U.S. Vermont Act 171 of 2018 — Data Broker Regulation

Why does it matter?

Act 171 defines data brokers by relationship rather than by data type: a business is a data broker when it sells or licenses brokered personal information about consumers who are not its customers, users, employees, investors or donors (9 V.S.A. section 2430(4)). The annual filing is public, so a broker's opt-out method, the activities consumers cannot opt out of and its prior-year breach count are on record with the Secretary of State (section 2446(a)). A broker that does not register owes $50 a day up to $10,000 a year plus unpaid fees (section 2446(b)), and one without the section 2447 security program commits an unfair and deceptive act under section 2453. From January 1, 2027, Act 138 adds a $900 fee, a $20,000 bond, $200 a day for operating unregistered and breach notice to the Attorney General.

Key benefits include:

• A public registration record

Registration with the Secretary of State on or before January 31 after any year in which the definition is met, with name and addresses, opt-out practices, purchaser credentialing, breach count and minors' data practices (section 2446(a)).

• A security program the statute itemizes

Section 2447(b) and (c) list ten program elements and eight computer system requirements, from a designated owner and annual review to encryption on portable devices and lockout after failed logins.

• Prohibited uses of brokered data

No one may acquire brokered personal information through fraudulent means or acquire or use it for stalking, harassment, fraud, identity theft or unlawful discrimination (section 2433(a)).

• Attorney General enforcement

Violations of sections 2433 and 2447 are unfair and deceptive acts under section 2453, with the Attorney General's chapter 63 investigation and civil action powers; the Attorney General also sues for unpaid registration penalties (section 2446(c)).

• A dated set of changes ahead

Act 138 of 2026 rewrites subchapter 5 from January 1, 2027: registration within 30 days of meeting the definition and annually by July 1, a $900 fee, a $20,000 bond, recipient verification before disclosure and the Data Broker Security Breach Notice Act.

How does it work?

Section 2430 supplies the definitions. Brokered personal information is one or more computerized data elements about a consumer, if categorized or organized for dissemination to third parties: name, address, date or place of birth, mother's maiden name, biometric data, a family or household member's name or address, a Social Security or other government-issued identification number, or other information that would allow a reasonable person to identify the consumer with reasonable certainty; public information about a consumer's business or profession is excluded. A data broker is a business, or a unit of one, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom it has no direct relationship; platform operators, 411 directory assistance, public professional information and safety alerts are excluded, as are one-time asset sales and incidental data sales.

Section 2446(a) requires a data broker, annually on or before January 31 following a year in which it met the definition, to register with the Secretary of State, pay a $100 fee and provide its name and addresses; if it permits opt-outs, the method, the activities or sales covered and whether a third party may opt out for the consumer; the collection, databases or sales a consumer may not opt out of; whether it credentials purchasers; the number of data broker security breaches in the prior year and, if known, the consumers affected; a separate statement of its practices for minors' brokered personal information; and any explanation it adds. A data broker security breach is an unauthorized acquisition, or a reasonable belief of one, of more than one element of unencrypted brokered personal information (section 2430(5)). Failure to register costs $50 a day up to $10,000 a year plus the fees due (section 2446(b)).

Section 2447 requires every data broker to develop, implement and maintain a comprehensive information security program, written in one or more readily accessible parts, with administrative, technical and physical safeguards appropriate to its size, scope and type of business, resources, amount of stored data and the need for security and confidentiality of personally identifiable information (subsection (a)). Subsection (b) lists ten minimum features: designated employees; risk identification and assessment with training, policy compliance and failure detection; policies for records taken off premises; disciplinary measures; cutting off terminated employees; supervision of service providers by selection and contract; physical access restrictions; regular monitoring and upgrades; review at least annually or on a material business change; and documented responsive actions with a post-incident review. Subsection (c) adds eight computer system requirements, to the extent technically feasible: authentication protocols with lockout, need-to-know access with unique IDs and non-default passwords, encryption across public networks and wirelessly, monitoring, encryption on portable devices, firewalls and patches, malware protection, and employee training, each satisfiable by a protocol giving a higher degree of security.

