SB2121

A data broker is now a business entity that collects, processes or transfers personal data it did not collect directly from the individual linked or linkable to that data. Previously, deriving the entity’s principal revenue from that activity was part of the definition itself. Removing that condition prevents it from separately excluding a business that meets the chapter’s other coverage test. Final law, section 1; Previous definition.

The separate coverage test remains. During a 12-month period, the broker must derive either more than 50% of its revenue directly from processing or transferring indirectly collected personal data, or revenue directly from processing or transferring such data concerning more than 50,000 individuals. These are alternatives, not cumulative requirements. Both thresholds say “more than,” not “at least”; the volume route still requires revenue from the activity, not simply possessing 50,001 records. “Individual” in this chapter means a Texas resident. Final law, section 2; Definitions; Coverage and exemptions.

Existing exclusions remain important. The chapter excludes defined service providers, certain expected sharing within common ownership or control, government entities and the specified missing-and-exploited-children resource entity. It also has exemptions tied to specified federal credit-reporting activity and financial institutions; those are not blanket permission for every business with a financial connection. Data exclusions separately address employee information, publicly available information, qualifying deidentified data and other listed categories. SB2121 does not repeal these conditions or decide a particular company’s eligibility. Definitions and service-provider scope; Data exclusions; Full entity exclusions.

The practical consequence is coverage by the existing data-broker framework: registration with the secretary of state, website or app notice where applicable, inclusion in the registry and a written information-security program. The existing registration and annual renewal fees remain $300 each; SB2121 does not create or raise them. Existing enforcement provisions also remain. It changes who can fall within this framework, not every consumer’s rights under all Texas privacy laws. Website/app notice; Registration and fees; Public registry; Security program; Existing notice/registration enforcement; Existing security-program enforcement.

Changes during passage: The introduced bill changed the coverage provision’s references from “data broker” to “business entity.” The Senate substitute instead broadened the data-broker definition and kept that term in the coverage test. The Senate-passed text matched the substitute. The House substitute then added “directly” before revenue in both coverage alternatives; that limitation survived in the final law. The House and enrolled texts match. The official amendment index lists no separate floor amendments, while the history records Senate concurrence in the House change May 31. Introduced; Senate substitute; Senate-passed; House substitute; Final law; Version index; Amendment index.

The act refers to the data-broker provisions as Chapter 509 and calls for coordination with the 2025 code-corrections act. The official statute history confirms that HB1620 renumbered them as Chapter 510 on the same effective date, incorporating SB2121’s changes. Separate additions about instructions for exercising consumer privacy rights came from SB1343, not SB2121. Final law, section 3; Renumbering history; Separate SB1343 notice amendment; Separate SB1343 registration amendment.

Compare the published text versions in the official text index. A change is not attributed to a specific amendment here without a verified record.

The law may bring additional businesses with substantial third-party-data activity into registration, transparency and security obligations even when that activity is not their principal revenue source. Businesses must examine direct revenue, affected Texas residents and exemptions rather than rely solely on their business label. This can add compliance work and fees for newly covered entities; it does not guarantee that fewer breaches occur or that every data sale is prohibited. Final law; Coverage limits; Existing fees.

The May 15 House-substitute fiscal note anticipates no state or local fiscal impact; the April 15 Senate-substitute and April 9 introduced notes agree. Those are government-budget estimates, not a calculation of private compliance costs or the number of newly covered companies. The act makes no appropriation. House fiscal note; Senate fiscal note; Introduced fiscal note.