Meet Vermont Act 171 data broker security duties with less effort

Vermont Act 171 is a 2018 Vermont law that created the first US state regime for data brokers. It requires businesses that sell or license personal information about Vermont residents, without a direct relationship with them, to register each year with the Secretary of State, to maintain a written comprehensive information security programme, and not to acquire brokered personal information by fraud or use it for stalking, fraud or unlawful discrimination. Its data broker provisions took effect on 1 January 2019.

A business must comply if it knowingly collects and sells or licenses the brokered personal information of Vermont residents with whom it has no direct relationship. A direct relationship includes current or past customers, users, employees, contractors, investors and donors. Location does not matter, so out-of-state data brokers are covered. Some activities are excluded, such as 411 directory assistance and providing publicly available information about a person's business or profession.

Under the current version of 9 V.S.A. § 2446, a data broker that fails to register is liable for a civil penalty of $50 per day, capped at $10,000 per year, plus the unpaid fees and other penalties imposed by law. The Attorney General can sue to collect them. Breaches of the security programme duties are treated as unfair and deceptive acts under the Vermont Consumer Protection Act. Higher penalties apply from 1 January 2027.

Section 2447 requires a written comprehensive information security programme with administrative, technical and physical safeguards. Minimum features include a designated owner, risk assessment, training, disciplinary measures, removing leavers' access, service provider supervision, physical restrictions, monitoring, annual reviews and post-incident reviews. Technical requirements, where feasible, include secure authentication with lockout, need-to-know access, encryption in transit and on portable devices, firewalls and patching, malware protection and staff security training.

Vermont Act 138 of the 2025 Adjourned Session amends the data broker rules from 1 January 2027. Registration moves to within 30 days of becoming a data broker and then by 1 July each year, the fee rises to $900, and a $20,000 bond is required. New duties cover verifying the identity and purpose of data buyers, more detailed registration disclosures, and notifying consumers of data broker security breaches within 45 days.

Vermont Act 171 is a legal duty, while ISO 27001 and SOC 2 are voluntary frameworks, but they overlap heavily. The § 2447 programme covers risk assessment, access control, encryption, malware protection, supplier oversight, training and incident review, all of which appear in ISO 27001 Annex A and the SOC 2 criteria. Controls and evidence built for either can support Act 171, though registration and the data use prohibitions still need separate work.

The time depends on how mature your security programme already is. Registration itself is a short annual filing with the Secretary of State. Building a written comprehensive information security programme that meets every § 2447 feature takes longer if you are starting from nothing, but organisations that already run ISO 27001 or SOC 2 controls can often reuse much of that work and focus on Vermont specific gaps.

Yes, on request. Vermont Act 171 is mapped in OneClickComply's control library and available on request, rather than being a live framework in every account. It shares controls with frameworks such as ISO 27001 and SOC 2, so evidence collected once counts towards each. OneClickComply helps you run the security programme, but registration with the Vermont Secretary of State remains your responsibility, and we do not guarantee compliance.