Vermont Data Broker Registry: Filing, Deadlines, and Penalties

The Vermont data broker registry requires any business that knowingly collects and sells or licenses personal information about consumers it has no direct relationship with to register with the Secretary of State by January 31 each year, pay a $100 annual fee, and file seven categories of disclosures about its practices.¹ The registry is public. Consumers can search it to see which companies trade in their data and how, if at all, to opt out.

Who Has to Register

Vermont law defines a data broker as a business that knowingly collects and sells or licenses the personal information of consumers with whom it does not have a direct relationship.² The direct-relationship test does most of the work. A retailer selling shoes to a customer has a direct relationship with that customer and is not a data broker for that transaction. A company that scrapes public records, buys mailing lists, or aggregates browsing behavior to build profiles for resale almost certainly is, because the people in those profiles never chose to do business with it.

“Brokered personal information” covers names, addresses, dates and places of birth, biometric data such as fingerprints or iris scans, Social Security numbers, government-issued IDs, and information about immediate family or household members. It also reaches any combination of data that would let a reasonable person identify a specific consumer.² The data must be computerized and organized for dissemination to third parties. A company that holds customer records internally for its own use falls outside the definition.

The direct-relationship carve-out protects ordinary businesses from accidentally becoming data brokers. A bank, doctor’s office, or insurer that shares customer data with service providers as part of delivering a product the consumer signed up for generally has a direct relationship with that consumer. The question is whether the consumer would reasonably expect the company to have their information. When the answer is no, the company is likely operating as a data broker.

What the January 31 Filing Requires

Every data broker must register by January 31 of each year following a year in which it met the statutory definition and pay a flat $100 annual fee.¹ A company that first qualified as a data broker in 2025, for example, owes its first registration by January 31, 2026.

The filing itself has seven required components:¹

The broker’s legal name, physical address, email address, and website URL.
If the broker offers a consumer opt-out from collection, from its databases, or from certain sales, a description of the request method, which activities the opt-out covers, and whether a third party can submit the request on a consumer’s behalf.
A statement identifying any collection, databases, or sales from which a consumer cannot opt out.
Whether the broker screens or verifies the identity and intended use of the companies that buy its data.
The number of data breaches the broker experienced in the prior year and, if known, the total number of consumers affected.
If the broker has actual knowledge that it holds personal information about minors, a separate statement describing its collection practices, databases, sales activities, and opt-out policies for that data.
Any additional explanation the broker chooses to provide about its practices.

The minors’ disclosure is triggered only by actual knowledge. The statute does not require brokers to investigate whether their databases include minors, but a broker that knows they do must lay out its practices in detail.

How to File

Registration runs through the Secretary of State’s online portal, which accepts the $100 fee electronically and issues a confirmation receipt once the submission processes.³ If the filing is incomplete or contains errors, the portal flags what needs correcting before the submission can finalize.

Completed registrations appear in a publicly searchable database maintained by the Secretary of State’s office. Consumers and researchers can look up any registered broker and read its filed disclosures, including the opt-out method if one exists.

What the Registry Gives Consumers

Vermont’s law does not require data brokers to offer an opt-out. It requires transparency. Brokers that offer opt-outs must explain how they work, and brokers that don’t must say so. Some registered brokers plainly state that consumers cannot stop the collection or sale of their data. That admission is itself useful, because it tells consumers which companies to push back against through other channels.

For brokers that do offer opt-outs, the registry filing must specify the method, whether it applies to all activities or only certain sales, and whether the consumer can authorize someone else to submit the request.¹ Mechanisms range from dedicated web forms to email addresses, and responsiveness varies. Document every request and follow up if confirmation does not arrive.

One boundary matters here: Vermont’s data broker law does not give consumers a private right of action. You cannot personally sue a broker for failing to register. Enforcement runs exclusively through the Attorney General’s office, so consumer complaints to that office are the practical way to flag non-compliant companies.

Penalties for Skipping Registration

A data broker that fails to register faces a civil penalty of $50 for each day it remains unregistered, up to $10,000 per year.¹ The state can also recover an amount equal to the registration fees the broker should have paid during the non-compliance period, plus any other penalties available under law. Trying to save $100 by ignoring the registry gets expensive fast.

The Attorney General can sue in the Civil Division of the Superior Court to collect these penalties and to seek injunctive relief.¹ Injunctive relief could mean a court order compelling registration, requiring changes to business practices, or halting operations until the company complies. Separately, violations of the data broker duties under § 2447 are treated as unfair and deceptive acts in commerce, which opens up the full range of Vermont consumer protection remedies.⁴

A Pending Bill Would Raise the Stakes

H.211, introduced in the 2025–2026 session, would raise the daily penalty from $50 to $200 and remove the $10,000 annual cap entirely.⁵ As of early 2026, the bill has not been enacted. If it passes, unregistered brokers face daily fines four times larger with no ceiling on the accumulated total.

Federal Rules That May Also Apply

Registering in Vermont does not end a data broker’s compliance picture. The FTC enforces the Protecting Americans’ Data from Foreign Adversaries Act, which prohibits data brokers from selling sensitive personal information to entities controlled by certain foreign governments, with civil penalties that can exceed $53,000 per incident.⁶ The CFPB has also proposed rules to clarify when data brokers qualify as consumer reporting agencies under the Fair Credit Reporting Act, which would trigger federal accuracy and dispute-resolution requirements. A Vermont-registered company can still face federal enforcement if its practices reach either regime.

1
Vermont General Assembly. Vermont Code 9 VSA 2446 – Annual Registration
2
Vermont General Assembly. Vermont Code 9 VSA 2430 – Definitions
3
Vermont Secretary of State. Data Broker
4
Vermont General Assembly. Vermont Code 9 VSA 2447 – Duties of Data Brokers; Prohibited Acts
5
Vermont Legislative Joint Fiscal Office. H.211 – An Act Relating to Data Brokers and Personal Information
6
Federal Trade Commission. FTC Reminds Data Brokers of Their Obligations to Comply with PADFAA