Vermont data broker bonds.
$100 flat.

What the bond actually guarantees

The bond is required from January 1, 2027, not before. Vermont has registered data brokers with the Secretary of State since 2019, and the version of 9 V.S.A. § 2446 in force until January 1, 2027 asks for a registration each January and a fee, but no bond. Act 138 (H.211), which the Governor approved on June 16, 2026, rewrites the section from that date: a data broker must register within 30 days of meeting the definition and then on or before July 1 each year, pay a $900 registration fee, and maintain a bond in the amount of $20,000 that runs to the State (§ 2446(a)(3)). Each registration must include an electronic copy of the bond (§ 2446(a)(4)(G)(i)). The bond is available now, so you can have it issued and in hand before the requirement starts.

It’s a three-party arrangement: you (the principal), the surety, and the State of Vermont (the obligee). Section 2446(a)(3) says the bond runs to the State for any liability arising under this subchapter, the data broker subchapter of Vermont’s Protection of Personal Information chapter (9 V.S.A. chapter 62, subchapter 5). The section’s own penalties show what that can mean: an administrative fine of $200 for each day a data broker fails to register, and a $25,000 civil penalty for filing materially incorrect information (§ 2446(b)). Whatever the claim, the surety’s liability stops at the $20,000 penal sum, and an action on the bond must be brought within two years after the cause of action accrues.

Who has to file? From January 1, 2027, 9 V.S.A. § 2430(6)(A) defines a data broker as a business, or unit or units of a business, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship. Act 138 rewrites the definitions around it on the same date. Brokered personal information becomes any information, including derived data and unique identifiers, that is linked or reasonably linkable to an identified or identifiable individual, publicly available information excluded. A direct relationship means the consumer intentionally interacted with the business to access, buy, use, request or get information about its products or services, and collecting data straight from a consumer does not create one by itself. Some exclusions in the pre-2027 definition, such as 411 directory services and sales merely incidental to the business, are not in the 2027 text; the exclusion for a one-time or occasional sale of assets remains (§ 2430(6)(C)). For this subchapter a consumer is a Vermont resident, not someone acting in a commercial or employment role (§ 2446(e)). If you are not sure you meet the definition, settle that with counsel or the Secretary of State before you register: we issue the bond, we do not decide who needs it.

It is not insurance for you — if the surety pays a claim, you repay the surety. The statute says to maintain the bond and to file a copy with every registration, but it sets no bond term, renewal date or cancellation rule, so keep it continuous from one term to the next. Nor does it say when a broker already registered under the January cycle first registers under the new July 1 cycle; if that is you, ask the Secretary of State’s Business Services Division. We track your term and send renewal notices 60 and 30 days out.

From January 1, 2027, you need this bond if you’re