Vermont Signs Data Privacy and Online Surveillance Act, Overhauling Data Broker Registration and Adding Deletion Rights

Vermont’s governor signed the Vermont Data Privacy and Online Surveillance Act on June 16, 2026, making Vermont the fourth state this year to enact comprehensive data privacy legislation. The law substantially upgrades the state’s data-broker regime: brokers must register, pay a $900 annual fee, maintain a $20,000 surety bond, and provide a dedicated deletion-request webpage for consumers. Connecticut had passed its own data-broker law on May 14, 2026. At the federal level, House Republicans introduced the SECURE Data Act to create an FTC data-broker registry — a bill that would preempt state laws including Vermont’s new protections. The Brennan Center notes that data brokers remain largely unregulated federally despite documented sales of Americans’ data to law enforcement agencies including ICE.

This is the state-level surveillance-resistance front intersecting the same federal-preemption logic seen in AI governance (2026-06-04–great-american-ai-act-discussion-draft-three-year-state-preemption): states build broker protections from below while a federal “registry” bill is positioned to wipe them out from above. It joins the multistate surveillance-pricing cascade (2026-06-05–surveillance-pricing-ban-multistate-cascade-ct-ny-co-veto) and New York’s ICE-cooperation limits (2026-05-29–hochul-signs-ny-ice-cooperation-limits-287g-ban-mask-ban) as part of the 2026 state pushback against the surveillance apparatus — with the documented broker-to-ICE data pipeline (2025-09-08–sfpd-illegal-alpr-data-sharing-ice) as the enforcement gap the deletion-request requirement may or may not reach.