Vermont Act 138, signed June 16, 2026, overhauls the nation's first data broker law. From January 1, 2027, brokers operating in Vermont must pay a $900 annual registration fee, post a $20,000 surety bond, disclose whether they sell sensitive data or share it with government agencies and generative AI developers, and notify consumers of security breaches.
Vermont has been here before. In 2018 it became the first state in the country to require data brokers to register publicly — a law that gave privacy researchers their first real census of who buys and sells personal records. Act 138 (originally H.211) is the significant update to that framework, and it pushes into territory no other state registry has covered.
What Act 138 Changes
- Annual registration fee rises to $900, up sharply from the original fee and payable every year.
- A $20,000 surety bond is now required, so brokers must post money against non-compliance rather than simply filing a form.
- Expanded disclosures. Registrants must state whether they collect sensitive categories of data and who they share it with.
- Breach notification. Data brokers must give notice of security breaches — closing a gap where broker-held records could leak with no consumer-facing duty to report.
- Real penalties. Failure to register carries $200 per day. An incomplete registration not fixed within 30 days runs $1,000 per day. Filing materially incorrect information carries a flat $25,000 penalty plus $1,000 per day after the 30-day correction window.
The Sensitive Data Disclosures Are the Big Deal
The most consequential part of Act 138 is what brokers now have to admit in writing. Registrants must disclose whether they collect or hold:
- Precise geolocation — the location trails that reveal where you live, work, worship and seek medical care
- Biometric information
- Reproductive health data
- Immigration status or related information
- Government-issued identification numbers
- Information about minors
They must also disclose whether they share data with government entities, law enforcement, foreign actors, or generative AI developers. That last category is new ground. No other state registry has asked brokers to declare on the record whether the personal data they hold is feeding AI training pipelines, and the answers will be public.
Why a Registry Helps You Directly
A public broker registry is a target list. Every registrant is a company that holds records about people and is required to offer an opt-out. Vermont's registry is one of the best publicly available starting points for finding brokers you have never heard of — the ones that never show up in a search for your own name but supply the sites that do.
What Act 138 Does Not Do
Be clear about the limits, because registration laws are often oversold:
- It does not delete your data. Vermont has no universal "delete my data everywhere" button of the kind California built with its DROP platform under the Delete Act.
- It does not stop the sale of your records — it makes brokers disclose and pay to keep doing it.
- It still requires you to opt out broker by broker, one request at a time, and to repeat the process when listings repopulate.
- It binds registrants, not everyone. Brokers that simply do not register are the ones most likely to ignore your requests, which is what the daily penalties are meant to address.
Skip the manual work
PrivacyOn removes your personal information from 100+ data broker sites and keeps it removed — automatically.
Start your free scan★★★★★ 4.8/5 · Trusted by thousands of families
How This Compares to Other States
Vermont now sits in a small group of states regulating brokers directly rather than only through general consumer privacy rights:
- California — the Delete Act and the DROP platform, which aims to give consumers a single deletion request honored across registered brokers.
- Connecticut — Public Act 26-64, signed May 2026, with data broker registration from January 1, 2027 and an accessible deletion mechanism due by July 1, 2028.
- New Jersey — its data broker law, with registration and enforcement provisions operative in spring 2027 and steep registration fees.
- Vermont — the oldest registry, now the most detailed on sensitive-data and AI-sharing disclosures.
The direction of travel is consistent: more registration, more disclosure, higher fees. What is still rare is an actual deletion mechanism, and only California has one running.
What Vermonters Should Actually Do
- Use the registry as a worklist. Vermont's Secretary of State publishes registered data brokers. Work through it and file opt-outs with the ones holding your records.
- Freeze your credit at all three bureaus. It is free and blocks the most damaging use of leaked broker data.
- Exercise your consumer rights under Vermont's broader privacy protections where they apply, and keep written records of every request and response.
- Re-check in 90 days. Brokers repopulate from one another — a removal is a maintenance task, not a one-time fix.
- Automate it if the manual route stalls. PrivacyOn removes your information from 100+ data brokers, re-scans continuously so re-listed records get pulled again, includes 24/7 dark web monitoring, and covers up to 5 household members from $8.33/month. The initial scan is free and shows you exactly which sites publish your address today.
January 1, 2027 Is Not a Deadline for You
Act 138's key provisions bind brokers, not residents. Nothing about your personal data improves automatically on that date. If your address and phone number are on people-search sites now, they will still be there in January unless you or a service removes them.
Frequently Asked Questions
What is Vermont Act 138?
Act 138 (H.211) is a 2026 Vermont law, signed June 16, 2026, that amends the state's pioneering 2018 data broker statute. Key provisions take effect January 1, 2027 and raise the annual registration fee to $900, require a $20,000 surety bond, mandate detailed disclosures about sensitive data and data sharing, and impose breach notification duties on data brokers.
When does Vermont's new data broker law take effect?
The law was signed on June 16, 2026, with its key data broker provisions — including the higher registration fee, surety bond and expanded disclosures — effective January 1, 2027.
Does Act 138 let me delete my data from all brokers at once?
No. Act 138 is a registration, disclosure and breach-notification law, not a universal deletion mechanism. California's DROP platform under the Delete Act is currently the only one-request-for-all-brokers system in the US. In Vermont you still opt out broker by broker, or use a service like PrivacyOn to automate it across 100+ brokers.
What sensitive data must Vermont data brokers disclose?
Registrants must disclose whether they handle precise geolocation, biometric data, reproductive health information, immigration-related information, government-issued ID numbers and information about minors — and whether they share data with government entities, law enforcement, foreign actors or generative AI developers.
What are the penalties for data brokers that don't comply?
Failing to register carries $200 per day. An incomplete registration left unfixed for more than 30 days runs $1,000 per day. Filing materially incorrect information carries a $25,000 flat penalty plus $1,000 per day after the 30-day correction window.
How do I remove my personal information from Vermont data brokers?
Start with the state's public registry of registered brokers, then submit an opt-out to each one and keep records of your requests. Because brokers resell to each other, listings repopulate, so re-check every few months. PrivacyOn automates removal across 100+ brokers with continuous re-scanning from $8.33/month, and the scan that shows where you are exposed is free.