Vermont's New Data Broker Law (2027): What It Does and Doesn't Do

Vermont was the first state to make data brokers register, back in 2018. On June 16, 2026, Governor Phil Scott signed H.211, now Act 138, which rewrites those rules from January 1, 2027. Some summaries describe it as a new deletion right. We read the act as enacted, and it is not one. Here is what it actually changes, and what Vermonters can do about brokers today.

The Short Version

• Effective January 1, 2027: higher registration fee ($900, up from $100), a new $20,000 bond, a broader definition of data broker, and many more disclosures.
• Not in this act: a duty for brokers to delete your data when you ask. Brokers must link a deletion page only "if the data broker permits deletion."
• Being studied: a single request that reaches every broker, like California's DROP. Final report due December 1, 2028.
• Separate law: Vermont's comprehensive privacy law, Act 145, gives residents a deletion right from January 1, 2028.

Who Counts as a Data Broker

Under the amended definition, a data broker is a business that knowingly collects and sells or licenses the personal information of a consumer it has no direct relationship with. The act gives examples of a direct relationship: you are a past or present customer, subscriber or user, an employee or contractor, or an investor. A "consumer" is an individual residing in Vermont.

That covers the people-search sites most people worry about, and the marketing and risk data companies behind them.

What Brokers Must Do From 2027

1. Register faster. Within 30 days of meeting the definition, then every year by July 1. The old law gave brokers until January 31 of the following year.
2. Pay $900 a year instead of $100.
3. Hold a $20,000 bond payable to the state for liability under the law.
4. Disclose what they collect. Whether they collect precise geolocation, reproductive health care data, biometric data, immigration status, sexual orientation, union membership, login credentials, government ID numbers, or mobile advertising, connected TV or vehicle identifiers.
5. Disclose who they sell to. Whether in the past year they shared or sold data to a foreign actor, the federal government, other state or local governments, law enforcement without a subpoena or court order, or a developer of a generative AI system.
6. Disclose minors' data practices if they know they hold it.
7. List an opt-out page explaining whether you can opt out, how, and what the opt-out covers.

The Deletion Question

This is where some coverage of the law goes further than the text. The registration section asks for the URL of a page that, quote, "if the data broker permits deletion, allows a consumer to request that a data broker delete the brokered personal information of the consumer." That is a disclosure about a broker's own policy. We did not find a section in Act 138 that requires a broker to delete on request or sets a deadline to do it.

So from January 2027 you will be able to see, in the state registry, which brokers say they delete. That is useful. It is not the same as a legal right to make them.

A Statewide Deletion Tool Is Only Being Studied

Section 2 of the act directs the Secretary of State to study an "accessible deletion mechanism." It would let a consumer send one verifiable request to every registered broker at once, which is how California's DROP works. The interim report is due December 1, 2027, and the final report, with any proposed legislation, December 1, 2028. Nothing gets built until lawmakers act on it.

Penalties

• Failing to register: $200 for each day, plus the fees that were due.
• Missing registration information: $1,000 a day if not fixed within 30 days of discovery or notice.
• Materially incorrect information: $25,000, plus $1,000 a day until corrected.

The Attorney General enforces the law and can investigate and sue.

What Vermonters Can Do Now

1. Use the registry. Vermont's Secretary of State already publishes registered brokers. It is a ready-made list of who to contact.
2. Ask anyway. Many brokers accept deletion requests from any US resident, not only from states with a law. Others will say no. Either way, a written request and the broker's reply are on record. Our free deletion letter generator writes one in a minute.
3. Start with people-search sites. They publish your address and phone to anyone. The opt-out steps for each are in our free guides.
4. Mark January 1, 2028. That is when Act 145 gives Vermont residents a general right to delete personal data held by covered businesses.

Frequently Asked Questions

Is Act 138 the same as Vermont's new privacy law?

No. Act 138 (H.211) amends the data broker registration law. The Vermont Data Privacy and Online Surveillance Act is Act 145 (S.71), signed the same day, and it takes effect January 1, 2028.

Does this law apply if I don't live in Vermont?

The act defines a consumer as an individual residing in Vermont. Brokers that register still disclose their practices publicly, so anyone can read the registry.

Can a broker charge me to delete my data?

Act 138 does not address fees for deletion, because it does not create a deletion right. Check the broker's own policy, and keep its answer.

Where can I read the law?

The bill status and enacted text are on the Vermont Legislature's H.211 page.