(a) A person described by Section 541.002(a)(3) may not engage in the sale of personal data that is sensitive data without receiving prior consent from the consumer.
(b) A person who violates this section is subject to the penalty under Section 541.155.