Title BC, Business and Commerce Code

Sec. 509.101. VERIFICATION OF PARENT OR GUARDIAN. (a) A digital service provider shall verify, using a commercially reasonable method and for each person seeking to perform an action on a digital service as a minor's parent or guardian: (1) the person's identity; and (2) the rela…

Sec. 509.102. POWERS OF VERIFIED PARENT. (a) A verified parent is entitled to alter the duties of a digital service provider under Section 509.052 with regard to the verified parent's known minor. (b) A verified parent is entitled to supervise the verified parent's known minor's …

Sec. 509.103. ACCESS TO KNOWN MINOR'S PERSONAL IDENTIFYING INFORMATION. (a) A known minor's verified parent may submit a request to a digital service provider to: (1) review and download any personal identifying information associated with the minor in the possession of the digit…

Sec. 509.104. MINOR IN CONSERVATORSHIP OF DEPARTMENT OF FAMILY AND PROTECTIVE SERVICES. If a minor is in the conservatorship of the Department of Family and Protective Services, the department may designate the minor's caregiver or a member of the department's staff to perform th…

Sec. 509.151. DECEPTIVE TRADE PRACTICE; ENFORCEMENT BY ATTORNEY GENERAL. A violation of this chapter is a deceptive act or practice actionable under Subchapter E, Chapter 17, solely as an enforcement action by the consumer protection division of the attorney general's office. Add…

Sec. 509.152. PRIVATE CAUSE OF ACTION. (a) Except as provided by Subsection (b), this chapter may not be construed as providing a basis for, or being subject to, a private right of action for a violation of this chapter. (b) If a digital service provider violates this chapter, th…

Sec. 510.001. DEFINITIONS. In this chapter: (1) "Biometric data" means data generated by automatic measurements of an individual's biological patterns or characteristics, including fingerprint, voiceprint, retina or iris scan, information pertaining to an individual's DNA, or ano…

Sec. 510.002. APPLICABILITY TO CERTAIN DATA. (a) Except as provided by Subsection (b), this chapter applies to personal data from an individual that is collected, transferred, or processed by a data broker. (b) This chapter does not apply to the following data: (1) deidentified d…

Sec. 510.003. APPLICABILITY OF CHAPTER TO CERTAIN ENTITIES. (a) Except as provided by Subsection (b), this chapter applies only to a data broker that, in a 12-month period, derives: (1) more than 50 percent of the data broker's revenue directly from processing or transferring per…

Sec. 510.004. NOTICE ON WEBSITE OR MOBILE APPLICATION. A data broker that maintains an Internet website or mobile application shall post a conspicuous notice on the website or application that: (1) states that the entity maintaining the website or application is a data broker; (2…

Sec. 510.005. REGISTRATION. (a) To conduct business in this state, a data broker to which this chapter applies shall register with the secretary of state by filing a registration statement and paying a registration fee of $300. (b) The registration statement must include: (1) the…

Sec. 510.006. REGISTRY OF DATA BROKERS. (a) The secretary of state shall establish and maintain, on its Internet website, a searchable, central registry of data brokers registered under Section 510.005. (b) The registry must include: (1) a search feature that allows a person sear…

Sec. 510.007. PROTECTION OF PERSONAL DATA: COMPREHENSIVE INFORMATION SECURITY PROGRAM. (a) A data broker conducting business in this state has a duty to protect personal data held by that data broker as provided by this section. (b) A data broker shall develop, implement, and mai…

Sec. 510.008. CIVIL PENALTY. (a) A data broker that violates Section 510.004 or 510.005 is liable to this state for a civil penalty as prescribed by this section. (b) A civil penalty imposed against a data broker under this section: (1) subject to Subdivision (2), may not be in a…

Sec. 510.009. DECEPTIVE TRADE PRACTICE. A violation of Section 510.007 by a data broker constitutes a deceptive trade practice in addition to the practices described by Subchapter E, Chapter 17, and is actionable under that subchapter. Added by Acts 2023, 88th Leg., R.S., Ch. 963…

Sec. 510.010. RULES. The secretary of state shall adopt rules as necessary to implement this chapter. Added by Acts 2023, 88th Leg., R.S., Ch. 963 (S.B. 2105), Sec. 1, eff. September 1, 2023. Redesignated from Business and Commerce Code, Chapter 509 by Acts 2025, 89th Leg., R.S.,…

Sec. 521.001. SHORT TITLE. This chapter may be cited as the Identity Theft Enforcement and Protection Act. Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.

