Vermont H 211: An act relating to data brokers and personal information

Bill Text

No. 138 Page 1 of 41
2026

VT LEG #390220 v.1
No. 138. An act relating to data brokers and personal information.
(H.211)
It is hereby enacted by the General Assembly of the State of Vermont:
Sec. 1. 9 V.S.A. chapter 62 is amended to read:
CHAPTER 62. PROTECTION OF PERSONAL INFORMATION
Subchapter 1. General Provisions
§ 2430. DEFINITIONS
As used in this chapter:
(1) “Authorized agent” means:
(A) a person designated by a consumer to act on the consumer’s
behalf;
(B) a parent or legal guardian that acts on behalf of the parent’s child
or on behalf of a child for whom the guardian has legal responsibility; or
(C) a guardian or conservator that acts on behalf of a consumer that is
subject to a guardianship, conservatorship, or other protective arrangement.
(2)(A) “Biometric data” means that data generated from the
technological processing of an individual’s unique biological, physical, or
physiological characteristics can be used to identify an individual, including:
(i) iris or retina scans;
(ii) fingerprints;
(iii) facial or hand mapping, geometry, or templates;
(iv) vein patterns;

No. 138 Page 2 of 41
2026

VT LEG #390220 v.1
(v) voice prints; and
(vi) gait or personally identifying physical movement or patterns.
(B) “Biometric data” does not include:
(i) a digital or physical photograph;
(ii) an audio or video recording; or
(iii) any data generated from a digital or physical photograph, or
an audio or video recording, unless such data is generated to identify a specific
individual.
(3)(A) “Brokered personal information” means one or more of the
following computerized data elements about a consumer, if categorized or
organized for dissemination to third parties:
(i) name;
(ii) address;
(iii) date of birth;
(iv) place of birth;
(v) mother’s maiden name;
(vi) unique biometric data generated from measurements or
technical analysis of human body characteristics used by the owner or licensee
of the data to identify or authenticate the consumer, such as a fingerprint, retina
or iris image, or other unique physical representation or digital representation
of biometric data;

No. 138 Page 3 of 41
2026

VT LEG #390220 v.1
(vii) name or address of a member of the consumer’s immediate
family or household;
(viii) Social Security number or other government-issued
identification number; or
(ix) other information that, alone or in combination with the other
information sold or licensed, would allow a reasonable person to identify the
consumer with reasonable certainty any information, including derived data
and unique identifiers, that is linked or reasonably linkable, alone or in
combination with other information, to an identified or identifiable individual
or to a device that identifies, is linked to, or is reasonably linkable to one or
more identified or identifiable individuals in a household.
(B) “Brokered personal information” does not include publicly
available information to the extent that it is related to a consumer’s business or
profession.
(2)(4) “Business” means a commercial entity, including a sole
proprietorship, partnership, corporation, association, limited liability company,
or other group, however organized and whether or not organized to operate at a
profit, including a financial institution organized, chartered, or holding a
license or authorization certificate under the laws of this State, any other state,
the United States, or any other country, or the parent, affiliate, or subsidiary of
a financial institution, but does not include the State, a State agency, any

No. 138 Page 4 of 41
2026

VT LEG #390220 v.1
political subdivision of the State, or a vendor acting solely on behalf of, and at
the direction of, the State.
(3)(5) “Consumer” means an individual residing in this State.
(4)(6)(A) “Data broker” means a business, or unit or units of a business,
separately or together, that knowingly collects and sells or licenses to third
parties the brokered personal information of a consumer with whom the
business does not have a direct relationship.
(B) Examples of a direct relationship with a business include if the
consumer is a past or present:
(i) customer, client, subscriber, user, or registered user of the
business’s goods or services;
(ii) employee, contractor, or agent of the business;
(iii) investor in the business; or
(iv) donor to the business As used in this subdivision (6), “direct
relationship” means that a consumer has intentionally interacted with a
business for the purpose of accessing, purchasing, using, requesting, or
obtaining information about the business’s products or services. A consumer
does not have a direct relationship with a business if the purpose of the
consumer’s engagement is to exercise a consumer right or for the business to
verify the consumer’s identity. A business does not have a direct relationship
with a consumer simply because the business collects brokered personal
information directly from the consumer; the consumer must intend to interact

No. 138 Page 5 of 41
2