Johnson’s bill on data broker privacy notices

The text as introduced · 507 words

89R8838 BCH-F

By: Johnson
S.B. No. 1343

A BILL TO BE ENTITLED

AN ACT

relating to the notice requirements of a data broker registration

statement and Internet website.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF TEXAS:

SECTION 1. Section 509.004, Business & Commerce Code, as

added by Chapter 963 (S.B. 2105), Acts of the 88th Legislature,

Regular Session, 2023, is amended to read as follows:

Sec. 509.004. NOTICE ON WEBSITE OR MOBILE APPLICATION. A

data broker that maintains an Internet website or mobile

application shall post a conspicuous notice on the website or

application that:

(1) states that the entity maintaining the website or

application is a data broker;

(2) is clear, not misleading, and readily accessible

by the general public, including individuals with a disability;

[ and ]

(3) contains language provided by rule of the

secretary of state for inclusion in the notice ; and

(4) informs a consumer how to exercise any consumer

rights the consumer may have under Chapter 541 .

SECTION 2. Section 509.005(b), Business & Commerce Code, as

added by Chapter 963 (S.B. 2105), Acts of the 88th Legislature,

Regular Session, 2023, is amended to read as follows:

(b) The registration statement must include:

(1) the legal name of the data broker;

(2) a contact person and the primary physical address,

e-mail address, telephone number, and Internet website address for

the data broker;

(2-a) a link to a page on the data broker's Internet

website that provides consumers with specific instructions, which

must be prominently displayed, on how to exercise their consumer

rights under Section 541.051, and any other applicable data privacy

rights under Chapter 541;

(3) a description of the categories of data the data

broker processes and transfers;

(4) a statement of whether or not the data broker

implements a purchaser credentialing process;

(5) if the data broker has actual knowledge that the

data broker possesses personal data of a known child:

(A) a statement detailing the data collection

practices, databases, sales activities, and opt-out policies that

are applicable to the personal data of a known child; and

(B) a statement on how the data broker complies

with applicable federal and state law regarding the collection,

use, or disclosure of personal data from and about a child on the

Internet; and

(6) the number of security breaches the data broker

has experienced during the year immediately preceding the year in

which the registration is filed, and if known, the total number of

consumers affected by each breach.

SECTION 3. Section 509.005(b), Business & Commerce Code, as

amended by this Act, applies only to a registration statement

submitted on or after the effective date of this Act.

SECTION 4. It is the intent of the 89th Legislature, Regular

Session, 2025, that the amendments made by this Act to Sections

509.004 and 509.005(b), Business & Commerce Code, be harmonized

with another Act of the 89th Legislature, Regular Session, 2025,

relating to nonsubstantive additions to and corrections in enacted

codes.

SECTION 5. This Act takes effect September 1, 2025.