Title BC, Business and Commerce Code

Sec. 324.102. CIVIL PENALTY; INJUNCTIVE RELIEF. (a) A person who violates this chapter is liable to this state for a civil penalty in an amount not to exceed $100,000 for each violation. The attorney general may bring an action to recover the civil penalty imposed by this subsect…

Sec. 325.001. SHORT TITLE. This chapter may be cited as the Anti-Phishing Act. Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.

Sec. 325.002. DEFINITIONS. In this chapter: (1) "Electronic mail" means a message, file, or other information that is transmitted through a local, regional, or global computer network, regardless of whether the message, file, or information is viewed, stored for retrieval at a la…

Sec. 325.003. INAPPLICABILITY OF CHAPTER. This chapter does not apply to a telecommunications provider's or Internet service provider's good faith transmission or routing of, or intermediate temporary storing or caching of, identifying information. Added by Acts 2007, 80th Leg., …

Sec. 325.004. CREATION AND USE OF WEB PAGE OR DOMAIN NAME FOR FRAUDULENT PURPOSE PROHIBITED. A person may not, with the intent to engage in conduct involving the fraudulent use or possession of identifying information of another person: (1) create a web page or Internet domain na…

Sec. 325.005. TRANSMISSION OF FRAUDULENT ELECTRONIC MAIL PROHIBITED. A person may not, with the intent to engage in conduct involving the fraudulent use or possession of identifying information, send or cause to be sent to an electronic mail address held by a resident of this sta…

Sec. 325.006. CIVIL ACTION FOR INJUNCTIVE RELIEF OR DAMAGES. (a) Any of the following persons may bring a civil action against a person who violates this chapter: (1) a person who is engaged in the business of providing Internet access service to the public and is adversely affec…

Sec. 326.001. DEFINITIONS. In this chapter: (1) "Automated sales suppression device" means a device or software program that falsifies an electronic record, including transaction data or a transaction report, of an electronic cash register or other point-of-sale system. The term …

Sec. 326.002. AUTOMATED SALES SUPPRESSION DEVICES AND PHANTOM-WARE PROHIBITED; CRIMINAL OFFENSE. (a) A person commits an offense if the person knowingly sells, purchases, installs, transfers, uses, or possesses an automated sales suppression device or phantom-ware. (b) An offense…

Sec. 327.001. DEFINITIONS. In this chapter: (1) "Internet domain name" means a globally unique, hierarchical reference to an Internet host or service that is: (A) assigned through a centralized Internet naming authority; and (B) composed of a series of character strings separated…

Sec. 327.002. TICKET WEBSITE DOMAIN NAME RESTRICTED. (a) Except as provided by Subsection (b), a website operator may not intentionally use an Internet domain name, or any subdomain of the Internet domain name, in a ticket website's URL that contains any of the following: (1) the…

Sec. 327.003. DECEPTIVE TRADE PRACTICE. A violation of this chapter is a deceptive trade practice under Subchapter E, Chapter 17, and is actionable under that subchapter. Added by Acts 2019, 86th Leg., R.S., Ch. 1348 (S.B. 2409), Sec. 1, eff. September 1, 2019.

Sec. 328.001. DEFINITIONS. In this chapter: (1) "Bot" means any automated software program that performs automatic and repetitive tasks and is designed to impersonate or replicate human activity online. The term does not include autofill or password management features built into…

Sec. 328.002. PROHIBITION ON USE OR CREATION OF BOTS TO ENGAGE IN CERTAIN ONLINE TICKET ACTIVITY. A person may not use or create a bot to: (1) purchase tickets in excess of posted limits for an online ticket sale; (2) use multiple Internet Protocol (IP) addresses, multiple purcha…

Sec. 328.003. ENFORCEMENT BY ATTORNEY GENERAL; INJUNCTION; CIVIL PENALTY. (a) The attorney general may investigate a claim that a person violated this chapter. (b) If the attorney general concludes that a person is violating this chapter, the attorney general may bring an action …

