A person other than the owner or operator of the computer may not knowingly cause computer software to be copied to a computer in this state and use the software to:

1. (1) collect personally identifiable information through intentionally deceptive means:

   1. (A) by using a keystroke-logging function; or
   2. (B) in a manner that correlates that information with information regarding all or substantially all of the websites visited by the owner or operator of the computer, other than websites operated by the person collecting the information; or

2. (2) cull, through intentionally deceptive means, the following kinds of personally identifiable information from the consumer's computer hard drive for a purpose wholly unrelated to any of the purposes of the software or service described to an owner or operator of the computer:

   1. (A) a credit or debit card number;
   2. (B) a bank account number;
   3. (C) a password or access code associated with a credit or debit card number or a bank account;
   4. (D) a social security number;
   5. (E) account balances; or
   6. (F) overdraft history.

Added by Acts 2007, 80th Leg., R.S., Ch. 885 (H.B. 2278), Sec. 2.01, eff. April 1, 2009.