Vermont starts regulating data brokers, which now have to register in the state, notify about breaches, can be sued if data is misused for e.g. racial profiling
While Facebook and Cambridge Analytica are hogging the spotlight, data brokers that collect your information from hundreds …
Context & Ripple Effects
Vermont's move lands squarely in the fallout from Facebook and Cambridge Analytica hogging the spotlight: while attention fixed on social platforms, brokers quietly aggregating personal data from hundreds of sources had faced no registration duty anywhere. The law creates three obligations at once — register with the state, disclose breaches, and accept lawsuits if data is misused for purposes like racial profiling.
What made this more than a press release is what came after: the registration requirement produced a public list of 121 US data brokers, turning an opaque industry into a nameable one. Later reporting found few brokers registered accurately, which set up the enforcement debate that still shadows every state copycat law.
First-order effects
- Data brokers buying and selling third-party personal data must now register with Vermont, report breaches, and face a private right of action when their data feeds misuse such as racial profiling — legal exposure they did not carry before.
- Vermont gains a registry it can use as an enforcement map, and consumers gain a documented roster of who holds their data.
Second-order effects
- Other states followed with their own broker-registration laws, but privacy experts found them inadequately enforced, letting large numbers of brokers operate under the radar — the compliance burden spreads while the transparency payoff thins.
- Deletion tools built on these registries are undermined when brokers register in some states and skip others: EFF's analysis found many of the 750 brokers registered somewhere have not registered in states with transparency laws.
Third-order effects
- If the state-by-state pattern holds, the endgame is federal preemption or supplementation — the CFPB's proposal to limit brokers' sale of Americans' personal and financial data, following the National Public Data breach, shows Washington stepping into the gap the patchwork left.
- Vermont itself kept going: its later strict online data privacy law, passed over tech-industry pushback, treats broker regulation as step one rather than the finish line.
The trend: Data-broker oversight is migrating from voluntary opacity to mandatory registration — first state by state, then toward federal rules as enforcement gaps and cross-border breaches expose the patchwork's limits.