Sec. 521.002. DEFINITIONS. (a) In this chapter: (1) "Personal identifying information" means information that alone or in conjunction with other information identifies an individual, including an individual's: (A) name, social security number, date of birth, or government-issued …

Sec. 521.051. UNAUTHORIZED USE OR POSSESSION OF PERSONAL IDENTIFYING INFORMATION. (a) A person may not obtain, possess, transfer, or use personal identifying information of another person without the other person's consent or effective consent and with intent to obtain a good, a …

Sec. 521.052. BUSINESS DUTY TO PROTECT SENSITIVE PERSONAL INFORMATION. (a) A business shall implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect from unlawful use or disclosure any sensitive personal information collected or…

Sec. 521.053. NOTIFICATION REQUIRED FOLLOWING BREACH OF SECURITY OF COMPUTERIZED DATA. (a) In this section, "breach of system security" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal informati…

Sec. 521.101. APPLICATION FOR COURT ORDER TO DECLARE INDIVIDUAL A VICTIM OF IDENTITY THEFT. (a) A person who is injured by a violation of Section 521.051 or who has filed a criminal complaint alleging commission of an offense under Section 32.51, Penal Code, may file an applicati…

Sec. 521.102. PRESUMPTION OF APPLICANT'S STATUS AS VICTIM. An applicant under Section 521.101 is presumed to be a victim of identity theft under this subchapter if the person charged with an offense under Section 32.51, Penal Code, is convicted of the offense. Added by Acts 2007,…

Sec. 521.103. ISSUANCE OF ORDER; CONTENTS. (a) After notice and hearing, if the court is satisfied by a preponderance of the evidence that an applicant under Section 521.101 has been injured by a violation of Section 521.051 or is the victim of an offense under Section 32.51, Pen…

Sec. 521.104. CONFIDENTIALITY OF ORDER. (a) An order issued under Section 521.103 must be sealed because of the confidential nature of the information required to be included in the order. The order may be opened and the order or a copy of the order may be released only: (1) to t…

Sec. 521.105. GROUNDS FOR VACATING ORDER. A court at any time may vacate an order issued under Section 521.103 if the court finds that the application filed under Section 521.101 or any information submitted to the court by the applicant contains a fraudulent misrepresentation or…

Sec. 521.151. CIVIL PENALTY; INJUNCTION. (a) A person who violates this chapter is liable to this state for a civil penalty of at least $2,000 but not more than $50,000 for each violation. The attorney general may bring an action to recover the civil penalty imposed under this su…

Sec. 521.152. DECEPTIVE TRADE PRACTICE. A violation of Section 521.051 is a deceptive trade practice actionable under Subchapter E, Chapter 17. Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.

Sec. 522.001. DEFINITIONS. In this chapter: (1) "Payment card" means a credit card, debit card, check card, or other card that is issued to an authorized user to purchase or obtain goods, services, money, or any other thing of value. (2) "Re-encoder" means an electronic device th…

Sec. 522.002. OFFENSE; PENALTY. (a) A person commits an offense if the person uses a scanning device or re-encoder to access, read, scan, store, or transfer information encoded on the magnetic strip of a payment card without the consent of an authorized user of the payment card a…

Sec. 523.001. EXTENSION OF CREDIT TO VICTIM OF IDENTITY THEFT. (a) In this section, "victim of identity theft" means an individual who has filed a criminal complaint alleging the commission of an offense under Section 32.51, Penal Code, other than a person who is convicted of an …

