By: Johnson S.B. No. 1343
(In the Senate - Filed February 18, 2025;
February 28, 2025, read first time and referred to Committee on
Business & Commerce; March 19, 2025, reported favorably by the
following vote: Yeas 10, Nays 0; March 19, 2025, sent to printer.)
Click here to see the committee vote
A BILL TO BE ENTITLED
AN ACT
relating to the notice requirements of a data broker registration
statement and Internet website.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:
SECTION 1. Section 509.004, Business & Commerce Code, as
added by Chapter 963 (S.B. 2105), Acts of the 88th Legislature,
Regular Session, 2023, is amended to read as follows:
Sec. 509.004. NOTICE ON WEBSITE OR MOBILE APPLICATION. A
data broker that maintains an Internet website or mobile
application shall post a conspicuous notice on the website or
application that:
(1) states that the entity maintaining the website or
application is a data broker;
(2) is clear, not misleading, and readily accessible
by the general public, including individuals with a disability;
[and]
(3) contains language provided by rule of the
secretary of state for inclusion in the notice; and
(4) informs a consumer how to exercise any consumer
rights the consumer may have under Chapter 541.
SECTION 2. Section 509.005(b), Business & Commerce Code, as
added by Chapter 963 (S.B. 2105), Acts of the 88th Legislature,
Regular Session, 2023, is amended to read as follows:
(b) The registration statement must include:
(1) the legal name of the data broker;
(2) a contact person and the primary physical address,
e-mail address, telephone number, and Internet website address for
the data broker;
(2-a) a link to a page on the data broker's Internet
website that provides consumers with specific instructions, which
must be prominently displayed, on how to exercise their consumer
rights under Section 541.051, and any other applicable data privacy
rights under Chapter 541;
(3) a description of the categories of data the data
broker processes and transfers;
(4) a statement of whether or not the data broker
implements a purchaser credentialing process;
(5) if the data broker has actual knowledge that the
data broker possesses personal data of a known child:
(A) a statement detailing the data collection
practices, databases, sales activities, and opt-out policies that
are applicable to the personal data of a known child; and
(B) a statement on how the data broker complies
with applicable federal and state law regarding the collection,
use, or disclosure of personal data from and about a child on the
Internet; and
(6) the number of security breaches the data broker
has experienced during the year immediately preceding the year in
which the registration is filed, and if known, the total number of
consumers affected by each breach.
SECTION 3. Section 509.005(b), Business & Commerce Code, as
amended by this Act, applies only to a registration statement
submitted on or after the effective date of this Act.
SECTION 4. It is the intent of the 89th Legislature, Regular
Session, 2025, that the amendments made by this Act to Sections
509.004 and 509.005(b), Business & Commerce Code, be harmonized
with another Act of the 89th Legislature, Regular Session, 2025,
relating to nonsubstantive additions to and corrections in enacted
codes.
SECTION 5. This Act takes effect September 1, 2025.
* * * * *