Key Elements

• Brokered personal information (section 2430(1))

Computerized data elements about a consumer organized for dissemination to third parties: name, address, date or place of birth, mother's maiden name, biometric data, family member's name or address, Social Security or other government ID number, or other information that would identify the consumer with reasonable certainty; public professional information is excluded.

• Data broker (section 2430(4))

A business, or a unit of one, that knowingly collects and sells or licenses to third parties the brokered personal information of consumers with whom it has no direct relationship; customers, users, employees, contractors, investors and donors are direct relationships; platform operators, 411 services, public professional information and safety alerts are excluded.

• Annual registration (section 2446(a))

On or before January 31 following a year in which the definition was met: registration with the Secretary of State, a $100 fee, addresses, opt-out practices and limits, purchaser credentialing, prior-year breach count and minors' data practices.

• Comprehensive information security program (section 2447)

A written program with administrative, technical and physical safeguards scaled to the business, the ten minimum features in subsection (b) and the eight computer system requirements in subsection (c).

• Prohibited acquisition and use (section 2433)

No acquisition of brokered personal information through fraudulent means, and no acquisition or use for stalking, harassment, fraud, identity theft or unlawful discrimination in employment or housing.

• Enforcement (sections 2446(b), (c), 2447(d), 2453)

$50 a day up to $10,000 a year plus unpaid fees for failing to register, collected by the Attorney General; violations of sections 2433 and 2447 are unfair and deceptive acts under section 2453 with the Attorney General's chapter 63 powers.

What does it cover?

Subchapter 5 of 9 V.S.A. chapter 62 applies to any business, wherever located, that meets the definition of data broker with respect to consumers residing in Vermont (section 2430(3), (4)); the State, its agencies and political subdivisions are excluded from the definition of business (section 2430(2)). It governs brokered personal information, a different and wider set than the personally identifiable information protected by Vermont's Security Breach Notice Act for data collectors in the same chapter, and section 2447 protects personally identifiable information held by the broker. Businesses that sell only their own customers' data, platform operators, directory assistance providers and publishers of public professional information fall outside the subchapter. Act 171's sections 3 and 4, on free credit security freezes, apply to consumer reporting agencies and are not part of the data broker regime.

What are its objectives?

Act 171 states its intent in section 1: to give consumers more information about data brokers, their data collection practices and the right to opt out, and to protect them from the unauthorized or harmful acquisition and use of their information. Its provisions pursue five ends.

Identify data brokers operating on Vermont consumers through a public annual registration with the Secretary of State (section 2446).

Tell consumers how to opt out of a broker's collection, databases or sales, and where no opt-out exists (section 2446(a)(3)(B), (C)).

Require every data broker to protect the personally identifiable information it holds with a written, itemized security program (section 2447).

Prohibit the fraudulent acquisition of brokered personal information and its use for stalking, harassment, fraud or unlawful discrimination (section 2433).

Make a broker's breach history and its handling of minors' data part of the public record (section 2446(a)(3)(E), (F)).

Framework in Context

Act 171 sits in 9 V.S.A. chapter 62, Protection of Personal Information, beside Vermont's Security Breach Notice Act for data collectors and section 2453, which supplies the enforcement route for sections 2433 and 2447. The section 2447 security program follows, almost clause for clause, the written information security program and computer system requirements of Massachusetts 201 CMR 17.03 and 17.04, so a business covered by both can run one program. Act 138 of 2026 (H.211) replaces much of the subchapter from January 1, 2027: new definitions; a duty in section 2431 to verify the recipient and purpose before disclosing brokered personal information; the Data Broker Security Breach Notice Act in section 2436; registration within 30 days of meeting the definition and annually by July 1 with a $900 fee and a $20,000 bond; expanded disclosures; and fines of $200 a day for operating unregistered, $1,000 a day for incomplete filings and $25,000 for materially incorrect ones.

Common Framework Mappings

Organizations map the section 2447 security program and the section 2446 disclosures to the frameworks below so that one control set and one evidence library serve Vermont, their other state registrations and their auditors.

Mapped frameworks include:

CIS Controls v8.1

CCPA/CPRA

GDPR

ISO 27001:2022

ISO 27701

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2

GovRAMP