Vermont Data Broker Registry and Breach Law

Unique requirement for data brokers to register with state and comply with specific security standards. First-in-nation data broker regulation.

JurisdictionVermont
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

Compliance Challenges

Implementation Best Practices

  • Develop and Document a Written Information Security Program Use established frameworks such as NIST SP 800-53 or ISO/IEC 27001 to guide security program development. NIST SP 800-53 ISO/IEC 27001

Recent Updates

  • Vermont Data Privacy Act (VDPA) – 2024 In May 2024, Vermont passed the VDPA, expanding privacy protections and enforcement mechanisms. The VDPA introduces a limited private right of action (until 2029), enhanced enforcement by the Attorney General, and increased penalties for violations (up to $10,000 per unfair or deceptive act). Vermont General Assembly – VDPA Bill Status CookieYes – Vermont Data Privacy Act

Related Regulations

  • Gramm-Leach-Bliley Act (GLBA) GLBA imposes information security and privacy requirements on financial institutions, some of which may overlap with Vermont’s requirements for data brokers. Federal Trade Commission – GLBA
  • General Data Protection Regulation (GDPR) GDPR applies to organizations processing personal data of EU residents, with broad security and transparency requirements similar to Vermont’s law. European Commission – GDPR
  • Interaction and Overlap Organizations subject to multiple regimes must harmonize compliance efforts, particularly regarding data mapping, breach notification, and consumer rights. IAPP – Comparing US State Privacy Laws

Industry Impact

Sources

Recent developments

  • — This update notes that Vermont’s amended data broker law includes a breach notice regime requiring notice to consumers within 45 days and preliminary notice to the Attorney General within 14 business days. It also says the law mandates a public, downloadable registry of registered data brokers and adds substantial penalties for noncompliance.[1] (source)
  • — The same July update says Vermont’s law requires the Secretary of State to maintain a publicly accessible downloadable spreadsheet of all registered data brokers. It also notes that the law contemplates a study of a California-style accessible deletion mechanism, signaling possible future policy changes.[1] (source)
  • — Vermont Governor Phil Scott signed H.B. 211 into law, significantly expanding the state’s data broker framework. The amendments add new registration disclosures, recipient-verification duties, and a dedicated breach-notice regime, with most operative provisions taking effect on 2027-01-01.[4] (source)
  • — This analysis says the new law raises the annual registration fee from $100 to $900 and requires a $20,000 surety bond. It also highlights expanded due-diligence obligations before sharing brokered personal information and a data-broker-specific breach reporting requirement.[5] (source)
  • — Sheppard reports that Vermont’s amendments broaden the definition of brokered personal information and require verification of recipients’ identity and intended use before disclosure. The article also notes new registration disclosures about sales or sharing with foreign actors, government agencies, law enforcement, and generative AI developers.[6] (source)
  • — IAPP reports that Vermont’s law creates annual registration obligations for data brokers and sets the fee at $900. It also says sections covering data brokers take effect on 2027-01-01, while other provisions begin in 2026.[10] (source)
  • — The law increases the penalty for failing to register to $200 per day, with separate penalties for incorrect filings and failure to correct omissions after notice. This is a significant enforcement escalation compared with Vermont’s prior regime.[4] (source)
  • — Industry commentary describes the law as adding a KYC-like screening obligation for data brokers before they sell data. The article frames the change as a meaningful operational burden for businesses that buy and sell personal data without a direct consumer relationship.[5] (source)
  • — Sheppard characterizes the amendments as a major expansion of Vermont’s existing law rather than a narrow update. The firm says the changes affect who is covered, what must be disclosed at registration, and how brokers must vet recipients of brokered data.[6] (source)
  • — IAPP notes that Vermont also directed a study of a statewide deletion mechanism and established a Cybersecurity Advisory Council. These adjacent measures suggest the data broker changes are part of a broader state privacy and security policy package.[10] (source)
  • — CalPrivacy advisory highlights enforcement focus on data brokers, urging assessment of "data broker" status even if not core business, ahead of 2026 deadlines.[3] (source)
  • — California's DROP launch for data brokers risks huge fines for non-compliance with registration and deletion requests under expanded Delete Act rules.[8] (source)

Read the full guide to Vermont Data Broker Registry and Breach Law

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates