Law / United States / 
Vermont
Data broker duty to vet prospective users of brokered personal information (section 2431(b) as added by Act 138 of 2026)
9 V.S.A. sec. 2431(b), (c); 2026 Vt. Acts & Resolves Act 138, Sec. 1
A data brokers rule binding private bodies.
- Obligation class
- Governance, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you are a data broker (as section 2430 defines the term from ), maintain procedures that require each prospective user of your brokered personal information to identify themselves, state the purposes for which the information is sought, and certify that the information shall be used for no other purpose.
- Before you disclose brokered personal information to a prospective user, make a reasonable effort to verify the identity of the prospective user and review the user's stated purposes.
- Do not disclose brokered personal information to a prospective user if you have reasonable grounds for believing that the information will be used to violate State or federal law or will not be used for the purposes the user stated.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 2431(c)(1) makes a violation an unfair and deceptive act in commerce under section 2453, and section 2431(c)(2) gives the Attorney General the authority to bring civil actions as provided under chapter 63, subchapter 1. Section 2458(b)(1) in that subchapter allows the court, in an action by the Attorney General or a State's Attorney, to impose a civil penalty of not more than $10,000.00 for each unfair or deceptive act or practice in commerce. Section 2431 states no penalty of its own.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Vermont Attorney General, who has the same authority to adopt rules, conduct civil investigations, enter into assurances of discontinuance, bring civil actions and take other enforcement actions as provided under chapter 63, subchapter 1 of title 9 (9 V.S.A. section 2431(c)(2) as effective ). A violation is an unfair and deceptive act in commerce in violation of section 2453 (section 2431(c)(1)).
What this law does
Sections 1 and 4 of Act 138 of 2026 take effect on . From that date a data broker must maintain procedures that require prospective users of its brokered personal information to identify themselves, state the purposes for which the information is sought, and certify that the information shall be used for no other purpose.
Before disclosing brokered personal information to a prospective user, a data broker must make a reasonable effort to verify the identity of the prospective user and review the user's stated purposes. A data broker must not disclose brokered personal information to a prospective user if it has reasonable grounds for believing that the information will be used to violate State or federal law or will not be used for the purposes the user stated.
A person who violates the section commits an unfair and deceptive act in commerce in violation of section 2453 of title 9. The Attorney General has the same authority to adopt rules to implement the section and to conduct civil investigations, enter into assurances of discontinuance, bring civil actions and take other enforcement actions as provided under chapter 63, subchapter 1 of that title.
When LexLint raises it
When your app profile says your app crawls the web or tracks devices.