Vermont data privacy and data broker removal

Delist · Updated August 28, 2026 · Corrections

Vermont now has a comprehensive privacy law and the nation's first data-broker registry. Here's what they give you and how to use both.

Your rights in Vermont

Vermont residents are protected by the Vermont Data Privacy and Online Surveillance Act (S.71), signed in June 2026 and effective January 1, 2028, alongside the state's data-broker registration law (9 V.S.A. Chapter 62).

• Rights from January 1, 2028: Access, correct, delete, and download the personal information a company holds about you, and opt out of data sales, targeted advertising, and profiling.

Does this cover the company that has my data?

Coverage depends on what the organization does, how much Vermont consumer data it handles, and whether a statutory exemption applies.

The data-broker law covers businesses that meet Vermont's definition of a data broker. Beginning January 1, 2028, the comprehensive law generally reaches organizations doing business in Vermont or targeting Vermont residents that process at least 35,000 consumers' personal data, process at least 3,000 consumers' sensitive data, or sell at least 3,000 consumers' personal data. The law contains entity- and data-level exemptions, so those thresholds are not the entire coverage test.

How to remove yourself from data brokers in Vermont

Vermont gives you more tools than most states. Here's how to use them, strongest first.

1. Use the data-broker registry

Vermont requires data brokers to register with the state. The public registry shows which companies collect and sell your information and gives you a starting point for opt-out requests. Vermont does not offer a single-request deletion mechanism, so you contact each broker separately.

2. Enable Global Privacy Control

Global Privacy Control is a free browser signal that communicates a request not to sell or use your data for targeted advertising. From January 1, 2028, Vermont's law will require covered businesses to honor qualifying opt-out preference signals. Until then, the signal has an effect only where another applicable law or a company's voluntary policy recognizes it.

3. Submit direct opt-out requests

For brokers the registry or GPC doesn't reach, submit requests directly. Look for the "Do Not Sell My Personal Information" link in each company's footer; most major brokers have one. You can also file access, deletion, or correction requests through each company's privacy policy page.

4. Automate ongoing removal

Removal is not a one-time task. Even after you finish every step above, brokers rebuild your profile from public records and commercial databases, and your listings reappear after new source data is ingested. Staying removed means checking again and re-filing, which is hard to keep up by hand.

Vermont's data broker law: what it means for you

Vermont passed the nation's first data-broker registration law in 2018. It is a transparency regime: it requires covered brokers to identify themselves and disclose specified practices, but it does not create a general right to make every broker delete your data.

• Data brokers must register with the Vermont Secretary of State each year by January 31 and disclose how they collect data, how you can opt out (including whether you can authorize an agent to opt out for you), and any breaches involving brokered data. The annual fee is $100, rising to $900 in 2027.
• A broker that fails to register faces a $50-per-day penalty, capped at $10,000 a year; the cap rises to $200 per day with no annual cap in 2027. The Attorney General enforces it.
• You can browse every registered broker at the Vermont Secretary of State's Data Broker Search.
• The 2026 overhaul (H.211, Act 138) was signed June 16, 2026. Its substantive amendments take effect January 1, 2027. They raise the annual fee to $900, add a $20,000 surety bond, expand registration disclosures, and require brokers to vet who receives brokered information and for what purpose.
• Act 138 directs the Secretary of State to study a possible centralized deletion mechanism. It does not create that mechanism.
• There is no centralized deletion tool today. Residents contact each registered broker individually.

Other privacy protections in Vermont

Vermont residents can draw on several overlapping protections:

• The nation's first data-broker registry, in effect since 2019 and strengthened by Act 138 in 2027.
• Comprehensive consumer rights under the Vermont Data Privacy and Online Surveillance Act, effective January 1, 2028.
• Security breach notification under 9 V.S.A. § 2435.
• The Safe at Home Address Confidentiality Program, run by the Secretary of State for survivors of domestic violence, stalking, and sexual assault.
• Federal safeguards such as the Fair Credit Reporting Act, which still apply.

How to file a privacy complaint in Vermont

File with the Vermont Attorney General's Consumer Assistance Program. To see who holds your data, use the Vermont Secretary of State's Data Broker Search.

State agencies enforce privacy laws in the aggregate, investigating patterns of violations rather than resolving individual disputes. Filing a complaint still matters, because it creates a record that helps trigger enforcement.

Frequently asked questions