Law / United States / 
Vermont
Data broker registration with the Secretary of State (version in force until January 1, 2027)
In force since .
A data brokers rule binding private bodies.
- Obligation class
- Licensing, Disclosure, Reporting
- Audit expectation
- none
As of .
What it requires
- If you are a data broker (a business that knowingly collects and sells or licenses to third parties the brokered personal information of Vermont residents with whom you have no direct relationship), register with the Secretary of State and pay the $100.00 registration fee on or before January 31 of each year following a year in which you meet that definition.
- In the registration, give your name and primary physical, email and internet addresses, and say whether you implement a purchaser credentialing process.
- In the registration, give the number of data broker security breaches you experienced during the prior year and, if known, the total number of consumers affected.
- If you permit a consumer to opt out of your collection of brokered personal information, of your databases or of certain sales, state in the registration the method for requesting the opt-out, which activities or sales it covers if it covers only certain ones, and whether a consumer may authorize a third party to opt out for them.
- Whether or not you offer an opt-out, state in the registration the data collection, databases or sales activities from which a consumer may not opt out.
- If you have actual knowledge that you possess the brokered personal information of minors, give a separate statement of the data collection practices, databases, sales activities and opt-out policies that apply to it.
- You are not a data broker for developing or maintaining third-party e-commerce or application platforms, for providing directory assistance or directory information services for a telecommunications carrier, or for providing publicly available information related to a consumer's business or profession or via real-time or near-real-time alert services for health or safety purposes, and a one-time or occasional sale of assets in a transfer of control, or a sale or license of data that is merely incidental to the business, is not selling or licensing.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
9 V.S.A. section 2446(b): a data broker that fails to register is liable to the State for a civil penalty of $50.00 for each day, not to exceed a total of $10,000.00 for each year, plus an amount equal to the fees due during the period it failed to register and other penalties imposed by law.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 10,000
- Per violation unit
- Day
- Per violation amount
- 50
Over one month of continuous breach, USD 1,522.
Who enforces it
Enforcement body
Vermont Attorney General, who may maintain an action in the Civil Division of the Superior Court to collect the penalties and to seek injunctive relief (9 V.S.A. section 2446(c)). The Secretary of State receives the registration.
What this law does
A data broker is a business, or unit or units of a business, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship. Brokered personal information is a listed set of computerized data elements about a consumer, among them name, address, date of birth, biometric data and Social Security number, if categorized or organized for dissemination to third parties.
Brokered personal information does not include publicly available information to the extent that it is related to a consumer's business or profession.
Developing or maintaining third-party e-commerce or application platforms, providing directory assistance or directory information services for a telecommunications carrier, and providing publicly available information related to a consumer's business or profession or via real-time or near-real-time alert services for health or safety purposes do not make a business a data broker.
Each year, on or before January 31 following a year in which a person meets the definition of data broker, the data broker must register with the Secretary of State and pay a registration fee of $100.00. The registration must state whether the data broker implements a purchaser credentialing process and the number of data broker security breaches it experienced during the prior year.
Where the data broker has actual knowledge that it possesses the brokered personal information of minors, the registration must include a separate statement detailing the practices, databases, sales activities and opt-out policies that apply to that information.
A data broker that fails to register is liable to the State for a civil penalty of $50.00 for each day, not to exceed a total of $10,000.00 for each year, plus an amount equal to the fees due for the period and other penalties imposed by law. The Attorney General may maintain an action in the Civil Division of the Superior Court to collect the penalties and to seek appropriate injunctive relief.
When LexLint raises it
When your app profile says your app crawls the web.