Vermont data broker law: definition and penalties
The short answer
The Vermont data broker law (9 V.S.A. 2430 and 2446) defines a broker as a business that sells personal information of people it has no direct relationship with. Brokers register by 31 January for $100 per year. Failing to register costs $50 per day, capped at $10,000 per year.
Vermont's text matters for a company with its own archive. The direct-relationship list names employees and customers.
Legally, a "data broker" resells consumer data and must register in some states. This site calls AI data companies buyers. It keeps "data broker" for the legal term.
Who counts as a data broker in Vermont?
The definition has three parts. It needs a business that knowingly collects and sells or licenses brokered personal information. The information must be about a consumer with whom the business has no direct relationship. Each part has to be met.
Brokered personal information covers computerized data elements. Examples are names, addresses, birth dates, biometric data and Social Security numbers.
Does licensing my own staff and customer data make me a broker?
On the text, the direct-relationship list covers three groups:
- Past and present employees, contractors and agents.
- Past and present customers, clients, subscribers and users.
- Investors and donors.
A sale limited to those people doesn't fit "no direct relationship."
Mixed archives are less settled. A person who appears only inside a customer's email thread isn't obviously on that list. I found no Vermont guidance or case on archive licensing.
What does registration cost, and when is it due?
Section 2446 sets an annual fee of $100. Registration is due on or before 31 January. That is the January after a year in which a person meets the definition.
What is the penalty?
According to section 2446, a broker that fails to register faces a civil penalty. It is $50 for each day, up to $10,000 for each year.
What should I gather first?
Note whether any list in your archive was bought, imported or enriched from another source. Those people may sit outside the direct-relationship list. Your lawyer decides whether the definition fits your facts.
How does Vermont compare with Texas?
Texas drops the direct-relationship wording. It asks whether data was collected directly. The register or not page lays the states side by side. Our state map covers the rest.
Talk to a privacy or commercial lawyer in your state before you sign.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
