Senate committee reviews H211 to expand Vermont's data‑broker registry, study deletion portal and tighten reporting

The Senate Economic Development, Housing & General Affairs committee took extended testimony on H211, a technical and policy update to Vermont's data‑broker registry law that would broaden what states must report, instruct the Attorney General to study deletion‑portal options and tighten penalties for inaccurate or vague registry entries.

Monique Priestley, the bill reporter, told the committee Vermont's registry listed 292 registered brokers as of the morning, and cited research from a privacy‑rights clearinghouse estimating roughly 750 data brokers across four state registries (California, Oregon, Texas and Vermont), implying several hundred brokers likely are not captured in Vermont's list. Priestley said the bill adds updated definitions, new reportable elements for registrants and a study to explore whether Vermont could link to or replicate California's deletion portal, which California launched Jan. 1 and which automates opt‑out requests across many registries.

Priestley also summarized California data: among 567 registered brokers in that state, 110 were identified as selling precise geolocation data, 52 were selling personal information to federal agencies, 33 to foreign actors and 31 to generative‑AI developers — categories Priestley said Vermont's registry currently does not track.

Privacy experts warned of enforcement challenges. Ryan Kger (formerly of Vermont's Attorney General's office and now a Massachusetts AG deputy chief) described the data‑broker business model as deeply opaque and said regulators and consumers face practical limits in verifying deletions. "Data brokers really don't seem to want anyone to know they exist," Kger said, arguing that many brokers collect, score and sell sensitive behavioral and location profiles that can be repurposed for fraud, targeted scams or other harmful uses.

Legislative counsel Rick Sle then presented section‑by‑section changes, noting the bill broadens the definition of "brokered personal information" to explicitly include derived data and device identifiers that are linked or reasonably linkable to individuals or devices, expands reportable registry elements, clarifies security‑breach reporting thresholds and tightens penalties for materially incorrect registry entries.

Committee members raised practical questions about the cost and technical feasibility of a deletion portal for a small state; witnesses noted California's portal is a possible model but resource demands vary. Lawmakers also discussed exemptions for legitimate uses (fraud prevention, identity verification, credentialing) and concerns about public‑information carve‑outs that could allow brokers to retain aggregated or previously public data.

No formal votes were taken. The committee paused the bill for additional review and followup with state agencies and privacy stakeholders about implementation options and enforcement capacity.