Under Vermont Data Broker Law, a “data broker” is generally defined as a business that knowingly collects and sells or licenses to third parties the personal information of consumers with whom the business does not have a direct relationship.
The definition centers on two key elements:
-
No direct relationship with the consumer whose information is collected
-
Sale or licensing of personal information to third parties
A “direct relationship” typically means the consumer intentionally interacts with the business – such as by making a purchase, creating an account, subscribing to a service, or otherwise knowingly providing information directly to the organization.
Businesses that obtain personal information from third-party sources and then resell, license, aggregate, or distribute that information may fall within Vermont’s statutory scope.
Vermont’s law also includes specific exclusions and registration-related disclosure requirements. Because statutory definitions differ across states, organizations should conduct and document a formal applicability analysis specific to Vermont rather than relying on assumptions based on other jurisdictions.
For operational guidance and structured compliance documentation tools, visit the CLIClaw Data Broker Compliance Library.
This FAQ is provided for general informational purposes only and is not legal advice. It is intended as a starting point for understanding the issues discussed and should not be relied on as a substitute for advice from qualified legal counsel.