Vermont H.211 Data Broker Overhaul Heads to the Governor (2026)

Vermont H.211 Is on the Governor's Desk: What the Data Broker Overhaul Would Do

Vermont's legislature passed H.211, "An act relating to data brokers and personal information," on May 29, 2026, sending a sweeping overhaul of the state's 2018 data-broker registry to Governor Phil Scott. As of June 13, 2026, Scott has not signed or vetoed the bill. If signed, it would raise the annual registration fee from $100 to $900 and add deletion-on-request and breach-notification duties, effective January 1, 2027.

Information last verified on June 13, 2026. This is a developing story; we update it as the record changes.

Jurisdiction: Vermont. This page covers a pending bill that has not yet become law as of June 13, 2026. It is separate from the vetoed S.71. This is general legal information, not legal advice.

What Happened

Vermont's House of Representatives passed H.211 on March 25, 2026. Sponsored by Reps. Monique Priestley (D-Windham) and Michael Marcotte (R-Newport), the bill was referred to the Senate, where the Committee on Economic Development, Housing and General Affairs substantially reworked it. The Senate removed the House-passed universal deletion portal and passed an amended version on May 28, 2026. The House concurred the next day, May 29, 2026.

The enrolled bill was delivered to Governor Phil Scott on June 10, 2026. As of June 13, 2026, Scott has taken no action. He may sign it, veto it, or allow it to become law without his signature.

Among the key operative changes: 9 V.S.A. section 2446, which governs annual data-broker registration, would be amended to raise the fee from $100 to $900. Data brokers would also be required to notify the Attorney General of a security breach and its date of discovery within 14 business days, certify that collected information is used for legitimate purposes, and delete a consumer's brokered personal information within 30 days of a verified individual request. A new subchapter would impose student-data privacy obligations on educational technology companies serving Vermont schools.

What the Law Actually Says

Vermont was the first state in the country to mandate data-broker registration when Act 171 took effect in 2019. That law, codified at 9 V.S.A. chapter 62, defines a data broker as "a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship" (section 2430(4)(A)). About 283 companies are currently registered under that framework.

The existing statute already requires annual registration with the Secretary of State and disclosure of data categories and sharing practices. H.211 would amend that baseline in several ways. Under section 2446 of the enrolled bill, the annual fee would rise from $100 to $900. Penalties for failing to register would increase from $50 per day (capped at $10,000 annually) to $200 per day with no annual cap. Data brokers that file materially incorrect registration information would face a civil penalty of $25,000.

The individual deletion-on-request duty is narrower than what consumers might expect from the California model. California's Delete Act (SB 362, 2023) created the Delete Request and Opt-Out Platform, known as DROP, a state-run portal where a single submission reaches every registered data broker simultaneously. Vermont's enrolled H.211 instead requires each data broker to maintain its own deletion mechanism on its website, allowing consumers to request deletion free of charge. The one-stop portal that would have matched California's approach was removed by the Senate and replaced with a $50,000 study. For a practical guide to exercising opt-out rights under existing law, see our step-by-step data-broker opt-out guide.

The student-data subchapter would require technology providers that contract with Vermont schools to submit detailed disclosures, comply with student data privacy obligations, and restrict use of student information to educational purposes. These provisions would also take effect January 1, 2027 if signed.

For a broader look at how states are approaching data-broker registration laws, including the California DROP platform, see our national comparison page.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

H.211 lands on the Governor's desk in an unusual moment for Vermont privacy law. Just two days before the bill arrived, Scott vetoed S.71, the Data Privacy and Online Surveillance Act, on June 8, 2026. That veto continued a pattern: Scott also vetoed the comprehensive H.121 in 2024, citing litigation risk from its private right of action. H.211 is a narrower bill with a different profile; it amends an existing registration framework rather than creating new consumer-rights claims enforceable in court.

Scott's record on data-broker regulation specifically is more favorable. In 2018 he allowed Act 171, the nation's first data-broker registration law, to become law. H.211 can be read as an incremental upgrade to that same framework rather than a departure from it. Whether that lineage makes it easier for Scott to sign is not something we will predict here.

The fee increase is the provision most likely to draw industry scrutiny. The legislative fiscal note for the Senate-recommended version, published by the Joint Fiscal Office, projects that 283 registered brokers paying $900 would generate roughly $254,700 in annual revenue, earmarked to a Data Brokers Registry Fund. Some coverage of the bill has described $900 as among the higher state registration fees on the books; for context, California's separate regime charges $6,600 annually under Title 11 of the California Code of Regulations, section 7600, so Vermont's proposed fee is not the highest nationally. The figure should be understood in the context of the small-state framework Vermont operates within.

The removal of the universal portal is the substantive retreat from H.211's original ambition. Vermont's 283-broker registry means consumers who want to exercise deletion rights under the enrolled bill would need to contact each company individually, each operating its own deletion page. The $50,000 study could eventually lead to a Vermont version of California's DROP, but the bill itself sets no timeline or commitment beyond the appropriation.

How This Affects You

If H.211 is signed, these changes would matter to two groups.

For data brokers operating in Vermont: The annual registration fee at section 2446 would increase from $100 to $900, with the higher rate applicable beginning with the registration cycle tied to the January 1, 2027 effective date. The penalty structure for non-registration would also increase sharply, from $50 per day to $200 per day with no annual ceiling. Data brokers would need to add a deletion-request page to their websites, implement a 30-day deletion workflow, build a breach-notification process to alert the Vermont Attorney General within 14 business days of discovering a breach, and include a legitimate-purposes certification in their annual registration. Educational technology companies contracting with Vermont schools would face a separate compliance checklist under the new subchapter.

For Vermont consumers: If signed, the bill would not immediately change how you opt out of data brokers in practice; individual deletion requests to each broker's own deletion page would be the mechanism. The one-stop portal that some consumers hoped for was not included in the enrolled bill. The deletion-on-request right does not exist under current Vermont law in the same form; if and when H.211 takes effect, a consumer could submit a written request to any registered data broker and receive deletion within 30 days at no charge.

None of these provisions are currently in force. All of them depend on Governor Scott's signature. Do not change compliance practices or assume deletion rights apply until and unless the bill becomes law.

This is general legal information, not legal advice. It covers pending legislation in Vermont as of June 13, 2026. H.211 has not been signed by the Governor and is not yet law; no provisions described here are currently in force. Laws change, and this article will be updated as events develop. Consult a lawyer licensed in your jurisdiction for advice about your specific situation.

Related articles

• Vermont Data Privacy Laws: Data Broker Registry and Consumer Rights
• Data Broker Registration Laws and the Delete Act
• How to Opt Out of Data Brokers: A Step-by-Step Guide
• Vermont Passes the Data Privacy and Online Surveillance Act (S.71), Then Gov. Scott Vetoes It

---

Last updated: 2026-06-13. This is a developing story; details verified as of 2026-06-13.