Digital Trust PractitionersAssociation of Digital Trust Practitioners · TrustPractitioners.org
JoinJoin
Regulations › US states › Vermont

Vermont data broker law

Vermont data broker registration law

In force data brokers
WhenIn effect since 1 January 2019
Who enforces itVermont Attorney General and Secretary of State
Who it applies toData brokers that collect and sell data of Vermont residents they have no direct relationship with.

The first state data broker registry, with security program and disclosure requirements.

The law in brief

Vermont passed the first state data broker law in 2018. Data brokers that collect and sell personal information about Vermont residents they have no direct relationship with must register every year, disclose their practices, and keep a written information security program. The law also makes it unlawful to acquire brokered personal information by fraud or to use it to stalk, harass, commit fraud or discriminate.

Who it applies to

  • Data brokers: businesses that knowingly collect and sell or license to third parties the brokered personal information of consumers with whom they do not have a direct relationship.
  • Brokered personal information includes names, addresses, dates and places of birth, family information, biometric data, and other information that allows a reasonable person to identify the consumer.
  • Businesses whose data use is limited to a direct relationship with the consumer, and activities such as consumer reporting under the Fair Credit Reporting Act, are excluded.

What it requires

Register annually

Register with the Secretary of State each year and pay the fee.

Disclose practices and breaches

Disclose whether consumers can opt out and how, any purchaser credentialing process, and the number of data broker security breaches and affected consumers in the prior year.

An information security program

Develop, implement and maintain a comprehensive written information security program with administrative, technical and physical safeguards appropriate to your size and data.

No acquisition by fraud or harmful use

Do not acquire brokered personal information through fraudulent means, or to stalk, harass, commit fraud or engage in unlawful discrimination.

Enforcement and penalties

The Attorney General enforces. Failing to register carries civil penalties per day, capped each year, plus fees; other violations are unfair and deceptive acts under Vermont's consumer protection law.

What's changing

Amended since 2018. Later amendments added disclosures and duties. Check the current statute and registry instructions before filing.

What to do first

  1. Decide whether you are a data broker under Vermont's definition.
  2. Register annually with the Secretary of State and pay the fee.
  3. Disclose whether and how consumers can opt out, whether you verify purchasers, and data broker security breaches in the past year.
  4. Keep a written information security program with the safeguards the law lists.
  5. Screen buyers, so your data is not used for stalking, harassment, fraud or discrimination.

Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.

Recent developments

Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.

Sources