Tracks devices, in Vermont

9 V.S.A. § 2445 (Added 2005, No. 162 (Adj. Sess.), § 1, eff. Jan. 1, 2007) · Read the law's page

• This binds a business, any sole proprietorship, partnership, corporation, association, limited liability company or other group however organized and whether or not organized to operate at a profit, including a financial institution, but never the State, a State agency or a political subdivision of the State; a customer's personal information covered is a signature, Social Security number, physical description, passport number, driver's license or State identification card number, insurance policy number, bank account number, credit card number, debit card number, or other financial information.
• Take all reasonable steps to destroy or arrange for the destruction of a customer's records containing personal information once the business no longer retains them, by shredding, erasing or otherwise modifying the information to make it unreadable or indecipherable through any means.
• An entity in the business of disposing of personal financial information on another business's behalf must implement and monitor policies and procedures that protect against unauthorized access to or use of the information during and after its collection, transportation and disposal.
• This duty applies to disposal only; it does not itself require safeguarding personal information that remains in active use, and it exempts a Gramm-Leach-Bliley-compliant financial institution, a HIPAA-compliant health insurer or facility, and an FCRA-compliant consumer reporting agency.
• A violation is investigated and prosecuted by the Attorney General or a State's Attorney, who may seek remedies under the Consumer Protection Act including a civil penalty of up to $10,000.00 for each violation, or by the Department of Financial Regulation for a business it licenses or registers, which acts under its own Title 8 and Title 9 powers; the section does not itself state whether a violation carries a private right of action.

9 V.S.A. sec. 2431(a) · Read the law's page

• This binds any person, not only a data broker: do not acquire brokered personal information (as section 2430 defines the term) through fraudulent means.
• Do not acquire or use brokered personal information for the purpose of stalking or harassing another person, committing a fraud (including identity theft, financial fraud or email fraud), or engaging in unlawful discrimination (including employment discrimination and housing discrimination).

9 V.S.A. sec. 2447 · Read the law's page

• If you are a data broker (as section 2430 defines the term in each version), the duty in section 2447 reads the same before and from January 1, 2027: the only change in section 2447's own text on that date is that the Attorney General's rulemaking authority in subdivision (d)(2) refers to the provisions of the section where it referred to the provisions of the chapter. The definitions the duty relies on do change on that date: section 2430 rewrites the definition of data broker, and rewrites personally identifiable information so that it excludes all publicly available information (until then it excluded only publicly available information lawfully made available from government records) and does not require a name where any listed data element is sufficient to perform or attempt identity theft against the consumer. Develop, implement and maintain a comprehensive information security program, written in one or more readily accessible parts, with administrative, technical and physical safeguards appropriate to the size, scope and type of your business, your resources, the amount of data you store and the need for security and confidentiality of personally identifiable information.
• Adopt safeguards in the program that are consistent with the safeguards for protection of personally identifiable information and information of a similar character set forth in other State rules or federal regulations that apply to you.
• At minimum, designate one or more employees to maintain the program; identify and assess reasonably foreseeable internal and external risks to the security, confidentiality and integrity of paper, electronic and other records containing personally identifiable information, with a process for evaluating and improving the safeguards, including ongoing employee training (temporary and contract employees included), employee compliance with policies and procedures, and means for detecting and preventing security system failures.
• At minimum, have security policies for employees on the storage, access and transportation of records containing personally identifiable information outside business premises, disciplinary measures for violations of the program's rules, measures that prevent terminated employees from accessing those records, and reasonable restrictions on physical access to those records and on their storage in locked facilities, storage areas or containers.
• At minimum, supervise service providers: take reasonable steps to select and retain third-party providers capable of maintaining appropriate security measures consistent with applicable law, and require them by contract to implement and maintain appropriate security measures for personally identifiable information.
• At minimum, monitor regularly that the program operates in a manner reasonably calculated to prevent unauthorized access to or use of personally identifiable information, upgrade safeguards as necessary, and review the scope of the security measures at least annually or whenever there is a material change in business practices that may reasonably implicate the security or integrity of those records.
• At minimum, document the responsive actions you take in connection with any incident involving a breach of security, and carry out a mandatory post-incident review of events and actions taken, making changes in business practices relating to protection of personally identifiable information where needed.
• To the extent technically feasible, include secure user authentication protocols; secure access controls that restrict access to those who need the information for their job duties and give each person with computer access a unique identification and a password that is not a vendor-supplied default; encryption of records and files containing personally identifiable information that travel across public networks or are transmitted wirelessly, and of such information stored on laptops or other portable devices (or a protocol that provides a higher level of security); reasonable monitoring of systems for unauthorized use or access; up-to-date firewall protection and operating system security patches for files on an Internet-connected system; up-to-date system security agent software with malware protection; and employee education and training on the proper use of the computer security system and the importance of personally identifiable information security.

