Laws
Vermont privacy law: the data broker registry now, deletion rights from 2028
Quick answer
Vermont doesn't give you a general right to make businesses delete your data yet. That starts on January 1, 2028, when the Vermont Data Privacy and Online Surveillance Act (Act 145) takes effect, with rights to access, correct and delete your data and to opt out of its sale. Until then, your tool is the data broker registry: registered brokers must say whether and how you can opt out, and you use each broker's own opt-out.
All privacy laws“A consumer shall have the right to: ... (3) delete personal data provided by, or obtained about, the consumer;”
- Applies in
- Vermont
- In force since
- Companies must answer within
- From January 1, 2028: without undue delay and within 45 days of receiving your request, extendable by 45 days when reasonably necessary if the business tells you within the first 45 days. Appeals: written answer within 60 days. Before 2028 there is no general deadline, because there is no general right to delete.
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: legislature.vermont.gov, ago.vermont.gov, sos.vermont.gov
Last verified against the official page:
Vermont residents. From January 1, 2028, Act 145 applies to organizations that process the data of at least 35,000 consumers, process the sensitive data of at least 3,000, or sell the personal data of at least 3,000. Government entities, HIPAA covered entities that aren't hybrid entities, data covered by Title V of the Gramm-Leach-Bliley Act and most insurers are exempt. The data broker law, in force now, covers businesses that knowingly collect and sell or license the personal information of people they have no direct relationship with.
Your rights
-
Data broker transparency (now)
A registered data broker must disclose whether you can opt out of its data collection or sales and how, which activities you can't opt out of, and whether someone else can opt out for you (9 V.S.A. § 2446).
-
Confirm and access (from 2028)
Ask whether a business processes your data and see it, including inferences drawn about you and whether it's used for profiling (9 V.S.A. § 2415d).
-
Correct (from 2028)
Have inaccurate personal data fixed (9 V.S.A. § 2415d).
-
Delete (from 2028)
Have a business delete personal data you gave it or that it obtained about you. A business that got your data from another source can comply by keeping a minimal record to suppress it, or by opting you out (9 V.S.A. § 2415d).
-
Portable copy (from 2028)
Get a copy of your data in a portable, readily usable format (9 V.S.A. § 2415d).
-
Opt out (from 2028)
Opt out of targeted advertising, the sale of your data, and profiling for automated decisions with legal or similarly significant effects. An authorized agent or a browser or device signal can do it for you (9 V.S.A. § 2415d).
-
List of buyers (from 2028)
Get a list of the third parties the business sold your personal data to (9 V.S.A. § 2415d).
General information, not legal advice.
How to use it
- 1
Today: look the broker up in the registry
Registered data brokers must file their opt-out method with the Vermont Secretary of State, and the Secretary of State publishes them. Search by company name in the Secretary of State's Data Broker Search, linked from its data broker page. Look there for the broker you found.
- 2
Today: use the broker's own opt-out
If a broker allows opt-outs, its registration has to describe how. Follow that method. Vermont's current law doesn't force a broker to offer one, which is why some registrations will tell you an activity can't be opted out of.
- 3
From 2028: send a request to the business
Use the secure and reliable method the business describes in its privacy notice, and say which right you're using. For opt-outs, an authorized agent or a browser or device signal can act for you.
- 4
From 2028: wait up to 45 days
The business must respond within 45 days, with one possible 45-day extension if it tells you in time.
- 5
From 2028: appeal a refusal
The business must answer an appeal in writing within 60 days. If it denies the appeal, it has to tell you how to complain to the Attorney General.
- 6
Complain to the Attorney General
Contact the Attorney General's Consumer Assistance Program at 800-649-2424 or AGO.CAP@vermont.gov, or file a consumer complaint online. From 2028 the Attorney General is the only enforcer of Act 145.
No answer in time? Complain to Vermont Attorney General, Consumer Assistance Program (the Vermont Secretary of State keeps the data broker registry) .
