Vermont’s data broker law applies when a business:
-
Collects personal information about Vermont residents.
-
Sells or licenses that information to third-parties.
-
Does not have a direct relationship with the consumer whose information is collected.
Companies that aggregate data from multiple sources, enrich marketing databases, or provide identity-related data services may fall within the scope of the law even if they do not interact directly with consumers.
Organizations should evaluate how they collect and share personal information to determine whether the law applies.
For operational guidance and structured compliance documentation tools, visit the CLIClaw Data Broker Compliance Library.
This FAQ is provided for general informational purposes only and is not legal advice. It is intended as a starting point for understanding the issues discussed and should not be relied on as a substitute for advice from qualified legal counsel.