Sec. 329.001. DEFINITION. In this chapter, "goods" has the meaning assigned by Section 17.45. Added by Acts 2023, 88th Leg., R.S., Ch. 169 (S.B. 58), Sec. 1, eff. September 1, 2023. Redesignated from Business and Commerce Code, Chapter 328 by Acts 2025, 89th Leg., R.S., Ch. 204 (…

Sec. 329.002. PROHIBITIONS CONCERNING SALE OF GOODS ONLINE. (a) For commercial purposes, a person may not sell, use, or cause to be used any technology, device, or software in the sale of goods on an Internet website that: (1) functions as a bypass in the purchasing process; (2) …

Sec. 329.003. ENFORCEMENT BY ATTORNEY GENERAL; INJUNCTION. (a) The attorney general may investigate a claim that a person violated this chapter. (b) If the attorney general believes that a person is violating this chapter, the attorney general may bring an action in the name of t…

Sec. 501.001. CERTAIN USES OF SOCIAL SECURITY NUMBER PROHIBITED. (a) A person, other than a government or a governmental subdivision or agency, may not: (1) intentionally communicate or otherwise make available to the public an individual's social security number; (2) display an …

Sec. 501.002. CERTAIN USES OF SOCIAL SECURITY NUMBER PROHIBITED; REMEDIES. (a) A person may not print an individual's social security number on a card or other device required to access a product or service provided by the person unless the individual has requested in writing tha…

Sec. 501.051. INAPPLICABILITY OF SUBCHAPTER. This subchapter does not apply to: (1) a person who is required to maintain and disseminate a privacy policy under: (A) the Gramm-Leach-Bliley Act (15 U.S.C. Sections 6801 to 6809); (B) the Family Educational Rights and Privacy Act of …

Sec. 501.052. PRIVACY POLICY NECESSARY TO REQUIRE DISCLOSURE OF SOCIAL SECURITY NUMBER. (a) A person may not require an individual to disclose the individual's social security number to obtain goods or services from or enter into a business transaction with the person unless the …

Sec. 501.053. CIVIL PENALTY; INJUNCTION. (a) A person who violates Section 501.052(a) is liable to this state for a civil penalty in an amount not to exceed $500 for each calendar month during which a violation occurs. The civil penalty may not be imposed for more than one violat…

Sec. 501.101. USE OF CONSUMER DRIVER'S LICENSE OR SOCIAL SECURITY NUMBER BY MERCHANT OR CERTAIN THIRD PARTY. (a) A merchant or a third party under contract with a merchant who requires a consumer returning merchandise to provide the consumer's driver's license or social security …

Sec. 501.1011. SALES RECEIPT CONTAINING DRIVER'S LICENSE NUMBER PROHIBITED. A person may not print an individual's driver's license number on a receipt that evidences payment for a sale of goods or services and is provided to the individual. Added by Acts 2009, 81st Leg., R.S., C…

Sec. 501.102. CIVIL PENALTY; INJUNCTION. (a) A person who violates Section 501.101 is liable to this state for a civil penalty in an amount not to exceed $500 for each violation. The attorney general or the prosecuting attorney in the county in which the violation occurs may brin…

Sec. 502.001. WARNING SIGN ABOUT IDENTITY THEFT FOR RESTAURANT OR BAR EMPLOYEES. (a) In this section: (1) "Credit card" means an identification card, plate, coupon, book, or number or any other device authorizing a designated person or bearer to obtain property or service on cred…

Sec. 502.002. BUSINESS RECEIPT CONTAINING CREDIT CARD OR DEBIT CARD INFORMATION. (a) A person who accepts a credit card or debit card for the transaction of business may not print on a receipt or other document that evidences the transaction and is provided to a cardholder more t…

Sec. 502.003. DELIVERY OF CHECK FORM. (a) In this section: (1) "Addressee" means a person to whom a check form is sent. (2) "Check form" means a device for the transmission or payment of money that: (A) is not a negotiable instrument under Section 3.104; (B) if completed would be…

Sec. 503.001. CAPTURE OR USE OF BIOMETRIC IDENTIFIER. (a) In this section: (1) "Artificial intelligence system" has the meaning assigned by Section 551.001. (2) "Biometric identifier" means a retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry. (b) A …

