vaultfish
Check your data

Texas data broker law: who must register

& ClaudePublished Updated

The short answer

The Texas data broker law is Chapter 509, amended by SB 2121, effective 1 September 2025. It covers businesses handling personal data they did not collect directly, if that is over 50% of revenue or 50,000+ people. The penalty is $100 per day, capped at $10,000 per year.

The Texas test looks at how the data was collected. It doesn't list staff or customers as exempt.

Legally, a "data broker" resells consumer data and must register in some states. This site calls AI data companies buyers. It keeps "data broker" for the legal term.

What did SB 2121 change?

The 2023 version of the Texas law defined a broker by its main source of revenue. SB 2121 rewrote the definition to turn on activity. The activity is collecting, processing or transferring personal data the business did not collect directly from the person.

The revenue test moved into its own section. In a 12-month period, the chapter covers a broker only if one of these is true:

  • More than 50 percent of its revenue comes from processing or transferring data it did not collect directly.
  • It earns revenue from the data of more than 50,000 individuals.

SB 2121 took effect on 1 September 2025.

Does Texas have a direct-relationship test?

The text says "collected directly from the individual." It doesn't list customers or employees as exempt. Vermont, Oregon and New Jersey handle it the other way. So the Texas test can read differently on a mixed archive. That's my reading of the text. I found no Texas guidance on archive licensing.

What is the penalty?

WilmerHale's summary reports a penalty of $100 for each day a broker violates the law. The total can't exceed $10,000 in a 12-month period. The same summary says brokers register with the Secretary of State.

Has Texas enforced it?

The Attorney General's office announced letters in June 2024 to more than 100 companies. The letters cited an apparent failure to register. On 13 January 2025 it sued Allstate and its subsidiary Arity. The complaint alleges that Arity did not register as a data broker.

I haven't confirmed an outcome in that case. Allegations in a complaint are not findings.

How does Texas compare with the other states?

Vermont lists employees and customers as direct relationships. Our state map places Texas next to California, Oregon, New Jersey and Connecticut.

Texas data broker penaltyOne day of violation$100Cap in any 12 months$10,000Daily Texas penalties add up to a yearly cap.Texas data broker penaltyOne day ofviolation$100Cap in any 12months$10,000Daily Texas penaltiesadd up to a yearly cap.
Source: Texas Business and Commerce Code ch. 509, via WilmerHale

Talk to a privacy or commercial lawyer in your state before you sign.

Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral

Sources 4

The outside sources linked on this page.

  1. capitol.texas.govSB 2121
  2. wilmerhale.comWilmerHale's summary
  3. privacyworld.blogAnnounced letters in June 2024 to more than 100 companies
  4. wilmerhale.comSued Allstate and its subsidiary Arity