Applies to persons who conducts business in the state that controlled or processed the personal data of 25,000 consumers or 12,500 consumers and derives 25% of gross revenue from the sale of personal data, decreases threshold to 6,250 by 2028; provides certain exemptions, including third party administrators, victims or witness of child abuse, domestic violence, human trafficking, and sexual assault, nonprofits established to detect and prevent fraud, certain noncommercial activities, and radio and television; provides consumer rights to confirm whether a controller is processing the consumer’s personal data, access to personal data, using or will use data in any artificial intelligence, obtain a list of third parties to which personal data is disclosed, correct inaccuracies, delete personal data, obtain a copy of personal data processed, or opt out; provides how and who may exercise rights; provides duties for controllers to limit collection and processing, provide reasonable administrative, technical, and physical data privacy practices, provide a mechanism for a consumer to withdraw consent; prohibits a controller from processing sensitive data, sell sensitive data, discriminate or retaliate, discriminate; provides duties for processors; requires a data protection assessment; provides protections for de-identified data; provides the attorney general with enforcement powers.

Exempts 501(c)(3) nonprofits from data privacy law; applies to entities that control or process the personal data of at least 100,000 consumers, excluding data used solely to complete payment transactions; applies to entities that control or process the personal data of at least 25,000 consumers and derive more than 25 percent of their revenue from the sale of personal data; exempts certain research, health care, and commercial uses of information and data; establishes consumer rights to access their data, correct inaccuracies, delete personal data, and obtain copies of personal data processed by a controller; restricts the use of children's data; requires processors and controllers to retain certain records; establishes opt-out, appeal, and complaint procedures; requires processors and controllers to maintain data security, and to provide consumers with notice of privacy practices; establishes duties of processors and regulates contracts between data controllers and processors; requires data controllers to conduct and document periodic data protection assessments, and allows the Attorney General to use the reports to assess compliance; sets rules for de-identified and pseudonymous data; enumerates permitted data uses by controllers and processors; provides for a notice of violations and opportunity to cure, with penalties for failure to cure violations after 60 days; clarifies that there is no private right of action under the Act; protects privacy of consumer health data; prohibits using a geofence to determine when consumers are near a health care facility.

Lowers the thresholds above which controllers of data are subject to regulation when processing personal data of consumers; reduces the threshold from 100,000 to 35,000 consumers for controllers or processors of personal data, other than data used solely for payment transactions; reduces the threshold from 25,000 to 10,000 consumers for controllers or processors that derive 20% percent or more, down from 25%, of annual gross revenue from selling personal data; prohibits controllers from processing sensitive data for targeted advertising or to profile consumers in furtherance of decisions that produce legal effects or effects of similar significance; prohibits selling sensitive data for any reason, with or without a consumer's consent; requires a clear and conspicuous disclosure to consumers that the controller may not sell sensitive data for any reason, or process sensitive data for targeted advertising or to profile consumers in furtherance of decisions that produce legal effects or effects of similar significance.

Prohibits any person or nonprofit organization from providing a public agency with personal information or compel the release of personal information; prohibits any public agency from releasing, publicizing, or publicly disclosing personal information; prohibits any public agency from requesting or requesting nay current or prospective contractor or grantee from providing a list of nonprofit organizations that has provided financial or nonfinancial support; exempts reports disclosures required by state law, warrants, discovery, evidence, voluntary release, collection of information in reports filed with the Secretary of State, information derived from a donation, national securities law; provides for penalties; UPDATE - included in state budget S.257. UPDATE - new status.

Prohibits any person or nonprofit organization from providing a public agency with personal information or compel the release of personal information; prohibits any public agency from releasing, publicizing, or publicly disclosing personal information; prohibits any public agency from requesting or requesting nay current or prospective contractor or grantee from providing a list of nonprofit organizations that has provided financial or nonfinancial support; exempts reports disclosures required by state law, warrants, discovery, evidence, voluntary release, collection of information in reports filed with the Secretary of State, information derived from a donation, national securities law; provides for penalties; redirects $500 million for Hurricane Helene recovery efforts in western North Carolina; $60 million for child care subsidy rates; appropriates funding for a child care workforce pilot program and mental and behavioral health programs in child care.

Authorizes the attorney general to bring action or dissolve a nonprofit if it is established that the nonprofit has been convicted for illegally committing, or attempting, soliciting, or conspiring to commit, an offense under federal law pertaining to the prevention of unauthorized landing of aliens or human smuggling. AMENDED to remove all nonprofit provisions and only apply to individuals.

Expands the Attorney General's ability to investigate the organization, conduct, and management of Texas corporations, including nonprofits, and foreign corporations, to determine whether they are or have violated state law or their own governing documents; allows the Attorney General to require organizations to file sworn written statements providing all information requested by the AG in connection with an investigation, and to examine any person under oath; provides for forfeiture of the right to do business in the state and potential loss of business registration or certificate of formation for failure to cooperate with an AG investigation, unless a court finds the organization had a good-faith reason not to provide requested documents, and did not refuse compliance to cause delay; provides for criminal penalties for removing, concealing, withholding, destroying, mutilating, altering, or falsifying a record with intent to avoid compliance with an investigation; imposes fines up to $5,000 and other criminal penalties; allows investigated entities to petition a state court for additional time to respond to investigative requests. Companion bill H.B. 4852.

Expands the Attorney General's ability to investigate the organization, conduct, and management of Texas corporations, including nonprofits, and foreign corporations, to determine whether they are or have violated state law or their own governing documents; allows the Attorney General to require organizations to file sworn written statements providing all information requested by the AG in connection with an investigation, and to examine any person under oath; provides for forfeiture of the right to do business in the state and potential loss of business registration or certificate of formation for failure to cooperate with an AG investigation, unless a court finds the organization had a good-faith reason not to provide requested documents, and did not refuse compliance to cause delay; provides for criminal penalties for removing, concealing, withholding, destroying, mutilating, altering, or falsifying a record with intent to avoid compliance with an investigation; imposes fines up to $5,000 and other criminal penalties; allows investigated entities to petition a state court for additional time to respond to investigative requests. Companion bill S.B. 2340.

Allows a charitable organization to be held liable for loss, damages, injury, or death resulting from a criminal offense committed by the person who they know is unlawfully present in the US while the person is receiving housing services from the charitable organization if providing the housing constitutes negligence, gross negligence, or willful and wanton misconduct; companion to HB 811. AMENDED to provide that housing means long-term living accommodations, including assistance in obtaining or signing a lease, but does not include temporary overnight housing such as that provided by a homeless shelter.

Allows a charitable organization for loss, damages, injury, or death resulting from a criminal offense committed by the person who is unlawfully present in the US while the person is receiving housing services from the charitable organization if providing the housing constitutes negligence, gross negligence, or willful and wanton conduct; companion to SB 227. "Dead" because SB 227 passed.