Vermont's data broker law changes on January 1, 2027; New Jersey's registry clock runs to March 27, 2027
Vermont's rewrite of its data broker law, Act 138 of 2026 (H.211), takes effect on January 1, 2027: the annual registration fee rises from $100 to $900, brokers must post a $20,000 bond and answer new questions, and the yearly deadline moves to July 1. New Jersey's data broker law, P.L.2026, c.25 (A5328), took effect when it was approved on June 30, 2026, except the public registry, which stays inoperative for 270 days; by our count that period runs to March 27, 2027. Neither law creates a one-stop deletion platform like California's.
- Vermont law
- Act 138 of 2026 (H.211), signed June 16, 2026
- Vermont data broker changes take effect
- January 1, 2027
- Vermont registration fee
- $100 now; $900 from January 1, 2027, plus a $20,000 bond
- Vermont deletion platform
- None; the Secretary of State must study one (reports due December 1, 2027 and December 1, 2028)
- New Jersey law
- P.L.2026, c.25 (A5328), approved June 30, 2026
- New Jersey effective date
- June 30, 2026; public registry inoperative for 270 days (to March 27, 2027, our count)
- New Jersey registration fee
- $5,000 to $1,500,000 a year, by number of New Jersey consumers
- New Jersey sensitive data
- Data brokers and data collectors may not sell or license it
Figures above were read from Vermont Act 138 as enacted and New Jersey P.L.2026, c.25 on 2026-10-12. See sources.
This page is general information, not legal advice; the rules depend on the facts and the state.
Vermont: what Act 138 changes on January 1, 2027
Vermont has required data brokers to register with the Secretary of State since 2019 under 9 V.S.A. chapter 62, subchapter 5. Under the current text of 9 V.S.A. section 2446, a broker registers each year on or before January 31 following a year in which it met the definition, pays $100, and reports its opt-out options, whether it credentials purchasers, its data broker security breaches and its practices for minors' data. The Secretary of State's Data Broker page, read on 2026-10-12, still says "an Annual Registration is required between January 1st and January 31st" following each calendar year as a broker.
Act 138 was signed on June 16, 2026. Its effective-date section says: "Secs. 1 and 4 shall take effect on January 1, 2027." Section 1 rewrites chapter 62, which holds the data broker rules. The study of a deletion mechanism (Sec. 2) took effect on July 1, 2026. From January 1, 2027, the enacted text provides:
- Deadline. A broker registers within 30 days after meeting the definition of a data broker, and then once a year on or before July 1.
- Fee and bond. The fee is $900. The broker must maintain a $20,000 bond that runs to the State. Amending a registration carries a $100 administrative fee.
- Wider definitions. "Brokered personal information" becomes any information, including derived data and unique identifiers, linked or reasonably linkable to an identified or identifiable individual or to a device. A "direct relationship" now means the consumer intentionally interacted with the business; a business is still a data broker for data it sells that it collected outside a first-party interaction with the consumer. The old list of exempt activities (such as 411 directory services) is removed, and "sale" and "publicly available information" are newly defined.
- New registration answers. Whether the broker collects precise geolocation (defined as within a radius of 1,850 feet), reproductive health care data, biometric data, immigration status, sexual orientation, union membership status, government ID numbers or mobile advertising IDs; and whether, in the past year, it shared data with or sold data to a foreign actor, the federal government, other state or local governments, law enforcement (unless under a subpoena or court order), or a developer of a GenAI system or model. Brokers also file a copy of the bond and privacy policy, the URL of a page for deletion requests (if the broker permits deletion) and opt-outs, and whether it is regulated by the Fair Credit Reporting Act.
- Vetting buyers. A broker must have buyers identify themselves, state their purpose and certify the data will be used for no other purpose, and must not disclose data when it has reasonable grounds to believe it will be used to break State or federal law.
- Breach notices. A new Data Broker Security Breach Notice Act requires notice to affected consumers within 45 days of discovery and a preliminary notice to the Attorney General within 14 business days.
- Penalties. $200 per day for failing to register (the old text: $50 per day, capped at $10,000 a year); $1,000 per day if omitted information is not filed within 30 days; and $25,000 for filing materially incorrect information, plus $1,000 per day if it is not corrected within 30 days.
