Vermont has a unique two-track privacy framework. Vermont's original Data Broker Regulation Law (Act 171, 2018) was the first data broker registration requirement in the United States, requiring data brokers to register with the state annually and pay a fee, with penalties for non-compliance. Vermont's newer Act 140 (2024) expands this framework significantly, adding comprehensive consumer privacy rights. Vermont's approach is particularly notable for its strong focus on data brokers — entities that collect and sell personal information about consumers with whom they have no direct relationship — and for its provisions allowing consumers to directly opt out of data broker databases through a state-run mechanism.
Residents of Vermont have the following legally enforceable privacy rights under Vermont Act 140:
Confirm whether a business processes your personal data and obtain a copy in portable format.
Request correction of inaccurate personal data held about you by covered businesses.
Request deletion of personal data you've provided or that has been collected about you.
Receive your personal data in a machine-readable, portable format to transfer to other services.
Prevent businesses from selling your personal data to third parties for commercial purposes.
Stop businesses from using your data to show you personalized ads based on your online behavior.
Opt out of automated decision-making used in significant decisions about credit, employment, or housing.
Businesses cannot penalize you with higher prices or reduced service for exercising your rights.
Vermont's data broker regulation applies to any person who, for profit, regularly collects and sells or licenses personal information of Vermont residents with whom they have no direct relationship. There is no size threshold for data broker registration. Vermont's broader consumer privacy provisions (Act 140) apply to controllers processing data of 100,000 or more consumers or 25,000+ consumers with 25%+ revenue from data sales.
Under Vermont Act 140, the following categories are classified as sensitive personal data and require explicit opt-in consent before processing:
Racial or ethnic origin · Religious or philosophical beliefs · Mental or physical health diagnoses · Sexual orientation or gender identity · Citizenship or immigration status · Genetic or biometric data uniquely identifying a person · Personal data of known minors · Precise geolocation data (within 1,750 feet)
Under Vermont Act 140, businesses must respond to consumer rights requests within 45 days of receipt. This may be extended by an additional 45 days with prior written notice explaining the reason for the delay. Businesses must also establish an internal appeals process for denied requests, with a response due within 60 days.
The Vermont Attorney General has enforcement authority over both the data broker registration requirement and the consumer privacy provisions. Violations may result in civil penalties up to $10,000 per violation. The data broker registration requirement has been actively enforced since 2018, with fines issued to non-compliant brokers.
To exercise your rights under Vermont Act 140, contact the business through their official privacy portal (typically linked at the bottom of their website under "Privacy" or "Your Privacy Rights"). Clearly state:
1. That you are a Vermont resident invoking rights under Vermont Act 140
2. Your full name and contact information linked to your account
3. The specific right you are invoking (access, deletion, opt-out of sale, etc.)
4. The legal deadline for response (45 days)
If the company denies your request, you have the right to appeal. If the company does not respond or appeal fails, you may file a complaint with the Vermont Attorney General's office.
| Term | Definition Under Vermont Act 140 |
|---|---|
| Personal Data | Any information linked or reasonably linkable to an identified or identifiable natural person. Does not include de-identified data or publicly available information. |
| Controller | A natural or legal person that, alone or jointly with others, determines the purposes and means of processing personal data. |
| Processor | A natural or legal person that processes personal data on behalf of a controller (e.g., a cloud hosting vendor). |
| Sale of Personal Data | The exchange of personal data for monetary or other valuable consideration by the controller to a third party. |
| Targeted Advertising | Displaying ads selected based on personal data obtained from a consumer's activities across non-affiliated websites or applications. |
| Profiling | Automated processing to evaluate, analyze, or predict aspects of a consumer's economic situation, health, personal preferences, behavior, location, or movements. |