Which of the following became the first state to pass a law specifically regulating the practices of data brokers?

In 2018, Vermont passed Act 171 (H.764), becoming the first U.S. state to enact a law specifically targeting and regulating "data brokers." The law requires data brokers who buy or sell the personal information of Vermont consumers with whom they do not have a direct relationship to register annually with the Secretary of State. It also imposes minimum data security standards and mandates reporting of security breaches. This legislation predates other significant state privacy laws that also regulate data brokers, such as the California Consumer Privacy Act (CCPA).

A. Washington has considered several privacy bills, including ones addressing data brokers, but it was not the first state to pass such a specific law.
B. California's CCPA, passed after Vermont's law, regulates data brokers as part of a broader consumer privacy framework but was not the first state law to do so.
C. New York has various data security and privacy laws, but it was not the first to specifically enact a data broker registration law like Vermont's.

1. State of Vermont, Act No. 171 (H.764). "An act relating to the regulation of data brokers and consumer protection." Signed into law May 22, 2018. Section 1, § 2446, "Data broker registration."

2. Mulligan, D. K., & King, J. (2019). "A Research Agenda for Data Broker Regulation." Berkeley Technology Law Journal, 34(1), 161-210. The article discusses the novelty and specifics of Vermont's Act 171 as a pioneering regulatory model. (See introduction and discussion of the Vermont law).

3. Hintze, M. (2018). "Vermont Passes First-in-the-Nation Data Broker Law." Future of Privacy Forum. This publication analyzes the law's passage and its status as the first of its kind in the nation.