9 V.S.A. sec. 2431(b), (c); 2026 Vt. Acts & Resolves Act 138, Sec. 1 · Read the law's page

• If you are a data broker (as section 2430 defines the term from January 1, 2027), maintain procedures that require each prospective user of your brokered personal information to identify themselves, state the purposes for which the information is sought, and certify that the information shall be used for no other purpose.
• Before you disclose brokered personal information to a prospective user, make a reasonable effort to verify the identity of the prospective user and review the user's stated purposes.
• Do not disclose brokered personal information to a prospective user if you have reasonable grounds for believing that the information will be used to violate State or federal law or will not be used for the purposes the user stated.

9 V.S.A. sec. 2436 · Read the law's page

• If you are a data broker, notify each consumer affected by a data broker security breach in the most expedient time possible and without unreasonable delay, and not later than 45 days after discovery or notification, consistent with the needs of law enforcement and with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security and confidentiality of the data system.
• Notify the Attorney General of the date of the breach and the date of discovery and provide a preliminary description of the breach within 14 business days after discovery, and when you notify consumers tell the Attorney General the number of Vermont consumers affected, if known, and give it a copy of the consumer notice.
• You need not give notice if you establish that misuse of the brokered personal information is not reasonably possible and give the Attorney General notice of that determination with a detailed explanation. If you later obtain facts indicating that misuse has occurred or is occurring, give the notice section 2436(b) requires.

9 V.S.A. secs. 2430, 2446; 2026 Vt. Acts & Resolves Act 138, Sec. 1 · Read the law's page

• Beginning January 1, 2027, under section 2446 as rewritten by Act 138 of 2026, register with the Secretary of State as a data broker (a business, or unit or units of a business, that knowingly collects and sells or licenses to third parties the brokered personal information of a Vermont consumer with whom it does not have a direct relationship; a consumer has a direct relationship only if the consumer has intentionally interacted with the business to access, purchase, use, request or obtain information about its products or services, has none if the purpose of the engagement is to exercise a consumer right or for the business to verify the consumer's identity, and has none merely because the business collected the information directly from the consumer; a business is still a data broker as to information it sells that it collected outside a first-party interaction; the exclusions in the version until 2027 for e-commerce and application platforms, directory assistance and sales merely incidental to the business are not in the rewritten definition; and publicly available information is outside brokered personal information, except that biometric data collected without the consumer's knowledge, obscene visual depictions, genetic data the consumer did not make public and nonconsensual intimate images are not publicly available information) not more than 30 days after you meet the definition and again on or before July 1 each year, pay the $900.00 registration fee, and maintain a $20,000.00 bond that runs to the State for any liability arising under the subchapter (an action on the bond must be brought within two years after the cause of action accrues).
• In the registration, give your name, primary physical, email and internet addresses and phone number; whether you implement a purchaser credentialing process; the number of data broker security breaches you experienced during the prior year and, if known, the total number of consumers affected; and, where you have actual knowledge that you possess the brokered personal information of minors, a separate statement of the data collection practices, databases, sales activities and opt-out policies that apply to it.
• State in the registration whether you collect each of the listed kinds of data: precise geolocation; reproductive health care data; biometric data; immigration status; sexual orientation; union membership status; name, date of birth, zip code, email address or phone number; an account login or number with the code that would permit access to a third-party account; a driver's license, State identification, Social Security, passport, military or other unique government identification number; and a mobile advertising, connected television or vehicle identification number.
• State in the registration whether, in the past year, you shared consumers' data with or sold it to a foreign actor, the federal government, other state or local governments, law enforcement (unless the data was shared under a subpoena or other court order) or a developer of a GenAI system or model; and, if you collect none of the name, date of birth, zip code, email address or phone number items and none of the government identification numbers, give the three most common types of personal information you collect.
• File with the registration an electronic copy of your bond and your current privacy policy, and give the URL of a page on your website that, if you permit deletion, lets a consumer ask you to delete their brokered personal information and that tells consumers whether they may opt out of your databases or certain sales, the procedure for requesting an opt-out, which activities or sales it covers, whether an authorized agent may opt out for them and the collection, databases or sales from which they may not opt out.
• State in the registration whether and to what extent you or any of your subsidiaries is regulated by the Fair Credit Reporting Act.
• Amend your registration when the section or the State requires, for an administrative fee of $100.00; if you left out required registration information or filed materially incorrect information, file an amendment supplying or correcting it not later than 30 days after you discover the problem or are notified of it.