Court Rules
All enforcement actions
Warning LetterLow Risk

Texas AG Notifies Over 100 Data Brokers of Apparent Noncompliance with Texas Data Broker Law

Multiple Unnamed Data Broker CompaniesJune 18, 2024Texas Attorney General

Summary

Texas Attorney General Ken Paxton issued warning letters to over 100 companies informing them of their apparent failure to register as data brokers with the Texas Secretary of State by the March 1, 2024 deadline required by Chapter 509 of the Texas Business and Commerce Code. The notification follows the establishment of a specialized privacy enforcement team within the AG’s Consumer Protection Division to enforce Texas privacy laws. The letters alert companies to potential penalties for noncompliance with registration and data safeguard requirements under Texas’s Data Broker Law.

Remedy

The notified companies are required to cure their noncompliance by registering as data brokers with the Texas Secretary of State and implementing required data safeguards to avoid statutory penalties for violation of Texas’s Data Broker Law. No monetary penalties or other formal remedies have been imposed as of the date of the warning letters.

Corrective Notice

Contract Impact

In-house legal teams should review all vendor agreements with entities that buy, sell, trade, or process consumer personal data to confirm whether such vendors are required to register as data brokers under Texas law. Teams should add clauses requiring vendors to certify compliance with Texas Data Broker Law registration requirements, implement adequate data safeguards, and notify the company immediately of any enforcement actions or noncompliance notices from the Texas Attorney General. Additionally, contracts should include audit rights to verify vendor registration status and data security practices, as well as indemnification clauses for penalties arising from vendor noncompliance with Texas privacy laws.

Contract Search Terms

data broker registrationTexas Data Broker LawChapter 509 Texas Business and Commerce Codepersonal data processingdata safeguard requirementsTexas Secretary of State data broker filingconsumer personal data

Laws Cited

Chapter 509 of the Texas Business and Commerce CodeTexas Data Broker Law
Tex. Bus. & Com. Code Chapter 509

Violation Types

Entity Details

Entity

Multiple Unnamed Data Broker Companies

Industry

Data Broker

Official Sources

Source Evidence

Entity Name
"over one hundred companies"
Laws Cited
"Chapter 509 of the Texas Business and Commerce Code"
Laws Cited
"Texas’s newly enacted Data Broker Law"
Violation Types
"apparent failure to register as data brokers with the Texas Secretary of State as required by Texas’s newly enacted Data Broker Law"
Event Type
"issued letters notifying over one hundred companies of their apparent failure to comply"
Jurisdiction
"Texas Attorney General Ken Paxton"

Related Enforcement Actions

TX

Tris Pharmaceuticals

$7.5M

Texas Attorney General Ken Paxton announced a $7.5 million settlement with Tris Pharmaceuticals over alleged misrepresentations about the efficacy of Dyanavel XR, an ADHD drug marketed for children. The release says the company overstated the drug’s efficacy and directed sales representatives to make misleading claims to doctors, including Medicaid providers.

TX

Plum Organics

Texas Attorney General Ken Paxton announced an agreement with Plum Organics requiring stronger testing and limits for heavy metals in covered baby food products, along with publicly accessible testing results. The release does not state a monetary penalty; the agreement follows an ongoing investigation into baby food manufacturers.

TX

Health Care Service Corporation (including Blue Cross and Blue Shield of Texas)

Texas Attorney General Ken Paxton opened an investigation into Blue Cross and Blue Shield of Texas, its parent Health Care Service Corporation, and related entities over alleged denials or delays of urgent and medically necessary care and potentially burdensome prior authorization requirements. The investigation is ongoing; the Attorney General issued a Civil Investigative Demand to obtain information and assess potential violations of Texas law.

TX

N/A (consumer alert; no enforcement target)

Texas Attorney General Ken Paxton issued a consumer alert warning Texas businesses and nonprofits about a surge of demand letters alleging California Invasion of Privacy Act (CIPA) violations based on common website technologies such as cookies, pixels, and analytics tools. The AG cautions that some letters may exaggerate or misrepresent violations and may be fraudulent, noting serial CIPA plaintiff Vivek Shah has been declared a vexatious litigant. Recipients are advised not to pay or respond directly, to consult privacy counsel, and to report suspected fraud to the Consumer Protection Division.

TX

TikTok

A Texas state district court (Judge Cory Liu) has found TikTok liable for lying to parents about the safety of its platform and for exposing children to inappropriate and explicit content, making Texas the first state in the nation to hold TikTok liable on these claims. The court found that although TikTok claimed it would remove graphic videos depicting drugs, nudity, alcohol, injuries, and profanity, such videos remained accessible to minors, even under 'Restricted Mode.' No penalty has been imposed yet; Attorney General Paxton will proceed to trial, expected next month, where relief and penalties will be determined.

TX

TriWest Healthcare Alliance Corp.

Texas Attorney General Ken Paxton opened an investigation into TriWest Healthcare Alliance Corp., the U.S. government contractor that administers the VA Community Care Network and the Defense Health Agency's TRICARE West Region, over reports that it wrongfully denied health care claims by falsely treating insureds as having other health insurance (OHI). The OAG has issued Civil Investigative Demands (CIDs) and plans to interview consumers and employees to determine whether TriWest violated the Texas Deceptive Trade Practices Act. No findings or penalties have been imposed yet.