Summary

• Texas has expanded its data broker law to cover more entities that collect, process, or transfer personal data not obtained directly from individuals.
• California has broadened the data broker definition and tied it to registration and deletion infrastructure under the DELETE Act.
• Both states are moving beyond simple registration toward security programs, risk assessments, notices, and consumer-rights disclosures.
• The regulatory burden is shifting toward indirect-data businesses, including firms that handle third-party personal information or brokered data.
• Texas enforcement and legislative activity suggest a broader privacy push that also includes AI governance and children's data protections.
• California's DROP platform and higher registration fees show a move toward operational privacy mechanisms, not just paperwork compliance.
• The topic is coherent and fairly dense, with a strong state-regulatory frame and limited fragmentation beyond differences in state design.