Texas data broker law
Texas data broker law (SB 2105)
Registration, website notices and a security program for data brokers.
The law in brief
Texas' data broker law (Senate Bill 2105, 2023, Business and Commerce Code Chapter 509) requires data brokers to register with the Secretary of State, post a prominent notice on their website and apps, and maintain a comprehensive information security program. The Attorney General enforces it and has opened investigations into data brokers.
Who it applies to
- Data brokers: businesses whose principal source of revenue comes from collecting, processing or transferring personal data they did not collect directly from the individual, or that meet the law's volume test.
- Exclusions include consumer reporting agencies under the Fair Credit Reporting Act, financial institutions under the Gramm-Leach-Bliley Act, and some businesses that only process data of their own customers or employees.
What it requires
Register with the Secretary of State
Register before collecting, processing or transferring personal data as a data broker in Texas, and renew annually.
Post a notice
Post a clear and conspicuous notice on your website or mobile application that you are a data broker, in the form the statute requires.
A comprehensive security program
Develop, implement and maintain a written information security program appropriate to your size, the volume of data and its sensitivity.
Enforcement and penalties
The Attorney General can seek civil penalties, including per-day penalties for failing to register subject to an annual cap, and injunctions. A violation is also a deceptive trade practice.
What's changing
Amended in 2025. Legislation in 2025 broadened who counts as a data broker and added requirements. Check the current definition before concluding you are outside it.
What to do first
- Check the definition against your revenue sources and the data you buy or license.
- Register with the Secretary of State each year and pay the fee.
- Post the required notice clearly on your website and mobile apps.
- Maintain a written information security program with administrative, technical and physical safeguards.
- Watch Attorney General activity; it has targeted brokers selling location and sensitive data.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Sources
- Texas Business and Commerce Code Chapter 509, Data Brokers Texas Legislature · Official text or regulator
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws