Data Broker Regulation

· About Vermont Data Broker Registry and Breach Law

Key Takeaways

  • Vermont’s data broker law applies to businesses that knowingly collect and sell or license brokered personal information of consumers with whom they do not have a direct relationship, and it requires annual registration with the Secretary of State. [12]
  • As enacted in 2026, the law’s substantive amendments take effect on 1 January 2027, while the existing registry framework remains in place until then. [1][7]
  • Data brokers will face a $900 annual registration fee and a $20,000 surety bond running to the State once the 2026 amendments take effect. [1][4]
  • Failure to register can trigger a $200 per day civil penalty with no cap under the amended law, replacing the former $50 per day capped penalty. [4]
  • Vermont also adds new consumer rights and deletion obligations, including requirements tied to brokered personal information and request handling, plus enhanced enforcement for materially incorrect filings. [1][4]
  • The law remains one of the first U.S. data-broker registry regimes and is now materially stronger after the 2026 amendments. [3][12]

What It Is

Vermont’s data broker regime is a state registration and disclosure law that targets companies meeting the state’s definition of a data broker and requires annual filing with the Vermont Secretary of State. [12] The registry is enforced by the Vermont Secretary of State under Title 9, Chapter 62, with civil penalties available for non-registration and noncompliance. [12]

The original registry law has been in place since Vermont became the first state to create a data broker registry, and the statute in force as of 2026 is codified at 9 V.S.A. § 2446. [12] In 2026, Vermont enacted H.211 / Act 138, which significantly expands the regime by increasing fees, requiring a bond, adding disclosures, and creating new obligations related to brokered personal information and consumer requests. [1][4][7]

On the current record, the key 2026 amendment package was signed on 16 June 2026 and is scheduled to take effect on 1 January 2027. [1][2][7] Some earlier 2026 bill drafts contemplated different effective dates and filing deadlines, but those were superseded by the enacted act. [4][10][15]

Who Must Comply

The law applies to a person or business that meets the statutory definition of a data broker, meaning it knowingly collects and sells or licenses brokered personal information of consumers with whom it does not have a direct relationship. [12] The filing obligation is tied to the year in which the business meets that definition, and annual registration is required thereafter. [12]

The statute’s reach is not limited to Vermont-incorporated entities; what matters is whether the business meets the statutory definition and handles covered consumer data in the relevant manner. [12] The registration system is therefore functionally extraterritorial in application to out-of-state firms that qualify as data brokers under Vermont law. [12]

The statute also includes exemptions built into the definition of data broker and related provisions, so not every ad-tech, analytics, or data processing company is automatically covered. [12] The specific exemption analysis turns on whether the business falls within the statutory exclusions in Chapter 62 and whether it actually sells or licenses brokered personal information as defined by Vermont law. [12]

Core Requirements

  1. Annual registration — Covered data brokers must register with the Vermont Secretary of State annually, and the filing is due on or before January 31 following the year in which the business met the data broker definition under the current statute. [12] Under the 2026 amendment package, the registration framework is also updated to require annual filing after the effective date. [4][7]
  1. Fee payment — The annual registration fee is $100 under the current statute, but the 2026 amendments raise it to $900. [12][4] The higher fee is part of the post-2026 compliance package that funds the expanded registry and related consumer functions. [1][4]
  1. Surety bond — Beginning with the amended regime, a data broker must maintain a $20,000 surety bond running to the State for liabilities arising under the subchapter. [4] This requirement is a significant new financial assurance mechanism and is not part of the pre-amendment baseline statute. [12][4]
  1. Registration disclosures — A registering broker must provide identifying and contact information and additional details about opt-out mechanics and data practices, as set out in 9 V.S.A. § 2446 and expanded by the 2026 act. [12][4] The amended law also requires more detailed disclosures about collection, sharing, and sale practices. [1]
  1. Amendment of incomplete or inaccurate filings — If a broker omits required registration information, it must file an amendment within 30 days after discovering or being notified of the omission. [4] Materially incorrect registration information can trigger a separate $25,000 civil penalty under the amended law. [4]
  1. Consumer request handling and deletion-related duties — The 2026 act adds new obligations around consumer rights and deletion of personal information upon request, moving Vermont beyond a pure registry model. [1][2] These duties are among the principal reasons the 2026 amendments are material for privacy programs already built around registration-only obligations. [1]

Deadlines and Penalties

| Milestone | Date | What applies | |---|---:|---| | Enactment signed | 16 June 2026 | H.211 / Act 138 was signed into law. [1][7] | | General effective date | 1 January 2027 | Expanded fee, bond, disclosure, consumer-rights, and enforcement provisions take effect. [1][2][7] | | Annual registration deadline | 31 January | Registration is due annually after the year a person meets the data broker definition under the current statute. [12] | | Filing amendment for omission | 30 days after discovery or notice | A broker must amend a deficient registration within 30 days. [4] |

Under the pre-amendment statute, a failure to register can result in a $50 per day civil penalty, capped at $10,000 per year. [12] Under the 2026 amendments, the failure-to-register penalty increases to $200 per day with no cap. [4] The amended law also contemplates a $1,000 per day penalty for failing to file a required amendment after notice or discovery of missing information, and a $25,000 penalty for materially incorrect registration information. [4]

Other sanctions include the surety bond requirement, which creates an additional financial exposure layer, and the possibility of state enforcement for noncompliant registration or inaccurate filings. [4][12]

How to Comply

  1. Map your business model against the Vermont definition — Determine whether the company knowingly collects and sells or licenses brokered personal information of consumers with whom it lacks a direct relationship. [12] This definition should be tested against actual data flows, not marketing labels.
  1. Build a Vermont data-broker inventory — Identify all business units, vendors, and product lines that could trigger registration, including affiliates and acquired businesses. [12] Use this inventory to set annual filing ownership and escalation paths.
  1. Align the privacy program to a control framework — Use ISO 27001 for security governance, access control, incident management, and supplier oversight; use NIST CSF 2.0 to structure risk identification, protection, detection, response, and recovery; and use ISO 42001 where automated profiling or AI-enabled data brokerage affects governance and accountability. These standards do not replace the statute, but they map well to the operational controls Vermont expects around data handling and security.
  1. Prepare registration content early — Collect the Secretary of State filing data, consumer opt-out descriptions, and practice disclosures before the annual deadline. [12][4] Treat the amended regime as requiring evidence-backed answers, not just a form submission. [1][4]
  1. Implement a correction workflow — Create a 30-day clock for any omission or discovered inaccuracy in the registration and route issues to legal and compliance immediately. [4] Preserve audit trails showing when an issue was discovered and how it was remedied.
  1. Budget for the bond and higher fee — Add the $900 fee and $20,000 bond to annual compliance budgeting for 2027 onward. [4] Confirm whether the bond must be maintained continuously and how claims are handled under the amended statute. [4]
  1. Operationalize consumer request handling — Update privacy notices, intake channels, and downstream systems so that deletion or related consumer requests can be authenticated, tracked, and completed within statutory timelines once the amendments are effective. [1][2] Test the process across vendors and data stores, including archives and backups where legally required.
  1. Train legal, privacy, and engineering teams — Train staff on the difference between registry obligations, consumer rights, and security controls so that filing, deletion, and breach workflows do not conflict. The most common failure mode is treating the Vermont regime as a simple annual report rather than a continuing compliance program. [1][4][12]

Related Regulations

The California Delete Act overlaps with Vermont because both regulate data brokers and deletion rights, but California uses a separate state deletion mechanism and registry framework. The Vermont Consumer Data Privacy Act can overlap on consumer rights and controller obligations, but it covers a broader class of businesses than the data broker-specific statute. The Massachusetts data security law overlaps on security safeguards and breach response, but it does not impose Vermont-style broker registration or bonding. The Vermont breach notification law overlaps on incident response and consumer notice, while the data broker amendments add broker-specific disclosure and penalty rules. The EU GDPR can overlap for organizations handling personal data of EU residents, but Vermont’s registry, bond, and state filing obligations are distinct and may apply in addition to GDPR duties.

FAQ

Does the Vermont data broker law apply to companies outside Vermont?

Yes, if an out-of-state company meets Vermont’s statutory definition of a data broker. The trigger is the nature of the business and data activities, not just where the company is incorporated or headquartered. [12]

When do the 2026 amendments start?

The enacted 2026 amendments are scheduled to take effect on 1 January 2027. The law was signed on 16 June 2026, but the expanded fee, bond, disclosure, and enforcement provisions are not operative until the effective date. [1][2][7]

What happens if a data broker does not register?

Under the current statute, failure to register can lead to a $50 per day civil penalty capped at $10,000 per year. The 2026 amendments sharply increase that exposure to $200 per day with no cap, making timely registration a major enforcement risk. [12][4]

Does the law require a surety bond?

Yes, under the 2026 amendments, data brokers must maintain a $20,000 surety bond running to the State. This requirement is part of the enhanced compliance package and is a notable departure from the pre-amendment regime. [4]

Does the law create consumer deletion rights?

Yes, the 2026 amendments add deletion-related obligations and broader consumer-rights features beyond the original registry model. Those obligations become effective with the rest of the amendment package on 1 January 2027. [1][2]

Is the filing only a one-time registration?

No, the Vermont framework requires annual registration. Under the current statute, the filing is due on or before January 31 following the year the business met the definition of a data broker, and the amended law continues to require ongoing compliance. [12][4]

Sources

Put it into practice

More compliance guides