1. (a) A controller shall provide consumers with a reasonably accessible and clear privacy notice that includes:

   1. (1) the categories of personal data processed by the controller, including, if applicable, any sensitive data processed by the controller;
   2. (2) the purpose for processing personal data;
   3. (3) how consumers may exercise their consumer rights under Subchapter B, including the process by which a consumer may appeal a controller's decision with regard to the consumer's request;
   4. (4) if applicable, the categories of personal data that the controller shares with third parties;
   5. (5) if applicable, the categories of third parties with whom the controller shares personal data; and
   6. (6) a description of the methods required under Section 541.055 through which consumers can submit requests to exercise their consumer rights under this chapter.

2. (b) If a controller engages in the sale of personal data that is sensitive data, the controller shall include the following notice:

   "NOTICE: We may sell your sensitive personal data." The notice must be posted in the same location and in the same manner as the privacy notice described by Subsection (a).

3. (c) If a controller engages in the sale of personal data that is biometric data, the controller shall include the following notice:

   "NOTICE: We may sell your biometric personal data." The notice must be posted in the same location and in the same manner as the privacy notice described by Subsection (a).

Added by Acts 2023, 88th Leg., R.S., Ch. 995 (H.B. 4), Sec. 2, eff. July 1, 2024.