Vermont bill would bar data brokers from labeling biometric, genetic data public

Companies that buy and sell personal data in Vermont would face tighter limits on what they can call “publicly available” information. The bill would rewrite part of the state’s data-broker law to keep biometric identifiers, genetic data and nonconsensual intimate images out of that category, even if the information appears online.

The revision to Vermont statutes removes any ambiguity around information gathered without a person’s knowledge. Biometric identifiers collected secretly, genetic information that a consumer has not intentionally made public, obscene images, and nonconsensual intimate images are all explicitly excluded from the definition of publicly available data.

Pulling the data‑broker industry further into the open

The proposal also adds more transparency requirements for the companies known as data brokers, firms that assemble and sell detailed profiles about people who often have no direct relationship with them. Under the Vermont framework, those businesses must register with the state and provide basic identifying details such as their physical address, email, internet address, and phone number.

Their filings must also disclose whether, in the past year, they sold or shared consumer data with certain recipients. The list includes foreign actors, the federal government, other state or local governments, and law enforcement agencies when the transfer did not occur under a subpoena or court order. The filings also capture sharing with developers building generative artificial intelligence systems.

To make the system visible to the public, the Secretary of State maintains an online registry listing every registered data broker along with the information they report and a plain explanation of the rights Vermont residents have under the law.