Some excerpts that define some key terms:
"(2) "Business" means a commercial entity, including a sole proprietorship, partnership, corporation, association, limited liability company, or other group, however organized and whether or not organized to operate at a profit, including a financial institution organized, charterd, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent, affiliate, or subsidiary of a financial institution, but does not include the State, a State agency, any political subdivision of the State, or a vendor acting solely on behalf of, and at the direction of, the State.
(3) "Consumer" means an individual residing in this State.
(4)(A) "Data broker" means a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship."
They use the broad definition of a “business” because in the US you can be incorporated in Delaware and actually operate in Vermont. This is actually a common thing - most US corporations are incorporated under the laws of either Delaware or Nevada but operate within their home state. But the state only has the ability to regulate the actual operations of businesses operating within Vermont.
Data brokers are scum. They do not produce any value, they do not improve the society, they have no positive effect on anyone. No reasonable person should stand up to protect them from liability.
Data brokers in Vermont will now have to register as such with the state; they must take standard security measures and notify authorities of security breaches (no, they weren’t before); and using their data for criminal purposes like fraud is now its own actionable offense.
It defines data brokers as businesses in Vermont that buy and sell data on people with whom they have no direct relationship. Seems like a reasonable law - unlike GDPR, they aren’t trying to reach outside of their jurisdiction, they aren’t trying to wipe out entire business models, there are no absurd fines, it’s easy to know if you’re violating it (because you would know that you have setup a data brokerage in Vermont), etc. My guess is there are only a handful of “data brokers” as they define that term within Vermont, so this affects very few people.