Texas data broker law: what you can ask a data broker to delete, and how

Two Texas laws apply. The Texas Data Privacy and Security Act (TDPSA, Business and Commerce Code chapter 541, in force since July 1, 2024) says a controller "shall comply with an authenticated consumer request" to "delete personal data provided by or obtained about the consumer," with an answer due within 45 days. The Texas data broker law (passed in 2023 as chapter 509, now numbered 510) makes data brokers register with the Secretary of State, which publishes a searchable registry; it gives you no deletion request of its own. The biggest gap: the TDPSA says personal data "does not include deidentified data or publicly available information," so what people-search sites pull from public records can sit outside the deletion request, and small businesses are outside the chapter. There is no Texas version of California's one-stop DROP platform. You send requests one broker at a time.

The two Texas laws

The TDPSA (chapter 541). House Bill 4 took effect on July 1, 2024. Its enrolled text applies the chapter to a person that "conducts business in this state or produces a product or service consumed by residents of this state," processes or sells personal data, and "is not a small business as defined by the United States Small Business Administration." A "consumer" is "a resident of this state acting only in an individual or household context." Section 541.051 lists five requests: access, correct, delete, obtain a copy, and opt out of targeted advertising, sale and certain profiling. Deletion covers data "provided by or obtained about the consumer," so data a broker bought or scraped, not only data you gave it. The attorney general "has exclusive authority to enforce this chapter," and its summary says the act "does not provide a private right of action."

The data broker law (chapter 509, now 510). Senate Bill 2105 took effect on September 1, 2023. Its enrolled text says a covered broker "shall register with the secretary of state" and pay "a registration fee of $300," and that the secretary "shall establish and maintain, on its Internet website, a searchable, central registry." Brokers must also post a notice that they are a data broker. Not registering costs at least "$100 for each day the entity is in violation," capped at "$10,000 assessed against the same data broker in a 12-month period." The attorney general put the deadline at March 1, 2024, and on June 18, 2024 announced letters to "over one hundred companies" that had apparently not registered. Two 2025 amendments matter: S.B. 2121 redefined a data broker as "a business entity that collects, processes, or transfers personal data that the business entity did not collect directly from the individual," dropping the old principal-source-of-revenue test, and S.B. 1343 requires the notice to say "how to exercise any consumer rights the consumer may have under Chapter 541" and registration statements filed from September 1, 2025 to include "a link to a page" with "specific instructions."

The registry. The Secretary of State's page links to the searchable Data Broker Registry. Its FAQ says an entry shows legal name, contact details, data categories and breach counts, and that the office is "the filing officer" and does not "investigate alleged violations": complaints go to the attorney general.

How to send a deletion request under the TDPSA

Find the channel. Section 541.055 says a controller "shall establish two or more secure and reliable methods," must offer a mechanism on its website if it has one, and "may not require a consumer to create a new account." A registered broker's entry should link to an instructions page if filed after September 1, 2025; otherwise use its privacy notice.

Say what you are asking for. Cite section 541.051(b)(3), say you are a Texas resident, and give the identifiers needed to find your record and nothing more. Section 541.052(e) lets a controller that "is unable to authenticate the request using commercially reasonable efforts" ask for "additional information reasonably necessary to authenticate." The statute does not say what that may be.

The clock. The controller "shall respond to the consumer request without undue delay, which may not be later than the 45th day after the date of receipt." It "may extend the response period once by an additional 45 days when reasonably necessary," but only if it tells you within the first 45 days and gives a reason. Responses are free "at least twice annually per consumer" unless a request is "manifestly unfounded, excessive, or repetitive."

What "deleted" can mean. Under section 541.052(f), a controller that got your data "from a source other than the consumer" is "considered in compliance" if it either keeps "a record of the deletion request and the minimum data necessary" to keep you deleted, or opts you out of processing that data "for any purpose other than a purpose that is exempt." A broker may suppress rather than erase. Ask which it did.

If the answer is no. The controller must give "the justification for declining to take action" within the 45 days and "instructions on how to appeal." The appeal must be answered "in writing" within 60 days. If it is denied, the controller "shall provide the consumer with the online mechanism" for complaining to the attorney general; that link is on the attorney general's TDPSA page, which also says the office cannot give legal advice to individuals. Before suing, the attorney general must give 30 days to cure; after that the penalty is "not to exceed $7,500 for each violation." Keep the date, channel, reply and appeal.

What the law does not cover

Publicly available information. The TDPSA defines it as information "lawfully made available through government records," or that a business "has a reasonable basis to believe is lawfully made available to the general public through widely distributed media" or by the consumer, "unless the consumer has restricted the information to a specific audience." A people-search site that builds your listing from government records can argue the listing is not personal data at all. Whether that holds for a given site is for the attorney general or a court, not this article. The data broker law goes further: it "does not apply to" publicly available information or to "inferences made exclusively from multiple independent sources of publicly available information that do not reveal sensitive data."

