Law / United States / 
Texas
Texas data broker registration, website notice and civil penalty
Tex. Bus. & Com. Code secs. 510.001-510.006, 510.008
In force since .
A data brokers rule binding private bodies.
- Obligation class
- Licensing, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you are a business entity that collects, processes or transfers personal data you did not collect directly from the individual it is linked to, and in a 12-month period you derive more than 50 percent of your revenue directly from processing or transferring such data or derive revenue directly from the personal data of more than 50,000 individuals not collected from them, register with the Texas secretary of state and pay the $300 fee to conduct business in Texas.
- You are outside the chapter if you are a service provider, a person or entity that collects personal data from another person or entity to which it is related by common ownership or corporate control (provided a reasonable consumer would expect them to share data), a governmental entity, or a congressionally designated nonprofit, national resource center or clearinghouse that assists victims, families, child-serving professionals and the public on missing and exploited children issues.
- You are also outside the chapter if you are a consumer reporting agency or another person or entity that furnishes information for inclusion in a consumer credit report or obtains a consumer credit report, but only to the extent your activity is regulated or authorized by the Fair Credit Reporting Act, or a financial institution subject to Title V of the Gramm-Leach-Bliley Act.
- Do not count as covered personal data deidentified data that meets the chapter's conditions, employee data, publicly available information, inferences made exclusively from multiple independent sources of publicly available information that do not reveal sensitive data, or data subject to Title V of the Gramm-Leach-Bliley Act.
- If you maintain a website or mobile application, post on it a conspicuous notice that states you are a data broker, is clear, not misleading and readily accessible, including to individuals with a disability, uses the language the secretary of state provides by rule, and tells a consumer how to exercise any consumer rights under Chapter 541.
- In the registration statement, give your legal name, a contact person, and your primary physical address, email address, telephone number and website address; a link to a prominently displayed page with specific instructions for exercising consumer rights under section 541.051 and any other applicable rights under Chapter 541; the categories of data you process and transfer; whether you implement a purchaser credentialing process; and the number of security breaches you had in the preceding year and, if known, the number of consumers each affected.
- If you have actual knowledge that you hold personal data of a known child (an individual younger than 13), also state in the registration your data collection practices, databases, sales activities and opt-out policies for it, and how you comply with applicable federal and state law on collecting, using or disclosing a child's personal data on the Internet.
- Keep your registration current: a certificate expires on the first anniversary of its issuance, and renewal takes a renewal application and a $300 fee.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Business and Commerce Code section 510.008(b): the civil penalty for a violation of the notice or registration section may not be less than $100 for each day of violation plus the unpaid registration fees for each year the entity failed to register, and may not exceed $10,000 assessed against the same data broker in a 12-month period. The $100 daily figure is a floor, and the $10,000 figure is the only ceiling the section states.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 10,000
Who enforces it
Enforcement body
Texas Attorney General, in an action to recover the civil penalty under Business and Commerce Code section 510.008(c).
What this law does
A data broker is a business entity that collects, processes or transfers personal data that it did not collect directly from the individual linked or linkable to the data. Personal data excludes deidentified data, employee data and publicly available information.
Chapter 510 applies only to a data broker that, in a 12-month period, derives more than 50 percent of its revenue directly from processing or transferring personal data it did not collect from the individuals, or derives revenue directly from the personal data of more than 50,000 individuals not collected from them.
The chapter does not apply to a service provider, a person or entity that collects personal data from another person or entity related to it by common ownership or corporate control where a reasonable consumer would expect them to share data, a governmental entity, an entity that serves as a congressionally designated nonprofit, national resource center or clearinghouse on missing and exploited children issues, a consumer reporting agency or other person or entity that furnishes information for inclusion in a consumer credit report or obtains a consumer credit report to the extent the Fair Credit Reporting Act regulates it, or a financial institution subject to Title V of the Gramm-Leach-Bliley Act.
The chapter does not apply to deidentified data that meets stated conditions, employee data, publicly available information, inferences made exclusively from multiple independent sources of publicly available information that do not reveal sensitive data, or data subject to Title V of the Gramm-Leach-Bliley Act.
A data broker that maintains a website or mobile application must post a conspicuous notice stating that it is a data broker, using language the secretary of state provides by rule, and telling a consumer how to exercise any consumer rights under Chapter 541. To conduct business in Texas, a data broker must register with the secretary of state by filing a registration statement and paying a registration fee of $300.
The registration statement gives the broker's legal name and contact details, a link to its consumer-rights instructions, the categories of data it processes and transfers, whether it uses a purchaser credentialing process, its practices for the data of a known child, and the number of security breaches it had in the preceding year. A registration certificate expires on the first anniversary of its issuance and is renewed by filing a renewal application and paying a renewal fee of $300.
A data broker that violates the notice or registration section is liable to the state for a civil penalty of at least $100 for each day of violation plus the unpaid registration fees for each year it failed to register, and the penalty may not exceed $10,000 against the same data broker in a 12-month period. The attorney general may bring an action to recover the civil penalty, and may recover reasonable attorney's fees and court costs.
As enacted in 2023 the definition reached only a business entity whose principal source of revenue is derived from collecting, processing or transferring personal data it did not collect directly from the individual. Senate Bill 2105 of 2023 added the chapter, then numbered 509, effective , and applied it only to data collected, processed or transferred on or after .
House Bill 1620 of 2025 redesignated the chapter from Chapter 509 to Chapter 510, effective . Senate Bill 2121 of 2025 amended the chapter, effective . Senate Bill 1343 of 2025 amended the chapter, effective .
When LexLint raises it
When your app profile says your app tracks devices.