Determining whether a company qualifies as a data broker generally requires reviewing how the organization collects and shares personal information.
Key questions include:
-
Does the organization collect personal information about individuals who are not its customers or users?
-
Does the organization sell, license, or provide that information to other companies?
-
Does the organization lack a direct relationship with those individuals?
If the answer to these questions is yes, the organization may fall within Vermont’s definition of a data broker and should evaluate its obligations under the law.
For operational guidance and structured compliance documentation tools, visit the CLIClaw Data Broker Compliance Library.
This FAQ is provided for general informational purposes only and is not legal advice. It is intended as a starting point for understanding the issues discussed and should not be relied on as a substitute for advice from qualified legal counsel.