Vermont Data Broker Registration Law: Requirements and Deadlines

What Vermont’s data broker law requires, maintained by Stauss PLLC. Last reviewed August 2026.

What You Need to Know

Vermont's law requires data brokers to annually register with the state and pay a registration fee. The law was significantly amended in 2026 with those changes effective January 1, 2027. The amendments include a new requirement for data brokers to post a bond.

Official law text

How Vermont defines and regulates data brokers

Who counts as a data broker	A business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship note “Direct relationship” means that a consumer has intentionally interacted with a business for the purpose of accessing, purchasing, using, requesting, or obtaining information about the business’s products or services. A consumer does not have a direct relationship with a business if the purpose of the consumer’s engagement is to exercise a consumer right or for the business to verify the consumer’s identity. A business does not have a direct relationship with a consumer simply because the business collects brokered personal information directly from the consumer; the consumer must intend to interact with the business. A business is still a data broker and does not have a direct relationship with a consumer as to the brokered personal information the business sells about the consumer that it collected outside of a first-party interaction with the consumer.
Which businesses it applies to	“Business” means a commercial entity, including a sole proprietorship, partnership, corporation, association, LLC, or other group, however organized and whether or not organized to operate at a profit, including a financial institution organized, chartered, or holding a license or authorization certificate under the laws of Vermont, any other state, the United States, or any other country, or the parent, affiliate, or subsidiary of a financial institution, but does not include the State of Vermont, a State agency, any political subdivision of the State, or a vendor acting solely on behalf of, and at the direction of, the State
Information covered	“Brokered personal information” means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household.
Other provisions	Data brokers must maintain a $20,000 bond that runs to the state for any liability arising from violations of data broker law Data brokers must maintain procedures requiring prospective users of brokered personal information to identify themselves, state the purposes for which information is sought, and certify that the information shall be used for no other purpose Data brokers must conduct due diligence on recipients of brokered personal information Data brokers have separate security breach notification obligations Data brokers must have comprehensive information security programs
Penalties	$200 per day for failing to register plus registration fees $1,000 per day for each day data broker fails to provide all required registration information starting 30 days after discovery $25,000 civil penalty plus $1,000 per each day data broker fails to correct materially incorrect information starting 30 days after discovery

Compliance requirements5

Requirement	Applies?
Annual Registration Requirement	Yes
Registration Disclosure Obligations	Yes
Privacy Policy Disclosure Obligations	No
Creates Substantive Consumer Rights	No
Delete Request & Opt-out Platform (DROP)	No

Tracking Vermont data broker law? We write about it as the law changes.

Key dates5

Date	What happens
January 1, 2027	Amendments to Vermont's data broker law take effect
January 31, 2027	Annual deadline for Vermont data brokers to register
January 31, 2028	Annual deadline for Vermont data brokers to register
January 31, 2029	Annual deadline for Vermont data brokers to register
January 31, 2030	Annual deadline for Vermont data brokers to register

Questions about Vermont’s data broker law?

Stauss PLLC advises companies on state privacy, AI, and data broker compliance.

Contact Stauss PLLC

Follow Vermont’s data broker law

Our analysis, by email, as the law moves.

This page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.