Sale of Personal Data (Texas Data Privacy and Security Act)
In Texas, selling personal data means sharing, disclosing or transferring it to a third party for monetary or other valuable consideration. The other-valuable-consideration language is broader than the monetary-only definitions some states use, so data exchanges, advertising pixels and cooperative arrangements can qualify. Selling triggers opt-out rights, a conspicuous disclosure, and a documented data protection assessment.
The Texas definition of sale is broad, and businesses that concluded they do not sell data usually reached that conclusion under a different state's definition. Tex. Bus. & Com. Code § 541.001 defines the sale of personal data as the sharing, disclosing or transferring of personal data for monetary or other valuable consideration by the controller to a third party.
Other valuable consideration is the whole point
Nevada and a few other regimes limit sale to transfers for monetary consideration, which lets most advertising technology arrangements out. Texas does not. If a controller passes personal data to a third party and receives something of value back, the transfer is a sale whether or not money moves. Analytics access granted in exchange for data. Audience matching where both sides gain. An advertising pixel that transmits identifiers to a platform in return for better targeting and measurement tools the controller would otherwise pay for. Cooperative databases where members contribute records to draw from a shared pool.
The question to ask about a vendor relationship is not what the contract calls it. Ask what the recipient does with the data, and whether the controller receives value it would otherwise have to buy. Free tooling is consideration.
What is carved out
Section 541.001 removes five things from the definition. Disclosure of personal data to a processor that processes the data on the controller's behalf. Disclosure to a third party for purposes of providing a product or service requested by the consumer. Disclosure or transfer of personal data to an affiliate of the controller. Disclosure of information the consumer intentionally made available to the general public through a mass media channel and did not restrict to a specific audience. And disclosure or transfer as an asset that is part of a merger, acquisition, bankruptcy or similar transaction in which a third party assumes control of all or part of the controller's assets.
The processor exclusion is the one worth building around. A vendor that contracts under § 541.104(b), takes instructions, and does not use the data for its own purposes is a processor, and sending data there is not a sale. The same vendor reserving rights to use client data for its own product development is not a processor, and the transfer is a sale. That distinction is decided by conduct and contract language, not by the label on the invoice.
What selling obligates you to do
Three duties attach at once. Under § 541.051(b)(5)(B) a consumer may opt out of the sale of personal data, and under § 541.055(e) that opt-out can arrive as a browser or device signal rather than through a form. Under § 541.103 a controller that sells personal data to third parties must clearly and conspicuously disclose that it does so, together with the manner in which a consumer may exercise the right to opt out. Under § 541.105 the sale of personal data requires a documented data protection assessment.
If what is being sold is sensitive data, § 541.102(b) requires the exact sentence "NOTICE: We may sell your sensitive personal data." in the same location and in the same manner as the privacy notice. Biometric personal data carries its own required string under § 541.102(c). And a business exempt from the chapter because it is an SBA small business still may not engage in the sale of personal data that is sensitive data without prior consent from the consumer, under § 541.107.