What you can do in Vermont today
Vermont regulated data brokers years before it passed a general privacy law. Its 2018 data broker law (Act 171) has applied since January 1, 2019. It makes brokers register with the Secretary of State every year and say whether and how you can opt out. It doesn't give you a right to have your data deleted. Nothing does, yet.
A data broker, under that law, is a business that knowingly collects and sells or licenses the personal information of people it has no direct relationship with. Today a broker registers by January 31 each year and pays $100. If it skips registration, the penalty is $50 a day, up to $10,000 a year, plus the unpaid fees.
Changes coming on January 1, 2027
Act 138 of 2026 tightens the registry. From January 1, 2027, a broker must register within 30 days of becoming one and by July 1 each year. The fee rises to $900 and brokers need a $20,000 bond. Skipping registration will cost $200 a day, and filing materially incorrect information adds $25,000.
Act 138 also tells the Secretary of State to study a one-stop online system for deleting your data from brokers, along the lines of California's free Delete Request and Opt-out Platform (DROP). The final report is due December 1, 2028, so don't expect a Vermont tool before then.
What changes on January 1, 2028
Act 145 (S.71) was signed on June 16, 2026 and takes effect on January 1, 2028. It gives Vermonters the rights listed above, from access and deletion to a list of the third parties a business sold their data to.
It applies to organizations that process the data of at least 35,000 consumers, process the sensitive data of at least 3,000, or sell the personal data of at least 3,000.
Government entities and most insurers stay outside it. So do HIPAA covered entities that aren't hybrid entities, and data covered by Title V of the Gramm-Leach-Bliley Act (financial data). A business may point to one of these exemptions when it turns down a request.
One detail matters if you're dealing with brokers. A business that got your data from another source can meet a deletion request by keeping a minimal record so it suppresses your data, or by opting you out, rather than erasing every trace.
Where Serus fits
Until 2028, Vermont gives you opt-outs broker by broker and no way to make other businesses delete your data. Serus finds the data brokers that operate where you live and sends the opt-out and removal requests for you. Then it checks whether your data comes back. If you'd rather do it yourself, start with the registry: it's free.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
Does Vermont have a privacy law?
Yes, but not in force yet. Act 145 (S.71), the Vermont Data Privacy and Online Surveillance Act, was signed on June 16, 2026 and takes effect on January 1, 2028. Vermont's data broker registry law has applied since January 1, 2019.
Can I ask a business to delete my data in Vermont today?
Not under a general Vermont law. That right arrives on January 1, 2028, when Act 145 takes effect. Today you can use the opt-out a data broker lists in its registration.
Do data brokers have to register in Vermont?
Yes. Today they register by January 31 each year with a $100 fee. From January 1, 2027 they must register within 30 days of becoming a broker and by July 1 each year, with a $900 fee and a $20,000 bond.
What happens if a broker doesn't register?
Today the penalty is $50 a day, up to $10,000 a year, plus unpaid fees. From January 1, 2027 it rises to $200 a day, plus $25,000 for materially incorrect information.
Will Vermont build a one-stop deletion tool like California's DROP?
Maybe. Act 138 requires the Secretary of State to study whether an online system to delete brokered personal information is feasible. The final report is due December 1, 2028.
Who enforces the 2028 law?
Only the Office of the Attorney General, under the Vermont Consumer Protection Act.
Sources
- legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf
- legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20Act%20Summary.pdf
- legislature.vermont.gov/bill/status/2026/S.71
- legislature.vermont.gov/statutes/section/09/062/02446
- legislature.vermont.gov/statutes/section/09/062/02430
- legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT138/ACT138%20Act%20Summary.pdf
- ago.vermont.gov/cap
- ago.vermont.gov/cap/get-help-consumer-complaint
- sos.vermont.gov/business-services/other-filings/data-broker
- bizfilings.vermont.gov/databrokersearch/Search
Something wrong or out of date? Tell us and we'll re-check it.