VT H0211

Data brokers must notify consumers and the Attorney General within 45 days of discovering a security breach affecting brokered personal information, including breach details and categories of data compromised

Secretary of State must establish an accessible deletion mechanism by January 1, 2028, allowing consumers to submit a single request to delete their personal information from all registered data brokers

Data brokers must access the deletion mechanism at least every 45 days beginning August 1, 2028, process deletion requests, and undergo independent compliance audits every three years starting December 31, 2030

Annual registration requirements expanded to include disclosure of whether brokers collect sensitive data such as precise geolocation, reproductive health data, biometric data, immigration status, and sexual orientation

Penalties increased to $200 per day for failure to register (up from $50) and $200 per day for each unprocessed deletion request, with all penalties deposited into a new Data Brokers Registry Fund