Vermont recently passed a major update to its data broker law (HB 211), joining California and Texas as one of the few states with privacy laws targeting businesses that collect and sell consumer data. Here’s what businesses that collect consumer information and share it with third parties need to know:
- Broader definitions – The law now captures more types of consumer data and narrows when a direct relationship with a consumer actually exists. Translation: more businesses may qualify as data brokers than before.
- Affiliate exception – Sharing data with affiliates is now excluded from the definition of a sale, aligning Vermont with Texas. California remains the only data broker state without this carve-out.
- Higher registration fees and steeper penalties – Vermont’s annual registration fee is now $900 (the highest among data broker states), and daily penalties for failing to register jump from $50 to $200 per day.
- New consumer deletion rights – Businesses must now maintain a webpage where consumers can request deletion of their data, and those requests must be honored within 30 days.
The amendment is currently awaiting the governor’s signature. Once signed, it will significantly raise the stakes for businesses that qualify as a data broker under Vermont law.