Answers
Privacy law mechanics
9 short answers on Privacy law mechanics. Each one is checked against primary sources and written in plain words.
All answers
Vermont data broker law: definition and penalties
The Vermont data broker law (9 V.S.A. 2430 and 2446) defines a broker as a business that sells personal information of people it has no direct relationship with.
Do I need to register as a data broker to license my data?
On plain text, Vermont and Oregon treat staff and customers as direct relationships, so you may not be a broker. Texas and California leave more room for mixed archives.
Are data brokers legal? A state-by-state map
Yes, data brokers are legal. Six states now regulate them.
Can I license EU employee data to AI?
The GDPR sets four checks: lawful basis, compatible purpose, notice of the new purpose, and national employee rules under Article 88. The EDPB says trained models cannot be considered anonymous in all cases.
Is licensing data to an AI lab a sale under CCPA?
Under Civil Code 1798.140(ad)(1), a transfer of personal information for monetary or other valuable consideration is a sale. Two exits exist: a third party that assumes control of the business, or data that meets the deidentified definition.
Texas data broker law: who must register
The Texas data broker law is Chapter 509, amended by SB 2121, effective 1 September 2025. It covers businesses handling personal data they did not collect directly, if that is over 50% of revenue or 50,000+ people.
Does the DOJ bulk data rule apply to company data?
It can, when the buyer is foreign. The DOJ rule, 28 CFR Part 202, prohibits transfers to covered persons and requires contract terms against onward transfer for other foreign recipients.
Can AI re-identify anonymized emails and Slack?
Maybe. Three 2026 preprints show LLMs matching accounts at 68% recall and re-identifying 79.2% of identities, but none tested company email or Slack.
Do I need a new privacy policy to license data to AI?
It depends on what your old notices said. California requires notice at or before collection.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
Could your company's data be licensed?
Answer a few questions about the systems you run and the records you hold. You get a readiness result and a plain list of what to check next. You never upload data.
Our only referral relationship is with micro1, an AI data company. It may pay us a fee if a company we introduce goes ahead with it. You pay nothing extra. How we are paid · How we handle your data
- Fit checkSeven questions
- RightsSeven more
- PathYou choose
