VermontH.2112025-2026 SessionHouseWALLET

An act relating to data brokers and personal information

Sponsored By: Monique Priestley (Democratic)

Signed by Governor

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

9 provisions identified: 5 benefits, 1 costs, 3 mixed.

Vermont extends its cybersecurity framework

Vermont’s existing cybersecurity chapter remains in effect five years longer. Its repeal date moves from June 30, 2028, to June 30, 2033. The law also establishes a Cybersecurity Advisory Council to advise on infrastructure, communications, standards, training, and safeguards. Led by the state’s chief information officer or designee, it includes government, utility, water-system, hospital, and essential-supply-chain representatives.

Brokers must check who gets data

Before sharing personal data, brokers must obtain the user’s identity, intended purposes, and a promise to use it only for those purposes. Brokers must reasonably verify identity, review purposes, and refuse sharing when they reasonably suspect illegal or unstated uses. The law bans fraudulent acquisition and use for stalking, harassment, fraud, or unlawful employment or housing discrimination. Brokers must safeguard data, including encryption or other methods that make it unreadable or unusable; contractual waivers of protections are unenforceable. Beginning January 1, 2027, the Attorney General can make rules, investigate privacy-duty violations, seek agreements to stop them, and bring civil cases. The law also requires an independent study of accessible ways to delete brokered personal information.

Consumers get clearer, faster breach notices

A broker breach involves unauthorized acquisition, or reasonable belief of acquisition, of more than one instance of unprotected brokered information. Brokers must notify affected consumers without unreasonable delay, no later than 45 days after discovery or notification. They must send an initial breach report to the Attorney General within 14 business days. Clear notices must use at least two listed methods and include known incident details, affected data categories, protective steps, a phone number, and account-monitoring advice. Collectors using phone notices need a valid number, must call directly, and cannot use prerecorded messages. They must try at least five live calls before leaving breach details in voicemail. Collectors notifying more than 1,000 consumers at once must promptly notify nationwide credit-reporting agencies; Title 8 licensees and registrants are exempt. The Department of Financial Regulation can investigate, prosecute, and impose remedies for covered breach violations by entities it regulates.

More consumer data falls under protections

Vermont’s broker rules cover information, derived data, and identifiers linked to people, including through household devices. Covered brokers knowingly collect and sell or license information about consumers without a direct relationship. That relationship requires an intentional interaction for products or services; merely collecting data directly does not count. The law removes former exclusions for some online shopping platforms, directories, and public-information services. Public information generally stays excluded, but not specified secretly collected biometric data, unpublished genetic data, or known nonconsensual intimate images. Sales include exchanges for money or other value, with exclusions for processors, affiliates, consumer-directed or consented sharing, requested services, public information, and specified business acquisitions.

School technology gets stronger privacy oversight

Beginning January 1, 2027, covered school-technology providers must register and file required information with Vermont’s Secretary of State. This covers teaching and learning products used in Vermont public schools or approved independent schools. Filings include contacts, privacy policies, terms, product descriptions and links, and schools with paid contracts. Providers must attest to compliance with Vermont student privacy, age-appropriate design, and applicable privacy laws, including federal children’s online privacy rules. Hardware and products used without the provider’s knowledge are excluded. Beginning January 1, 2027, student-privacy violations count as unfair or deceptive business acts; the Attorney General can make rules, investigate, seek agreements, and bring civil cases.

Unregistered brokers face daily fines

Brokers that fail to register face a $200 fine for each day of nonregistration. They also owe unpaid registration fees and reasonable state investigation and administration costs determined by a court. Missing registration information must be corrected within 30 days after discovery or notice; late corrections carry a $1,000 daily penalty. Materially incorrect information carries a $25,000 penalty and the same 30-day correction deadline. Failure to correct that information adds a $1,000 daily penalty after the deadline.

Breach notices have exceptions and alternatives

Collectors can skip consumer notice after establishing that misuse of personal information or login details is not reasonably possible. They must give the Attorney General, or the financial regulator for covered entities, a detailed explanation. Submissions can receive trade-secret treatment when they meet the legal definition. Brokers must notify consumers if the Attorney General rejects their finding or later facts show misuse; documented law-enforcement requests can delay notice until withdrawn in writing. For breaches limited to the specified health-related information, covered collectors can satisfy Vermont requirements through federal health-privacy notices. They must also notify the proper Vermont agency and certify federal compliance in writing.

Consumer breach coverage expands and narrows

The law changes which personal information falls under Vermont’s data-collector breach rules. A name is unnecessary when another listed detail is enough to perform or attempt identity theft. The information must not be encrypted, redacted, or otherwise protected from unauthorized use. But biometric data leaves the list of specified details. The public-information exclusion expands to widely distributed media and information a broker reasonably believes the consumer lawfully made public.

Broker fees fund registration and safeguards

Brokers must register within 30 days of qualifying and renew by July 1 each year, paying $900 annually. Required amendments cost $100 each. Filings include contact details, breach history, data collection and sharing practices, privacy policies, consumer-rights links, bond details, and credit-reporting-law information. Brokers must maintain a $20,000 bond covering qualifying liability claims; actions on the bond have a two-year deadline after the claim arises. The Secretary of State must maintain a public webpage with a downloadable broker-registration spreadsheet and information about consumer rights.

