Cybersecurity Policy Report, Vermont Governor Signs Bill to Overhaul Data Broker Regulations, (Jun 17, 2026)
Vermont Gov. Phil Scott (R.) this week signed into law a bill to update and expand the state’s regulation of data brokers by broadening definitions, introducing new terms, increasing registration requirements and penalties, and strengthening consumer protections and breach notification rules.
Under HB 211, data brokers are now required to register with the secretary of state within 30 days, pay an increased annual registration fee of $900, and maintain a $20,000 bond. The registration process requires detailed disclosures about data collection practices, types of data collected (including sensitive categories like biometric and reproductive health data), and data sharing with entities such as foreign actors, government agencies, and AI developers.
The new law increases penalties for noncompliance, with daily fines for failure to register or provide accurate information, and a $25,000 penalty for materially incorrect filings.
The legislation also broadens key definitions, such as “brokered personal information,” to include any information linked or reasonably linkable to an identified or identifiable individual or device and introduces new terms such as biometric data, precise geolocation, and generative artificial intelligence.
In addition, the new law directs the secretary of state to study the feasibility of creating an accessible, centralized deletion mechanism that would allow consumers to request deletion of their brokered personal information from all registered data brokers through a single, verifiable request. An interim report is due in December 2027, and a final report is due December 2028. Funding for the studies may be supported by a data broker registry fund, which holds monies from registration fees and penalties.
The law also introduces new registration and reporting requirements for providers of educational technology products used in Vermont schools. These providers must disclose product information, privacy policies, and attest compliance with state and federal student privacy laws, including the Vermont Age-Appropriate Design Code Act and the federal Children’s Online Privacy Protection Act.
The data broker and educational technology provisions of the new law will take effect in 2027. The bill (H.B. 211, Reg Sess.) was sponsored by Rep. Monique Priestley (D.).
News: StateLegislation DataPrivacy DataBreach