Privacy & Cybersecurity Law Blog

On June 20, 2025, the Texas governor signed into law S.B. 2121 (the “Bill”), which amends the Texas Data Broker Act’s (the “Act”) definition of “data broker” and applicability thresholds.

• Data Broker Definition: Currently, “data broker” means a business entity whose principal source of revenue is derived from the collecting, processing, or transferring of personal data that the entity did not collect directly from the individual linked or linkable to the data. Notably, the Bill amends and broadens the definition to a “business entity that collects, processes, or transfers personal data” that the business did not collect directly from the individual linked or linkable to the data.
• Applicability Thresholds: The law currently applies to a data broker that, in a 12-month period, derives (1) more than 50% of the data broker’s revenue from processing or transferring personal data that the data broker did not collect directly from the individuals to whom the data pertains, or (2) revenue from processing or transferring the personal data of more than 50,000 individuals that the data broker did not collect directly from the individuals to whom the data pertains. The Bill amends the applicability thresholds to clarify that the law applies to a data broker that, in a 12-month period, derives (1) more than 50% of the data broker’s revenue directly from processing or transferring personal data not collected by the data broker directly from the individuals to whom the data pertains, or (2) revenue directly from processing or transferring the personal data of more than 50,000 individuals not collected by the data broker directly from the individuals to whom the data pertains.

The amendments to the Act will take effect September 1, 2025.