Vermont Data Broker Law (including the Data Broker Security Breach Notice Act)

VT Data Broker Law

Data brokers · Data security · Breach notification

Vermont passed the first U.S. data broker registration law in 2018. Data brokers must register each year with the Secretary of State, run a written information security program, and may not sell data for fraud, stalking or discrimination. 2026 Act No. 138, effective Jan. 1, 2027, broadens the definitions, raises the fee to $900, requires a $20,000 bond and much more detailed disclosures, adds buyer verification duties, and creates a separate Data Broker Security Breach Notice Act.

Where: Vermont
Citation: 9 V.S.A. §§ 2430, 2431, 2436, 2446-2447 (9 V.S.A. ch. 62, subchs. 1, 2 and 5)
Status: In force
In force since: 2019-01-01
Last amended: 2027-01-01
Enforced by: Vermont Attorney General; Vermont Secretary of State maintains the registry
People can sue: Limited
Penalties: Currently, failing to register costs $50 per day (up to $10,000 per year) plus unpaid fees. From Jan. 1, 2027 (Act 138): an administrative fine of $200 per day for not registering, $1,000 per day for omitted information not fixed within 30 days, and $25,000 for materially incorrect information plus $1,000 per day until corrected. Violations of §§ 2431, 2447 and (from 2027) § 2446 are also unfair and deceptive acts under § 2453, carrying AG civil penalties up to $10,000 per violation; a consumer action under § 2461(b) may be arguable.
Applies to: Data brokers: businesses that knowingly collect and sell or license to third parties the brokered personal information of consumers with whom they have no direct relationship
Any person, for the ban on acquiring or using brokered personal information for fraud, stalking, harassment or unlawful discrimination (§ 2431)

What a privacy notice must say

From 2027: registration must give the URL of a web page telling consumers how to opt out and, if deletion is offered, how to request deletion.9 V.S.A. § 2446(a)(4)(I) as amended · From 2027-01-01

Practices it requires

No person may acquire brokered personal information by fraud, or acquire or use it for stalking, harassment, fraud or unlawful discrimination.9 V.S.A. § 2431(a)
From 2027: before disclosing brokered personal information, require buyers to identify themselves and certify their purposes, make a reasonable effort to verify their identity, and refuse disclosure if the data will likely be misused.9 V.S.A. § 2431(b) as amended by 2026 Acts No. 138 · From 2027-01-01

Security duties

Develop, implement and maintain a written comprehensive information security program with administrative, technical and physical safeguards, including encryption of transmitted and portable data, access controls, monitoring and employee training.9 V.S.A. § 2447(a)-(c)

Breach duties

From 2027: notify affected consumers of a data broker security breach within 45 days of discovery, and notify the Attorney General with a preliminary description within 14 business days.9 V.S.A. § 2436(b) (added by 2026 Acts No. 138) · From 2027-01-01

Registration

From 2027: register within 30 days of becoming a data broker and by July 1 each year, pay $900, keep a $20,000 bond, and disclose collection of sensitive categories (such as precise geolocation, reproductive health, biometric and immigration data) and sales to foreign actors, governments, law enforcement or generative AI developers.9 V.S.A. § 2446(a) as amended by 2026 Acts No. 138, Sec. 1 · From 2027-01-01
Register annually with the Secretary of State by Jan. 31 after any year in which the business met the data broker definition, pay a $100 fee and disclose opt-out options, purchaser credentialing, breaches and practices involving minors.9 V.S.A. § 2446(a)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Act 138 also directs the Secretary of State to study an accessible one-stop deletion mechanism (report due Dec. 1, 2028); the study's details were not reviewed. | The Secretary of State registration page still describes the pre-2027 January 1-31 filing window.

Research reference, not legal advice.