Data Broker Registration & Duties
Vermont Data Broker Regulation, as amended in 2026
Vermont · Jan 1, 2019; 2026 amendments effective Jan 1, 2027
The first state data-broker law in the country. Brokers register annually with the Secretary of State by January 31 and must maintain a written information security program. A June 16, 2026 amendment — signed the same day as Vermont's comprehensive privacy law — adds breach-notification duties specific to brokers, expands required disclosures to cover sensitive data and sharing with government agencies, foreign entities, and AI developers, imposes a $20,000 bond requirement, and directs the Secretary of State to build a universal deletion mechanism. Those changes take effect Jan 1, 2027.
This is a general reference, not legal advice or a determination that this law applies to your specific business. Run the full questionnaire to check against your actual revenue, data volume, and data types.