Vermont recently amended its data broker registry law with the passage of H.211. The changes take effect January 1, 2027. As amended, the law will modify who is covered, disclosures that must be made at registration and due diligence obligations. This is a significant expansion of the law, which currently only requires data brokers to protect brokered personal information. Some highlights to keep in mind:
- Recipient Verifications. Once the amendment goes into effect, before a broker shares brokered personal information, the broker will need to, among other things, verify the identity of the recipient, review its intended use purposes, and not share the data if the broker has a reasonable reason to think the information will be used in violation of the law.
- Definitional Expansion. The law will expand the definition of covered “brokered personal information.” Beginning January 1, 2027, it will cover any information that links, or can reasonably link, to a known or knowable person. It will also cover information tied to a device used by someone in a household. This includes derived data and unique IDs.
- Disclosures at Registration. As amended, a data broker will need to say when registering if, in the past year, it sold or shared consumer data with specific entities. This includes foreign actors, government agencies, and law enforcement (unless pursuant to a subpoena or court order). It also includes developers of generative AI systems or models.
Under the law, the Secretary of State will be required to keep a web page that not only publicly lists all registered data brokers, but keeps the list in downloadable form.
Putting it into Practice: These changes are a reminder that data broker activities are on the forefront of regulators’ minds. Many states, including California, Texas, and Oregon, have requirements that are similar -although not identical- to these in Vermont.