Sec. 523.002. VERIFICATION OF CONSUMER IDENTITY. (a) In this section: (1) "Consumer report" has the meaning assigned by Section 20.01. (2) "Extension of credit" does not include: (A) an increase in the dollar limit of an existing open-end credit plan as defined by federal Regulat…

Sec. 523.051. NOTATION OF FORGED CHECK. (a) In this section, "victim of identity theft" means a person who has filed with an appropriate law enforcement agency a criminal complaint alleging commission of an offense under Section 32.51, Penal Code. (b) A financial institution, in …

Sec. 523.052. NOTIFICATION TO CHECK VERIFICATION ENTITIES THAT CUSTOMER IS VICTIM OF IDENTITY THEFT. (a) In this section: (1) "Check verification entity" means a consumer reporting agency that compiles and maintains, for businesses in this state, files on consumers on a nationwid…

Sec. 541.001. DEFINITIONS. In this chapter, unless a different meaning is required by the context: (1) "Affiliate" means a legal entity that controls, is controlled by, or is under common control with another legal entity or shares common branding with another legal entity. For p…

Sec. 541.002. APPLICABILITY OF CHAPTER. (a) This chapter applies only to a person that: (1) conducts business in this state or produces a product or service consumed by residents of this state; (2) processes or engages in the sale of personal data; and (3) is not a small business…

Sec. 541.003. CERTAIN INFORMATION EXEMPT FROM CHAPTER. The following information is exempt from this chapter: (1) protected health information under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.); (2) health records; (3) patient …

Sec. 541.004. INAPPLICABILITY OF CHAPTER. This chapter does not apply to the processing of personal data by a person in the course of a purely personal or household activity. Added by Acts 2023, 88th Leg., R.S., Ch. 995 (H.B. 4), Sec. 2, eff. July 1, 2024.

Sec. 541.005. EFFECT OF COMPLIANCE WITH PARENTAL CONSENT REQUIREMENTS UNDER CERTAIN FEDERAL LAW. A controller or processor that complies with the verifiable parental consent requirements of the Children's Online Privacy Protection Act of 1998 (15 U.S.C. Section 6501 et seq.) with…

Sec. 541.051. CONSUMER'S PERSONAL DATA RIGHTS; REQUEST TO EXERCISE RIGHTS. (a) A consumer is entitled to exercise the consumer rights authorized by this section at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to exercise. Wit…

Sec. 541.052. CONTROLLER RESPONSE TO CONSUMER REQUEST. (a) Except as otherwise provided by this chapter, a controller shall comply with a request submitted by a consumer to exercise the consumer's rights pursuant to Section 541.051 as provided by this section. (b) A controller sh…

Sec. 541.053. APPEAL. (a) A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period of time after the consumer's receipt of the decision under Section 541.052(c). (b) The appeal process must be …

Sec. 541.054. WAIVER OR LIMITATION OF CONSUMER RIGHTS PROHIBITED. Any provision of a contract or agreement that waives or limits in any way a consumer right described by Sections 541.051, 541.052, and 541.053 is contrary to public policy and is void and unenforceable. Added by Ac…

Sec. 541.055. METHODS FOR SUBMITTING CONSUMER REQUESTS. (a) A controller shall establish two or more secure and reliable methods to enable consumers to submit a request to exercise their consumer rights under this chapter. The methods must take into account: (1) the ways in which…

Sec. 541.101. CONTROLLER DUTIES; TRANSPARENCY. (a) A controller: (1) shall limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which that personal data is processed, as disclosed to the consumer; and (2) fo…

Sec. 541.102. PRIVACY NOTICE. (a) A controller shall provide consumers with a reasonably accessible and clear privacy notice that includes: (1) the categories of personal data processed by the controller, including, if applicable, any sensitive data processed by the controller; (…