TX SB2121

Expands the definition of "data broker" to include any business entity that collects, processes, or transfers personal data not obtained directly from the individual, removing the previous requirement that this be the entity's "principal source of revenue"

Requires data broker regulations to apply only to entities that derive more than 50% of revenue directly from processing or transferring indirectly-collected personal data, OR derive revenue from processing data of more than 50,000 individuals not collected directly

Adds clarifying language specifying that revenue thresholds apply to revenue derived "directly" from data processing activities

Amends Section 509.001(4) and Section 509.003(a) of the Business & Commerce Code, originally enacted by S.B. 2105 in 2023

Takes effect September 1, 2025