Sec. 503A.001. DEFINITIONS. In this chapter: (1) "Biological sample" means a material part of the human body, or a discharge or derivative part of the body, including tissue, blood, urine, or saliva that is known to contain DNA. (2) "Deidentified data" means data not reasonably l…

Sec. 503A.002. APPLICABILITY. (a) This chapter applies to a direct-to-consumer genetic testing company that: (1) offers its products or services to individuals who are residents of this state; or (2) collects, uses, or analyzes genetic data that: (A) results from the company's pr…

Sec. 503A.003. EXCLUSIVE PROPERTY RIGHT IN DNA; CONFIDENTIALITY. An individual has a property right in, and retains the right to exercise exclusive control over, the individual's biological sample that is provided to or used by a direct-to-consumer genetic testing company and the…

Sec. 503A.004. REQUIREMENTS FOR CERTAIN USES OF DEIDENTIFIED DATA. (a) Except as otherwise provided by this chapter or other law, a direct-to-consumer genetic testing company that possesses an individual's deidentified data shall: (1) implement administrative and technical measur…

Sec. 503A.005. REQUIREMENTS FOR CERTAIN USES OR DISCLOSURE OF GENETIC DATA AND BIOLOGICAL SAMPLE. (a) A direct-to-consumer genetic testing company shall: (1) develop, implement, and maintain a comprehensive security program to protect an individual's genetic data against unauthor…

Sec. 503A.006. REQUIRED CONSENT. (a) A direct-to-consumer genetic testing company engaging in any of the following activities must obtain: (1) an individual's separate express consent for: (A) the transfer or disclosure of the individual's genetic data to any person other than th…

Sec. 503A.007. PROHIBITED DISCLOSURES. (a) A direct-to-consumer genetic testing company may not disclose an individual's genetic data to a law enforcement entity or other governmental body unless: (1) the company first obtains the individual's express written consent; or (2) the …

Sec. 503A.008. CIVIL PENALTY. (a) A direct-to-consumer genetic testing company that violates this chapter is liable to this state for a civil penalty in an amount not to exceed $2,500 for each violation. (b) The attorney general may bring an action to recover a civil penalty impo…

Sec. 504.001. DEFINITIONS. In this chapter: (1) "Crime victim information" means information that: (A) is collected or prepared by a law enforcement agency; and (B) identifies or serves to identify a person who, according to a record of the agency, may have been the victim of a c…

Sec. 504.002. PROHIBITION ON USE FOR SOLICITATION OR SALE OF INFORMATION. (a) A person who possesses crime victim or motor vehicle collision information that the person obtained or knows was obtained from a law enforcement agency may not: (1) use the information to contact direct…

Sec. 505.001. DEFINITIONS. In this chapter: (1) "Credit card" means a card or device issued under an agreement by which the issuer gives to a cardholder the right to obtain credit from the issuer or another person. (2) "Credit card issuer" means a lender, including a financial in…

Sec. 505.002. USE OF ZIP CODE TO VERIFY IDENTITY IN CREDIT CARD TRANSACTION. (a) A business may require a customer who purchases a good or service from the business using a credit card to provide the customer's zip code to verify the customer's identity as provided by Subsection …

Sec. 505.003. RETENTION OF ZIP CODE PROHIBITED. A business that obtains a customer's zip code under Section 505.002 may not retain the zip code in any form after the purchase of the good or service has been completed. Added by Acts 2009, 81st Leg., R.S., Ch. 87 (S.B. 1969), Sec. …

Sec. 506.001. DEFINITIONS. In this chapter: (1) "Covered information" means deidentified information released by a board, commission, department, or other agency of this state, including an institution of higher education as defined by Section 61.003, Education Code, or a hospita…

Sec. 506.002. REQUIRED NOTICES. (a) An agency of this state shall provide written notice to a person to whom the agency releases deidentified information that the information is deidentified information. (b) A person who sells covered information or otherwise receives compensatio…

Sec. 506.003. PROHIBITED ACTS. (a) A person may not: (1) reidentify or attempt to reidentify personal identifying information about an individual who is the subject of covered information; or (2) knowingly disclose or release covered information that was reidentified in violation…