), section 324.053(4), section 324.054 and section 324.055 do not apply to a telecommunications carrier, cable operator, computer hardware or software provider, or provider of information service or interactive computer service that monitors or interacts with a subscriber's Internet or other network connection or service, or a protected computer, for a network or computer security purpose, diagnostics, technical support or repair, an authorized update of software or system firmware, authorized remote system management, or detection or prevention of unauthorized use or of fraudulent or other illegal activity, including scanning for and removing software the chapter proscribes.

Tex. Bus. & Com. Code secs. 510.001-510.006, 510.008 · Read the law's page

• If you are a business entity that collects, processes or transfers personal data you did not collect directly from the individual it is linked to, and in a 12-month period you derive more than 50 percent of your revenue directly from processing or transferring such data or derive revenue directly from the personal data of more than 50,000 individuals not collected from them, register with the Texas secretary of state and pay the $300 fee to conduct business in Texas.
• You are outside the chapter if you are a service provider, a person or entity that collects personal data from another person or entity to which it is related by common ownership or corporate control (provided a reasonable consumer would expect them to share data), a governmental entity, or a congressionally designated nonprofit, national resource center or clearinghouse that assists victims, families, child-serving professionals and the public on missing and exploited children issues.
• You are also outside the chapter if you are a consumer reporting agency or another person or entity that furnishes information for inclusion in a consumer credit report or obtains a consumer credit report, but only to the extent your activity is regulated or authorized by the Fair Credit Reporting Act, or a financial institution subject to Title V of the Gramm-Leach-Bliley Act.
• Do not count as covered personal data deidentified data that meets the chapter's conditions, employee data, publicly available information, inferences made exclusively from multiple independent sources of publicly available information that do not reveal sensitive data, or data subject to Title V of the Gramm-Leach-Bliley Act.
• If you maintain a website or mobile application, post on it a conspicuous notice that states you are a data broker, is clear, not misleading and readily accessible, including to individuals with a disability, uses the language the secretary of state provides by rule, and tells a consumer how to exercise any consumer rights under Chapter 541.
• In the registration statement, give your legal name, a contact person, and your primary physical address, email address, telephone number and website address; a link to a prominently displayed page with specific instructions for exercising consumer rights under section 541.051 and any other applicable rights under Chapter 541; the categories of data you process and transfer; whether you implement a purchaser credentialing process; and the number of security breaches you had in the preceding year and, if known, the number of consumers each affected.
• If you have actual knowledge that you hold personal data of a known child (an individual younger than 13), also state in the registration your data collection practices, databases, sales activities and opt-out policies for it, and how you comply with applicable federal and state law on collecting, using or disclosing a child's personal data on the Internet.
• Keep your registration current: a certificate expires on the first anniversary of its issuance, and renewal takes a renewal application and a $300 fee.

Tex. Bus. & Com. Code secs. 510.007, 510.009 · Read the law's page

• If you are a data broker conducting business in Texas that meets the revenue thresholds of section 510.003, develop, implement and maintain a comprehensive written information security program with administrative, technical and physical safeguards appropriate for your size, scope and type of business, your resources, the amount of data you store and the need for security and confidentiality of the personal data.
• Designate one or more employees to maintain the program, identify and assess reasonably foreseeable internal and external risks to records containing personal data, train employees and contractors, require employee compliance, and provide discipline for violations.
• Make the program's safeguards consistent with the safeguards for protection of personal data and information of a similar character under the state or federal laws and regulations that apply to you.
• Provide a means for detecting and preventing security system failures.
• Adopt security policies for your employees on the storage, access and transportation of records containing personal data outside your physical business premises.
• Include measures that prevent a terminated employee from accessing records containing personal data.
• Place reasonable restrictions on physical access to records containing personal data, including by storing the records in a locked facility, storage area or container.
• Monitor the program regularly to ensure it operates in a manner reasonably calculated to prevent unauthorized access to or unauthorized use of personal data, and upgrade your information safeguards as necessary to limit that risk.
• Supervise third-party service providers: take reasonable steps to select and retain providers capable of maintaining appropriate security measures, and require them by contract to implement and maintain those measures.
• Review the scope of the program's security measures at least annually and whenever a material change in your business practices may reasonably affect the security or integrity of records containing personal data.
• Document the responsive actions taken in connection with any breach of security, including a post-incident review of each event and the changes made to business practices in response.
• To the extent technically feasible, use secure user authentication, secure access controls, encryption of records that travel across public networks or wirelessly and of personal data stored on laptops or portable devices, system monitoring, current firewall protection and operating system patches, and current malware protection.

Tex. Bus. & Com. Code ch. 542 (secs. 542.001-542.004) · Read the law's page

• This chapter applies only to a business entity with fewer than 250 employees that owns or licenses computerized data including sensitive personal information, as those terms are defined by Section 521.002.
• It is a safe harbor, not a duty: if such an entity is sued over a breach of system security and demonstrates that, at the time of the breach, it had implemented and maintained a cybersecurity program meeting Section 542.004's requirements, the claimant may not recover exemplary damages from it. A qualifying program must contain administrative, technical, and physical safeguards; conform to a named industry-recognized cybersecurity framework (the NIST Cybersecurity Framework, NIST SP 800-171, NIST SP 800-53/53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, the ISO/IEC 27000-series, the HITRUST Common Security Framework, the Secure Controls Framework, SOC 2, or a similar framework); and be scaled by headcount: simplified measures such as password policies and employee training below 20 employees, the CIS Controls Implementation Group 1 from 20 to 99 employees, and full conformance with a named framework from 100 to 249 employees.
• The chapter creates no duty to adopt a program and no cause of action of its own; it only removes exemplary-damages exposure for a qualifying entity that already has one at the time of a breach.