Sponsors & Cosponsors

Sponsor

Monique Priestley
Democratic • House

Cosponsors

Abbey Duke
Democratic • House
Angela Arsenault
Democratic • House
Anne B. B Donahue
Independent • House
Anthony "Tony" Micklus
Republican • House
Barbara Rachelson
Democratic • House
Brian J Cina
Democrat/Progressive • House
Brian Minier
Democratic • House
Carol Ode
Democratic • House
Chloe Tomlinson
Democrat/Progressive • House
Conor Casey
Democratic • House
Daisy Berbeco
Democratic • House
Dara Torre
Democratic • House
David "Dave" Bosch
Republican • House
Edward "Teddy" Waszazak
Democratic • House
Edye Graning
Democratic • House
Ela Chapin
Democratic • House
Elizabeth L Burrows
Democratic • House
Emilie Krasnow
Democratic • House
Emily Carris Duncan
Democratic • House
Esme Cole
Democratic • House
Gayle S Pezzo
Democratic • House
Rep. Heather Surprenant
Affiliation unavailable
Herb Olson
Democratic • House
James W Masland
Democratic • House
Jana Brown
Democratic • House
Jed Lipsky
Independent • House
John K O'Brien
Democratic • House
Jubilee McGill
Democratic • House
Kate Lalley
Democratic • House
Kate McCann
Democratic • House
Kate Nugent
Democratic • House
Kirk White
Democratic • House
Laura H Sibilia
Independent • House
Larry Satcowitz
Democratic • House
Leanne Harple
Democratic • House
Leslie Goldman
Democratic • House
Lucy Boyden
Democratic • House
Marc B Mihaly
Democratic • House
Rep. Mari Cordes
Affiliation unavailable
Michael Boutin
Republican • House
Michael J Marcotte
Republican • House
Michael Mrowicki
Democratic • House
Michelle Bos-Lun
Democratic • House
Mollie S. S Burke
Democratic • House
Phil Pouech
Democratic • House
R. Scott Campbell
Democratic • House
Rebecca Holcombe
Democratic • House
Sarah "Sarita" C Austin
Democratic • House
Thomas S Stevens
Democratic • House
Troy Headrick
Independent • House
William "Will" Greer
Democratic • House
Zon Eastes
Democratic • House

Roll Call Votes

No roll call votes available for this bill.

Actions Timeline

House message: Governor approved bill on June 16, 2026
5/29/2026House
Signed by Governor on June 16, 2026
5/29/2026House
Delivered to Governor on June 10, 2026
5/29/2026House
House message: House concurred in Senate proposal of amendment
5/29/2026House
Rep. McCoy of Poultney moved to deliver the bill to the Governor forthwith, which was agreed to
5/29/2026House
Senate proposal of amendment concurred in
5/29/2026House
Rules suspended and taken up for immediate consideration as moved by Rep. McCoy of Poultney
5/29/2026House
Notice Calendar: Senate Proposal of Amendment
5/29/2026House
Senate Message: Passed in concurrence with proposal of amendment
5/28/2026Senate
Rules suspended & messaged to House forthwith, on motion of Senator Baruth
5/28/2026Senate
Read 3rd time & passed in concurrence with proposal of amendment
5/28/2026Senate
Rules suspended & bill placed on all remaining stages of passage, on motion of Senator Baruth
5/28/2026Senate
3rd reading ordered
5/28/2026Senate
Proposal of amendment by Committee on Economic Development, Housing and General Affairs, as amended, agreed to
5/28/2026Senate
Proposal of amendment by Committee on Economic Development, Housing and General Affairs amended as recommended by Committee on Appropriations
5/28/2026Senate
Reported favorably by Senator Brennan for Committee on Appropriations with proposal of amendment
5/28/2026Senate
Reported favorably by Senator Chittenden for Committee on Finance
5/28/2026Senate
Read 2nd time, reported favorably with proposal of amendment by Senator Chittenden for Committee on Economic Development, Housing and General Affairs
5/28/2026Senate
Rules suspended & taken up for immediate consideration, on motion of Senator Baruth
5/28/2026Senate
Referred to Committee on Appropriations per Senate Rule 31
5/28/2026Senate
Rules suspended on motion of Senator Baruth
5/28/2026Senate
Referred to Committee on Finance per Senate Rule 31
5/28/2026Senate
Rules suspended on motion of Senator Baruth
5/28/2026Senate
Read 1st time & referred to Committee on Economic Development, Housing and General Affairs
3/27/2026Senate
Read third time and passed
3/25/2026House

Bill Text

As Enacted (ACT 138)Opens in a new window
6/18/2026
PDF
As Passed by Both Chambers
6/8/2026
PDF
As Passed by Both Chambers (Unofficial)
6/8/2026
PDF
Senate Proposal of Amendment
5/29/2026
PDF
Senate Proposal of Amendment (Unofficial)
5/29/2026
PDF
As Passed by the House
3/26/2026
PDF
As Passed by the House (Unofficial)
3/26/2026
PDF
As Introduced
2/12/2025
PDF

Related Bills

Back to State Legislation