Vermont data broker registration
Vermont: data broker registration, by 31 January each year, moving to 1 July from 2027 under Act 138, at the Vermont Secretary of State.
Who registers
A business that knowingly collects and sells or licenses the brokered personal information of consumers it has no direct relationship with. No FCRA, GLBA or HIPAA entity exemption. Until 31 December 2026, e-commerce platforms, directory assistance, public business or profession data, alert services and merely incidental sales are carved out; Act 138 deletes those carve-outs from 1 January 2027.
When and what it costs
- First registration
- Between 1 and 31 January after any year you met the definition; from 1 January 2027, within 30 days of meeting it Fee $100, rising to $900 from 2027.
- Renewal
- By 31 January each year, moving to 1 July from 2027 under Act 138, $100, rising to $900 from 2027.
- Bond
- From 1 January 2027 a $20,000 surety bond running to the State, with a copy filed with the Secretary of State; no bond form is published yet
- Where
- the Vermont Secretary of State
- Public notice
- From 2027 the registration asks for the URL of your opt-out and deletion rights page, copies of the bond and privacy policy, sensitive-data categories, FCRA status, and sharing with foreign actors, government or generative-AI developers; breaches go to the Attorney General within 14 business days.
- If missed
- Today $50 a day, capped at $10,000 a year; from 1 January 2027 $200 a day with no cap, $1,000 a day for an incomplete filing and $25,000 for a materially incorrect one (Act 138).
- Rule
- 9 V.S.A. 2446-2447; Act 138 (H.211) of 2026 (source, read 2026-09-30)
- From 2027-01-01
- Fee $900, $20,000 bond, 30-day initial registration, annual date 1 July, stricter direct-relationship test, carve-outs removed, new disclosure fields.
- Also
- We keep 31 January 2027 as the next date because it is the earlier reading; we will move the row to 1 July once the Secretary of State publishes the transition.
How DROP runner handles it
DROP runner runs your California deletion cycle every 45 days. Its calendar also carries every state registry you tick: the first-cycle deadline where a registry is new, the renewal date each year (on your own anniversary where the state works that way), the fee, and a link to the official place to file. Reminders arrive 45, 30, 14, 7 and 1 days ahead. You file and pay yourself.
Other states: California, Connecticut, Oregon, Texas. Information from the state's own published rules; not legal advice.