Status: Enacted — Signed by Governor Phil Scott on June 16, 2026 as Act 138. Effective January 1, 2027.
Bill Number: Vermont H.211 (2025-2026 Session) — An act relating to data brokers and personal information (Act 138)
Jurisdiction: Vermont
Category: Privacy & Data Protection, Data Broker Regulation, Consumer Protection
Industries: Data Brokers, AdTech, Marketing Analytics, People-Search Services, any business that buys or sells brokered personal information
Enacted Date: June 16, 2026
Effective Date: January 1, 2027
Summary: Vermont H.211, enacted as Act 138, significantly strengthens the state's data broker law — the first such registry law in the nation when originally enacted in 2018. The amendments raise the annual registration fee from $100 to $900, introduce a first-of-its-kind $20,000 surety bond running to the state, impose affirmative due-diligence obligations on brokers before they disclose brokered personal information, require deletion of personal information upon request, and sharply increase penalties for non-compliance. Signed by Governor Phil Scott on June 16, 2026 (alongside the H.816 therapy-bot ban), the law continues Vermont's national leadership on data-broker accountability and sits alongside Connecticut's Consumer Data Privacy and Data Broker Act (SB 4) and California's data-broker disclosure expansion as the most aggressive 2026 measures targeting the sale of personal data.
Key Requirements:
- Due Diligence Before Disclosure: Before disclosing brokered personal information, a data broker must identify the recipient and its purpose for receiving the data, and obtain certification that the data will not be used for any other purpose. If the broker has reasonable grounds to believe the data will be misused or used unlawfully, it must decline the transaction.
- Deletion on Request: Brokers must delete personal information upon consumer request and certify that the information they collect is used for legitimate purposes.
- Registration and Surety Bond: The annual registration fee increases from $100 to $900, and brokers must post a $20,000 surety bond running to the state for liability arising under the law.
- Breach Notification: Data brokers must provide notice of security breaches.
- Escalated Penalties: Failure to register carries $200 per day; incomplete registration not remedied within 30 days exposes a broker to $1,000 per day; filing materially incorrect information carries a flat $25,000 penalty plus $1,000 per day after the 30-day correction window.
- Deletion-Platform Study: The Secretary of State must study the feasibility of a state deletion-request platform, with a final report and proposed legislation due December 2028.
Legislative Context: H.211 was one of two privacy/AI measures Governor Scott signed in mid-June 2026, alongside H.816 (the therapy chatbot ban). Vermont pioneered data-broker registration in 2018; Act 138 modernizes that framework with substantive conduct rules rather than registration alone, reflecting a broader 2026 trend toward holding data brokers accountable for downstream use of personal and sensitive data, including location and biometric-adjacent information.
Affected Entities: Businesses that meet Vermont's definition of a data broker — entities that knowingly collect and sell or license brokered personal information about consumers with whom they have no direct relationship. The law targets the brokered-data economy; it does not regulate first-party operators of physical security systems, video analytics, or computer-vision safety platforms that do not sell personal information.
Compliance Outlook: Data brokers operating in Vermont should re-register under the new fee and bonding requirements, implement recipient-vetting and purpose-certification workflows before any data disclosure, and stand up deletion-on-request and breach-notification processes ahead of the January 1, 2027 effective date. Organizations that are unsure whether their data practices trigger data-broker status — particularly those monetizing analytics or location data — should evaluate their exposure now. Because Vermont, Connecticut, California, Oregon, and Texas are converging on broker due-diligence and deletion obligations, multi-state operators should standardize their data-handling controls.
IntelliSee Relevance: Adjacent — Privacy Context. Act 138 regulates data brokers that buy and sell personal information; IntelliSee is not a data broker. IntelliSee analyzes a customer's own live camera feeds to detect physical safety events and does not collect, sell, license, or broker personal information, biometric identifiers, or location data to third parties. The law therefore imposes no direct compliance obligation on IntelliSee deployments. It is tracked because security and risk leaders evaluating any AI or video-analytics technology increasingly scrutinize how vendors handle personal data — and IntelliSee's first-party, no-data-brokering posture is a differentiator in privacy-sensitive sectors such as education, healthcare, and government. Vermont customers deploying IntelliSee for AI gun detection, fall detection, and aggressive-behavior monitoring can document that these systems fall outside the data-broker regulatory perimeter. See the State-by-State AI Security Legislation Tracker for full context.
Compliance Timeline
- March 25, 2026 — H.211 passed by the Vermont House.
- May 28, 2026 — Passed by the Vermont Senate; adopted by both chambers as the session closed.
- June 16, 2026 — Governor Phil Scott signs H.211 into law as Act 138.
- January 1, 2027 — Amendments take effect.
- December 2028 — Secretary of State deletion-platform feasibility report due.