Small businesses. The TDPSA does not apply to an SBA-defined small business, except that section 541.107 bars it from selling sensitive data "without receiving prior consent." The data broker law applies only to a broker that, in a 12-month period, gets more than 50 percent of its revenue from such data or earns revenue from the personal data "of more than 50,000 individuals." A small people-search site may owe nothing to either law.

Exempt entities and data. Section 541.002(b) excludes state agencies, Gramm-Leach-Bliley financial institutions, HIPAA covered entities, nonprofits, universities and electric utilities. Section 541.003 exempts data regulated by the Fair Credit Reporting Act, the Driver's Privacy Protection Act and FERPA, among others. FCRA consumer reporting agencies are also outside the data broker law.

Copies already sold, and the registry itself. A TDPSA request goes to one controller; the text says nothing about copies sold earlier, so each buyer needs its own request. The registry does not forward requests, and a company missing from it may be a broker that ignored the law: the attorney general's Allstate and Arity petition, filed in January 2025, says the Arity defendants had "apparently failed to register."

Universal opt-out signals

Section 541.055(e) took effect on January 1, 2025. It says a consumer "may designate an authorized agent using a technology, including a link to an Internet website, an Internet browser setting or extension, or a global setting on an electronic device, that allows the consumer to indicate the consumer's intent to opt out of the processing." A controller "shall comply" if it can verify "with commercially reasonable effort, the identity of the consumer and the authorized agent's authority," and the technology "may not make use of a default setting."

Three limits follow. It covers only targeted advertising and the sale of personal data, not deletion. A controller may decline if it cannot verify "that the consumer is a resident of this state." And a browser signal goes to the sites you visit; it does not reach a broker's file on you unless you visit that broker with it on. The statute names no signal. Global Privacy Control is a signal of this type: its site says "your browser will send the GPC signal to websites you visit" to communicate a do-not-sell-or-share request. Do not expect it to clear a people-search listing.

Texas vs California

California's Delete Act created DROP, which the California Privacy Protection Agency describes as one free request to "over 600 registered data brokers," who must re-check and delete every 45 days. Texas has nothing like it. Its registry sits with a Secretary of State that calls itself a filing officer; California's sits with a privacy regulator that also runs the deletion platform. Our California guide covers DROP; Texans cannot use it.

Practical order

1. Search your name and list the sites. Use each people-search site's own opt-out first; it does not depend on which law applies. Our people-search directory has a tested guide per site, How to remove your information from the internet gives the full order of work, and What is a data broker explains who these companies are.
2. Check the Texas registry and our directory. For registered brokers that are not people-search sites (marketing lists, identity and risk vendors, location data firms), send a TDPSA deletion request through the channel in the registry entry or privacy notice. Quote 541.051(b)(3), state Texas residency, and ask whether they deleted or suppressed under 541.052(f).
3. Calendar day 45 and day 90. No answer and no extension notice by day 45, or a refusal: appeal. Appeal denied: file the complaint with the attorney general using the link the broker must give you.
4. Keep records and re-check. Search your name again after each reply and a few months later. Listings built from public records can come back; a "processed" reply is not the same as a listing that is gone.
5. Turn on an opt-out signal in your browser for the ad and sale side, knowing it deletes nothing.

We cannot promise any listing stays down, and neither does the statute. The TDPSA gives you a request with a deadline and an appeal; the registry gives you names. The rest is repetition.

If you are at risk

If someone is using your address or routine to threaten or follow you, do not wait on a 45-day clock. Contact local law enforcement, and in an emergency call 911. Removal requests are a privacy tool, not a safety plan.

FAQ

Does Texas have a law that lets me ask a data broker to delete my data? Yes, with limits. The Texas Data Privacy and Security Act (Business and Commerce Code chapter 541) says a controller shall comply with an authenticated consumer request to delete personal data provided by or obtained about the consumer, and must respond within 45 days. Publicly available information is not personal data under the act, and small businesses are outside the chapter.

Is there a Texas data broker registry, and does it remove me from anything? The Secretary of State runs a searchable data broker registry under the Texas data broker law (passed as chapter 509, now chapter 510). It is a list of registered companies and their filings. It does not take deletion requests. You still send a request to each broker yourself.

Do people-search sites have to delete my information in Texas? It depends on the site and the data. The TDPSA's definition of personal data excludes publicly available information, which includes information lawfully made available through government records. A people-search listing built from public records can fall outside the deletion request, and a site that is a small business is outside the chapter. The site's own opt-out is usually the faster route.

Does Global Privacy Control work in Texas? Since January 1, 2025 the TDPSA says a consumer may use a browser setting, extension or device setting to opt out of targeted advertising and the sale of personal data. The statute does not name a specific signal. The signal covers opt-out, not deletion, and it reaches only the sites you visit with it switched on.