Data brokers would verify people seeking brokered information and notify officials and affected Vermont consumers after certain breaches.
Data brokers would have to verify who receives brokered personal information and why, and report certain breaches to officials and affected Vermont consumers.
Data brokers would pay a $900 yearly registration fee, provide more business information, and face daily or civil penalties for registration violations.
The Secretary of State would study an online tool that could let consumers delete their brokered information across different data brokers, with a report due in 2028.
Three members would be added to the Cybersecurity Advisory Council, while educational technology providers would give the state more business and product information.
Data brokers would verify a person and the person’s purpose before disclosing brokered personal information. The rule covers data brokers handling brokered personal information, including information about Vermont residents. The data broker must verify both the person receiving the information and the purposes for using it. When applicable, data brokers must notify the Attorney General and affected consumers about breaches involving Vermonters’ brokered personal information. The act lists multiple effective dates beginning July 1, 2026, but this summary does not assign a specific date to each requirement.
Data brokers would pay a $900 annual registration fee and provide more business information when registering with the Secretary of State. The requirements apply to data brokers that must register to operate in Vermont. Operating without registration would carry a $200 daily penalty. Failing to provide required registration information would carry a $1,000 daily penalty. Filing materially incorrect registration information would carry a $25,000 civil penalty, plus a $1,000 daily penalty until corrected. The act lists multiple effective dates beginning July 1, 2026, but this summary does not assign a specific date to each fee, registration duty, or penalty.
The Secretary of State would study whether Vermont could create an online system for consumers to delete brokered personal information held by different data brokers. The study concerns brokered personal information held by various data brokers and a possible consumer deletion system. The requirement calls for a feasibility study and report, not an immediate online deletion system. The final report would be due December 1, 2028.
The Cybersecurity Advisory Council would receive three additional members, and educational technology providers would supply more business and product information in state filings. The council change affects the Cybersecurity Advisory Council; the filing duties apply to providers of educational technology products filing with the Secretary of State. Educational technology providers would include a link to their most recent privacy policy and the name and description of each product they provide. The council’s repeal date would extend to 2033. The act lists multiple effective dates beginning July 1, 2026, but does not assign a specific date to these provisions in the supplied summary.
No hearings or votes scheduled.