9 V.S.A. § 2431: Acquisition and disclosure of brokered personal information; prohibitions [Effective January 1, 2027; see also § 2431 effective until January 1, 2027, set out above]

(a) Prohibited acquisition and use.

(1) A person shall not acquire brokered personal information through fraudulent means.

(2) A person shall not acquire or use brokered personal information for the purpose of:

(A) stalking or harassing another person;

(B) committing a fraud, including identity theft, financial fraud, or email fraud; or

(C) engaging in unlawful discrimination, including employment discrimination and housing discrimination.

(b) Disclosure. A data broker shall:

(1) maintain procedures that require prospective users of the data broker’s brokered personal information to identify themselves, state the purposes for which the information is sought, and certify that the information shall be used for no other purpose;

(2) prior to disclosing brokered personal information to a prospective user and pursuant to subdivision (1) of this subsection:

(A) make a reasonable effort to verify the identity of the prospective user of the information; and

(B) review the user’s stated purposes for which the information is sought; and

(3) not disclose brokered personal information to a prospective user if the data broker has reasonable grounds for believing that the information will be used to violate State or federal law or will not be used for the purposes stated by the user pursuant to this subsection.

(c) Enforcement.

(1) A person who violates a provision of this section commits an unfair and deceptive act in commerce in violation of section 2453 of this title.

(2) The Attorney General has the same authority to adopt rules to implement the provisions of this section and to conduct civil investigations, enter into assurances of discontinuance, bring civil actions, and take other enforcement actions as provided under chapter 63, subchapter 1 of this title.