How do Companies Determine Whether They Qualify as a Data Broker?

Determining whether a company qualifies as a data broker generally requires reviewing how the organization collects and shares personal information.

Key questions include:

• Does the organization collect personal information about individuals who are not its customers or users?

• Does the organization sell, license, or provide that information to other companies?

• Does the organization lack a direct relationship with those individuals?

If the answer to these questions is yes, the organization may fall within Vermont’s definition of a data broker and should evaluate its obligations under the law.

For implementation guidance, governance documentation templates, and audit-readiness support, visit the CLIClaw Data Broker Compliance Library.