Vermont Tightens Data Broker Law, Requiring Disclosure of 3 Sensitive Data Categories
Updated
Updated · POLITICO · Jun 25
Vermont Tightens Data Broker Law, Requiring Disclosure of 3 Sensitive Data Categories
3 articles · Updated · POLITICO · Jun 25
Summary
Vermont updated its data broker registry law in June, forcing companies to say whether they sell sensitive information including location data, sexual orientation and immigration status.
4 states now require data brokers to register publicly, turning the databases into directories for deletion requests and potential enforcement targets as lawmakers seek more transparency over hidden data sellers.
Connecticut passed a similar registry measure in May, effective in 2027, while Texas and California also advanced the bipartisan approach despite lobbying opposition from the Consumer Data Industry Association.
Washington is weighing narrower federal versions, including a House kids' safety proposal that would cover only under-18 data and omit deletion rights, raising concern broader registries could lose momentum.
As states build powerful data privacy walls, will a new federal law tear them down in the name of a unified standard?
Can a single click truly erase your digital footprint, or is California's universal 'delete button' just a privacy placebo?
Vermont Enacts Nation-Leading Data Privacy Laws: New Consumer Rights, Expanded Sensitive Data, and Strict Broker Penalties Effective 2027–2028
Overview
In June 2026, Vermont enacted new data privacy and broker laws that significantly strengthen consumer control and transparency over personal data. The amendments to the data broker law will take effect on January 1, 2027, followed by a broader consumer privacy law on January 1, 2028. These laws set specific thresholds for businesses, targeting organizations with substantial consumer data exposure. Vermont also increased penalties for non-compliance, such as daily fines for failing to register as a data broker. Together, these actions position Vermont as a leader in protecting personal information and holding businesses accountable.