- Public list. The Secretary of State must keep a consumer page with "a downloadable spreadsheet of data brokers that have registered with the State" and the information each broker filed.
These questions closely follow California's: the 2026 California registry asks five similar questions about sharing or selling data in the past year (its third covers other state governments), including the GenAI developer question we counted in brokers that disclosed sharing data with GenAI developers.
No deletion platform yet, only a study
Act 138 does not give Vermonters a single deletion request. Section 2 tells the Secretary of State to study the feasibility of an accessible deletion mechanism that would let a consumer, through a single verifiable request, ask every registered broker to delete their data, at no charge, on a Secretary of State website. The Act sets two deadlines: "an interim report on or before December 1, 2027, and a final report on or before December 1, 2028". The features listed track California's platform, described in how California's DROP works.
How to search the Vermont data broker registry today
The Secretary of State's Data Broker page links to a "Data Broker Search" on its business filings site (bizfilings.vermont.gov), where registered brokers can be looked up by name. That search page is drawn by JavaScript and uses a reCAPTCHA check, so we did not read or count it automatically, and we found no downloadable list on the Secretary of State's page on 2026-10-12. We therefore do not state how many brokers are registered in Vermont. The downloadable spreadsheet required by Act 138 applies from January 1, 2027.
New Jersey: what P.L.2026, c.25 requires
New Jersey's law (A5328, first reprint) was approved on June 30, 2026 and is codified starting at N.J.S.A. 56:8-166.20. Section 8 reads: "This act shall take effect immediately, except that subsection b. of section 2 of this act shall remain inoperative for 270 days following the date of enactment." Subsection b. is the public registry. Counting 270 days from June 30, 2026 reaches March 27, 2027.
- Who registers. Data brokers (businesses that knowingly collect or purchase personal data of consumers they have no direct relationship with and sell or license it) and also "data collectors": businesses that collect data from consumers they do have a direct relationship with and sell or license it to a data broker.
- Agency. The Division of Consumer Affairs in the Department of Law and Public Safety keeps the public registry and reviews it at least annually. Its Director must adopt implementing rules.
- Annual fee by number of New Jersey consumers. $5,000 (100,000 or fewer); $10,000 (more than 100,000 and fewer than 500,000); $100,000 (more than 500,000 and fewer than one million); $500,000 (more than one million and fewer than 1.5 million); $750,000 (more than 1.5 million and fewer than 2.5 million); $1,000,000 (more than 2.5 million and fewer than 4.5 million); $1,500,000 (more than 4.5 million).
- What is filed. Name and addresses; opt-out methods; whether people may direct the business to delete their data; activities that cannot be opted out of; whether purchasers are credentialed; a history of data breaches; a separate statement on data of people under 18; and the processors used. The breach history is filed but not published: "The division shall not publish any information that is submitted to the division pursuant to paragraph (6) of subsection d. of this section."
- Sensitive data. Section 3 says: "In no case shall a data broker or data collector sell or license sensitive data to any other individual or entity." Sensitive data includes precise geolocation (within a radius of 1,750 feet), health, financial account access data, sexual orientation, immigration status, biometric data and data from a known child. Section 1 also amends New Jersey's consumer data privacy law (P.L.2023, c.266) so that a controller must "not sell sensitive data", regardless of how many consumers' data it handles.
- Penalties. $2,500 for each day a data broker or data collector fails to register or pay the fee, plus the unpaid fees; $2,500 for each day it fails to submit or update the required information; and $50,000 for each record of sensitive data sold, offered for sale or licensed. The Division collects the registration penalties in a summary proceeding.
- Exemptions. Among others: HIPAA-covered health information, financial institutions subject to the Gramm-Leach-Bliley Act, consumer reporting agencies acting under the Fair Credit Reporting Act, and government entities.
Several law firms report that the Division of Consumer Affairs announced on July 10, 2026 that the first registration period will run from April 1 through June 30, 2027. We could not read that announcement on the Division's own site (see below), so treat those dates as reported, not confirmed. The text of P.L.2026, c.25 does not mention New Jersey's Daniel's Law, and it creates no deletion platform.
