ComplyRoom US REGULATORY TRACKERGet deadline alerts
Dated research · 63 rules · 20 states · Data cutoff
AI & Privacy/Texas/SB2105 (2023); Business&CommerceCodeCh509

Texas data broker registration and security

Enacted in force

Jurisdiction
Texas [source]
Applies to
Covered data brokers whose principal revenue is from indirect-source personal data and that, over12months, derive more than50% of revenue from processing/transferring such data or derive revenue from doing so for more than50,000 Texas individuals; statutory data/entity exemptions apply. [source]
Penalty
Notice/registration violations: at least $100 per day plus unpaid fees, with a $10,000 cap for the same broker in12months; security-program violations are deceptive trade practices. [source]
Detail review
Accepted record facts reviewed
Nov 13, 2026

Fields requiring verification

  • enforcement date: Unverified — No distinct enforcement-start date was established. Primary source

In plain English

  • Covered data brokers whose principal revenue is from indirect-source personal data and that, over12months, derive more than50% of revenue from processing/transferring such data or derive revenue from doing so for more than50,000 Texas individuals; statutory data/entity exemptions apply. Primary source
  • Register with the secretary of state to conduct covered business, pay the statutory $300 fee and renew on the registration anniversary. Primary source
  • Post the required conspicuous data-broker notice on a maintained website or mobile app. Primary source
  • Maintain a written comprehensive information-security program with administrative, technical and physical safeguards. Primary source

Dates and phased obligations

Act effective2023-09-01; covered processing from2023-12-01; initial registration timing subject to implementing rules Primary source

· operative
Act effective2023-09-01; covered processing from2023-12-01; initial registration timing subject to implementing rules Primary source

Act legal-effective date2023-09-01; Chapter509 applies to processing from2023-12-01. Section2 required registration rules by2023-12-01 with adequate compliance time. This row does not invent a first registration deadline from the processing date. Source and qualifications

Questions from this record

Who does SB2105 (2023); Business&CommerceCodeCh509 cover?

Covered data brokers whose principal revenue is from indirect-source personal data and that, over12months, derive more than50% of revenue from processing/transferring such data or derive revenue from doing so for more than50,000 Texas individuals; statutory data/entity exemptions apply. Primary source

What is the law’s status?

Enacted / in force Primary source

What date does this record track?

Act effective2023-09-01; covered processing from2023-12-01; initial registration timing subject to implementing rules Primary source

Has this record been verified?

This record’s accepted facts were last reviewed on 2026-11-13; unsupported comparison fields remain Unverified. Primary source

Primary sources

Verification history

  • — Facts and dates reconciled from the accepted T1 report. Source
  • — Accepted T1 report content changed. Source

Not legal advice. This page restates the linked record and does not determine whether a particular business is covered. Methodology and verification limits.

Compare the tracked rulesDates, coverage, and sources in one quarterly file.
View the matrix