Texas Broadens and Alters Data Collector Registration Regulations

Texas Strengthens Data Privacy Laws: Companies Urged to Review Practices

On June 20, 2025, the Texas Governor signed two bills, SB 2121 and SB 1343, amending the Texas Data Broker Act. These changes, which went into effect on September 1, 2025, expand the law's scope and increase the focus on data privacy.

The Texas Attorney General's office, one of the top data privacy regulators in the country, now has the power to enforce the Texas Data Broker Act. This includes scrutinizing a company's overall operations based on noncompliance or delayed compliance. The cost of noncompliance under the Texas Data Broker Act is $100 per day for each day the data broker is violating the law, not to exceed $10,000 in a 12-month period.

SB 2121 expands the definition of "data broker" to include businesses that collect, process, or transfer personal data not collected directly from the individual, with certain exclusions. This means that entities that had previously concluded they were not required to register in Texas may now fall under the law's scope.

Data brokers are required to protect personal data and implement certain safeguards under the Texas Data Broker Act. They are also required to post a conspicuous notice on their websites or mobile apps identifying themselves as data brokers. This notice must contain language provided by rule of the secretary of state for inclusion and inform a consumer how to exercise any consumer rights they may have under Chapter 541.

The notice must be clear, not misleading, and readily accessible to the general public, including individuals with a disability. SB 1343 requires data brokers to provide information on their websites and registration statements about consumer privacy rights under the Texas Data Privacy and Security Act.

Entities that may now fall under the Texas Data Broker Act due to changes in laws SB 2121 and SB 1343 include certain data brokers and businesses that collect, purchase, or sell personal data without direct consumer interaction, especially those handling sensitive personal information in Texas. Companies should evaluate their data collection practices to assess whether they now fall within the statute's scope.

The Texas Attorney General's office has actively reached out to companies for failing to register in Texas. It is crucial for businesses to comply with these new regulations to avoid potential fines and maintain the trust of their customers.