Vermont and New Jersey next to California, Texas and Oregon
| State | Registry agency | Annual fee | When to register | Central deletion mechanism |
|---|---|---|---|---|
| California | California Privacy Protection Agency | Set by the agency, not to exceed its reasonable costs | On or before January 31 after each year as a data broker | Yes; brokers must check it at least every 45 days from August 1, 2026 |
| Vermont | Secretary of State | $100; $900 from January 1, 2027 | Now: January 1-31. From January 1, 2027: within 30 days of becoming a broker, then by July 1 each year | No; study only, final report due December 1, 2028 |
| New Jersey | Division of Consumer Affairs | $5,000 to $1,500,000 by consumer count | Annually; first window reported as April 1 to June 30, 2027 (not confirmed) | No (not in P.L.2026, c.25) |
| Texas | Secretary of State | $300 (renewal $300) | Before doing business in Texas; certificate expires one year after issue | No (not in S.B. 2105 as enacted in 2023) |
| Oregon | Department of Consumer and Business Services (Division of Financial Regulation) | $600 (renewal $600) | Before collecting, selling or licensing; registration valid to December 31 | No (not in ORS 646A.593) |
For California's own figures, see the 2026 California data broker registry.
| Rule | Vermont (from January 1, 2027) | New Jersey |
|---|---|---|
| Covers sellers with a direct relationship | Only for data collected outside a first-party interaction | Yes, as "data collectors" when they sell or license to a data broker |
| Penalty for not registering | $200 per day | $2,500 per day |
| Sensitive data sales | Must be disclosed at registration | Prohibited |
| Precise geolocation radius | 1,850 feet | 1,750 feet |
| Bond | $20,000 | None in the text |
| Downloadable public list | Required (spreadsheet) | Public registry; format not set in the text |
What we could not confirm
- How many data brokers are registered in Vermont. The Secretary of State's Data Broker Search uses JavaScript and a reCAPTCHA check, and we found no downloadable list on 2026-10-12.
- How Vermont will handle the January 2027 filing window. The Secretary of State's page still describes the January 1-31 window, and we found no transition rule in Act 138 between that window and the new July 1 deadline.
- New Jersey's first registration period (April 1 to June 30, 2027) and the July 10, 2026 announcement. The Division of Consumer Affairs alerts page (njconsumeraffairs.gov) returned an automated bot-check page instead of content, so we did not read it; the dates come from law firm reports.
- Whether New Jersey's registry provision becomes operative on March 27 or March 28, 2027. The law says it stays inoperative "for 270 days following the date of enactment"; March 27, 2027 is the 270th day by our count.
- The fee for a New Jersey business at exactly 500,000, one million, 1.5 million, 2.5 million or 4.5 million consumers. The schedule's tiers use "more than" and "fewer than", and we found no rule addressing those exact numbers. We did not search for proposed New Jersey rules.
- Texas changes after 2023. We read S.B. 2105 as enacted; we did not check later amendments or renumbering of Texas Business and Commerce Code chapter 509.
- California's fee amount. The statute leaves it to the California Privacy Protection Agency, and we used only the statute here.
Questions
When does Vermont's new data broker law take effect?
How much is Vermont data broker registration?
How do I search the Vermont data broker registry?
What is the New Jersey data broker law effective date?
Can I ask every Vermont or New Jersey data broker to delete my data at once?
Sources
- Vermont Act 138 of 2026 (H.211), as enacted - Vermont General Assembly, read 2026-10-12
- Act 138 act summary - Vermont Office of Legislative Counsel, read 2026-10-12
- Bill status H.211 (Act 138) - Vermont General Assembly, read 2026-10-12
- 9 V.S.A. section 2446, current text - Vermont Statutes Online, read 2026-10-12
- Data Broker - Vermont Secretary of State, read 2026-10-12
- Data Broker Search - Vermont Secretary of State, Business Services Division, read 2026-10-12
- P.L.2026, c.25 (A5328 1R) - New Jersey Legislature, read 2026-10-12
- Data Broker Registry / Delete Act statute, effective 01/01/2026 - California Privacy Protection Agency, read 2026-10-12
- S.B. 2105, 88th Legislature, enrolled - Texas Legislature Online, read 2026-10-12
- ORS chapter 646A (section 646A.593) - Oregon State Legislature, read 2026-10-12
- Data Broker registry - Oregon Division of Financial Regulation, read 2026-10-12
Source links are not affiliate links. This page is general information, not legal, tax or financial advice.
