Vermont Data Broker Law (including the Data Broker Security Breach Notice Act)

Vermont passed the first U.S. data broker registration law in 2018. Data brokers must register each year with the Secretary of State, run a written information security program, and may not sell data for fraud, stalking or discrimination. 2026 Act No. 138, effective Jan. 1, 2027, broadens the definitions, raises the fee to $900, requires a $20,000 bond and much more detailed disclosures, adds buyer verification duties, and creates a separate Data Broker Security Breach Notice Act.