When does the Vermont Data Broker Law Apply to a Business?

Vermont’s data broker law applies when a business:

• Collects personal information about Vermont residents.

• Sells or licenses that information to third-parties.

• Does not have a direct relationship with the consumer whose information is collected.

Companies that aggregate data from multiple sources, enrich marketing databases, or provide identity-related data services may fall within the scope of the law even if they do not interact directly with consumers.

Organizations should evaluate how they collect and share personal information to determine whether the law applies.

For implementation guidance, governance documentation templates, and audit-readiness support, visit the CLIClaw Data Broker Compliance Library.