Law / United States / 
Vermont
Data broker registration, bond and expanded disclosures (section 2446 as rewritten by Act 138 of 2026)
9 V.S.A. secs. 2430, 2446; 2026 Vt. Acts & Resolves Act 138, Sec. 1
A data brokers rule binding private bodies.
- Obligation class
- Licensing, Disclosure, Reporting
- Audit expectation
- none
As of .
What it requires
- Beginning , under section 2446 as rewritten by Act 138 of 2026, register with the Secretary of State as a data broker (a business, or unit or units of a business, that knowingly collects and sells or licenses to third parties the brokered personal information of a Vermont consumer with whom it does not have a direct relationship; a consumer has a direct relationship only if the consumer has intentionally interacted with the business to access, purchase, use, request or obtain information about its products or services, has none if the purpose of the engagement is to exercise a consumer right or for the business to verify the consumer's identity, and has none merely because the business collected the information directly from the consumer; a business is still a data broker as to information it sells that it collected outside a first-party interaction; the exclusions in the version until 2027 for e-commerce and application platforms, directory assistance and sales merely incidental to the business are not in the rewritten definition; and publicly available information is outside brokered personal information, except that biometric data collected without the consumer's knowledge, obscene visual depictions, genetic data the consumer did not make public and nonconsensual intimate images are not publicly available information) not more than 30 days after you meet the definition and again on or before July 1 each year, pay the $900.00 registration fee, and maintain a $20,000.00 bond that runs to the State for any liability arising under the subchapter (an action on the bond must be brought within two years after the cause of action accrues).
- In the registration, give your name, primary physical, email and internet addresses and phone number; whether you implement a purchaser credentialing process; the number of data broker security breaches you experienced during the prior year and, if known, the total number of consumers affected; and, where you have actual knowledge that you possess the brokered personal information of minors, a separate statement of the data collection practices, databases, sales activities and opt-out policies that apply to it.
- State in the registration whether you collect each of the listed kinds of data: precise geolocation; reproductive health care data; biometric data; immigration status; sexual orientation; union membership status; name, date of birth, zip code, email address or phone number; an account login or number with the code that would permit access to a third-party account; a driver's license, State identification, Social Security, passport, military or other unique government identification number; and a mobile advertising, connected television or vehicle identification number.
- State in the registration whether, in the past year, you shared consumers' data with or sold it to a foreign actor, the federal government, other state or local governments, law enforcement (unless the data was shared under a subpoena or other court order) or a developer of a GenAI system or model; and, if you collect none of the name, date of birth, zip code, email address or phone number items and none of the government identification numbers, give the three most common types of personal information you collect.
- File with the registration an electronic copy of your bond and your current privacy policy, and give the URL of a page on your website that, if you permit deletion, lets a consumer ask you to delete their brokered personal information and that tells consumers whether they may opt out of your databases or certain sales, the procedure for requesting an opt-out, which activities or sales it covers, whether an authorized agent may opt out for them and the collection, databases or sales from which they may not opt out.
- State in the registration whether and to what extent you or any of your subsidiaries is regulated by the Fair Credit Reporting Act.
- Amend your registration when the section or the State requires, for an administrative fee of $100.00; if you left out required registration information or filed materially incorrect information, file an amendment supplying or correcting it not later than 30 days after you discover the problem or are notified of it.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
9 V.S.A. section 2446(b)(1): a data broker that fails to register is liable to the State for an administrative fine of $200.00 for each day it fails to register, the fees that were due during that period and any reasonable costs incurred by the State in the investigation and administration of the action as the court deems appropriate. Section 2446(d) separately makes a violation an unfair and deceptive act under section 2453 and lets the Attorney General sue under chapter 63, subchapter 1, where section 2458(b)(1) allows a civil penalty of up to $10,000 for each such act. Subdivision (b)(2) adds a civil penalty of $1,000.00 per day after 30 days for omitted registration information, and (b)(3) a civil penalty of $25,000.00 for materially incorrect information plus $1,000.00 per day if it is not corrected within 30 days.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Day
- Per violation amount
- 200
Over one month of continuous breach, USD 6,088.
Who enforces it
Enforcement body
Vermont Attorney General, who has the authority to adopt rules and to conduct civil investigations, enter into assurances of discontinuance and bring civil actions as provided under chapter 63, subchapter 1 of title 9 (9 V.S.A. section 2446(d)(2)). A violation is an unfair and deceptive act in commerce in violation of section 2453 (section 2446(d)(1)). The Secretary of State receives the registration.
What this law does
Sections 1 and 4 of Act 138 of 2026 take effect on . Brokered personal information means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household.
Brokered personal information does not include publicly available information. Publicly available information means information made available through federal, state or local government records or to the general public from widely distributed media, or that a data broker has a reasonable basis to believe the consumer has lawfully made available to the general public.
Publicly available information does not include biometric data collected by a business about a consumer without the consumer's knowledge, any obscene visual depiction, genetic data unless the consumer made it publicly available, or intimate images known to be nonconsensual.
A consumer has a direct relationship with a business only where the consumer has intentionally interacted with the business for the purpose of accessing, purchasing, using, requesting or obtaining information about its products or services. A consumer does not have a direct relationship with a business if the purpose of the consumer's engagement is to exercise a consumer right or for the business to verify the consumer's identity.
A business is still a data broker as to the brokered personal information it sells about a consumer that it collected outside of a first-party interaction with the consumer. A data broker must register with the Secretary of State not more than 30 days after meeting the definition of a data broker and then once annually on or before July 1, pay a registration fee of $900.00 and maintain a bond of $20,000.00 that runs to the State for any liability arising under the subchapter.
The registration must state whether the data broker collects the mobile advertising identification number, connected television identification number or vehicle identification number of consumers. The registration must also state whether, in the past year, the data broker has shared consumers' data with or sold it to a foreign actor, the federal government, other state or local governments, law enforcement unless under a subpoena or other court order, or a developer of a GenAI system or model.
A data broker that fails to register is liable to the State for an administrative fine of $200.00 for each day, the fees that were due, and any reasonable costs incurred by the State in the investigation and administration of the action as the court deems appropriate.
A data broker that fails to provide all required registration information must file an amendment not later than 30 days after discovering or receiving notification of the omission and is liable for a civil penalty of $1,000.00 per day thereafter. A data broker that files materially incorrect information in its registration is liable to the State for a civil penalty of $25,000.00 and must correct it within 30 days, or owe an additional $1,000.00 for each day it fails to correct it.
A person who violates the section commits an unfair and deceptive act in commerce in violation of section 2453 of title 9, and the Attorney General has the authority to conduct civil investigations, enter into assurances of discontinuance and bring civil actions as provided under chapter 63, subchapter 1 of that title. The Secretary of State must maintain a public page with a downloadable spreadsheet of the data brokers that have registered and the information each provided.
In the subchapter a consumer is an individual residing in Vermont and does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer or contractor of a company, partnership, sole proprietorship, nonprofit organization or government agency whose communications or transactions with the data broker occur solely within the context of that individual's role.
When LexLint raises it
When your app profile says your app crawls the web or tracks devices.