This page sets out how the Databanking model could be tested in Vermont, by replacing the inspection of identity documents with a query to a licensed custodian of the person's choosing, under laws Vermont has already enacted: the licence for personal information protection companies, the Data Privacy and Online Surveillance Act and the Age-Appropriate Design Code.
Organisations frequently do not need a copy of a person's underlying data. They need an answer derived from it. Databanking keeps the data with a regulated custodian. The organisation submits an authorised query or computation, and the Databank returns only the permitted result: an attestation, a match or no-match, an eligibility decision. The worked example follows one such transaction end to end.
Vermont has already legislated for much of what such a model requires. Since 2018 its statutes have provided for personal information protection companies, licensed by the Department of Financial Regulation to receive, hold and manage the disclosure or use of a consumer's personal information under a fiduciary duty to that consumer. On 16 June 2026 the state enacted the Vermont Data Privacy and Online Surveillance Act, which from 1 January 2028 limits the collection of personal data to what is reasonably necessary and proportionate, and on the same day it strengthened its data broker law. Its Age-Appropriate Design Code takes effect on 1 January 2027, and the Attorney General's Office is finalising rules on how online services may establish a user's age with the least intrusion. What Vermont does not yet have is a custodian that answers a question in place of disclosing the record.
This pilot aims to replace the inspection of identity documents with a query. A person's date of birth, verified against the state's motor vehicle records, would be held by a licensed custodian of the person's choosing. A business that needs to know whether the person is 21 or over would put that question to the custodian and receive only the answer. Under statutes already enacted, the pilot would test parts of the proposed Databanking model that have not been tested by any existing system: a custodian independent of both the source registry and the relying business and bound to the individual by a fiduciary duty, more than one such custodian competing for accounts, portability between them, and a share of each access fee returned to the person whose data was queried.
Vermont already has in statute the legal foundations of the Databanking model: a licensed custodian with a fiduciary duty, a statutory standard of proportionate collection, and a regulator under instruction to find age-assurance methods that protect privacy.
Since 2018, Vermont law has provided for personal information protection companies, licensed by the Department of Financial Regulation to hold and manage a consumer's personal information under a fiduciary duty, and to certify or validate it to third parties.
The Data Privacy and Online Surveillance Act, signed on 16 June 2026, limits collection from 1 January 2028 to what is reasonably necessary and proportionate, and treats government identification numbers as sensitive data.
The Age-Appropriate Design Code takes effect on 1 January 2027, and the Attorney General's Office is finalising rules that require the least intrusive reasonably accurate method of establishing age.
The Department of Financial Regulation supervises banking, insurance and securities, and has made Vermont home to 707 captive insurance companies, an industry built over four decades.
Age is still established by showing a document. At a counter, a clerk reads a whole licence (name, address, date of birth, licence number and photograph) to learn one fact, and identity scanners and online verification services can retain what they capture. The proposed age-assurance rules set out a ladder of methods, from self-declaration through estimation from device or usage data to the checking of credentials, and permit a business to climb it only as far as the risk requires. Each step up the ladder buys accuracy with disclosure: the more certain a business becomes of a user's age, the more it learns about the user. Selective disclosure loosens that link, since a mobile driving licence can confirm that its holder is 21 or over without revealing the date of birth, and Vermont law has provided for mobile identification with limited profiles since 2023. What a credential does not provide is an independent custodian answering on the person's behalf, with a fresh answer each time a question is asked, a record of every query, accounts that can move between competing custodians, and a share of each fee returned to the person.
The licence for personal information protection companies provides the custodian and its duty, but not the discipline that makes a custodian a Databank. The statute permits a company to release elements of the information it holds. It does not oblige the company to answer in place of releasing, to refrain from analysing what it holds, to account to the consumer for every query, to let the consumer move the account to a competitor on a common schema, or to share the fee for each answer. Those are the conditions the pilot would add, as conditions of the licence or under the Department's existing rulemaking power. Whether all of them can be imposed under the statute as it stands is settled in the first phase.
Nor does the statute create a custodial market. It provides no common account schema on which a person could move between custodians, and no mechanism by which part of the value of an access returns to the person whose data was accessed.
The proposal does not depend on whether any company holds such a licence today, since the pilot custodians would apply for licences of their own with the Databanking conditions attached.
The pilot would route a single class of transaction, the age check, through a personal information protection company operating as a Databank.
The Databank never analyses what it holds. It keeps the record, enforces the individual's permissions, executes approved computations and releases bit-scarce results under an auditable leakage budget. It earns revenue from custody and authorised access alone. The individual can move the account to the other pilot Databank at any time, on a standardised account schema, without the record passing through any relying business.
The online flow requires no new legislation. At the counter, an answer can stand in for an identity document only where the law on age-restricted sales allows it and the Cannabis Control Board and the Department of Liquor and Lottery accept it, which is a question for the first phase.
The value of a pilot lies in testing the assumptions most vulnerable to failure. For Databanking, these are institutional and economic: whether individuals will entrust a record to an independent custodian, whether relying organisations will accept an answer in place of the record, whether custodians can compete and accounts can move between them, and whether a custodian can sustain itself without exploiting what it holds.
Vermont has already answered part of the institutional question in statute. A licence class for custodians of personal information, bound by fiduciary duty and supervised by the financial regulator, exists. A pilot that elsewhere would have to begin by persuading a legislature to create such a licence can begin in Vermont with an application. Because a state licenses and supervises such companies itself, licensing and supervising the pilot custodians lie within Vermont's own powers.
The Department of Financial Regulation has shown what a specialist licence can grow into. A personal information protection company must, like a captive insurer, be organised in Vermont, keep a place of business there and meet there each year, while serving consumers anywhere. A custodial industry built on the licence would be a Vermont industry, in the way captive insurance became one.
The timing is unusually precise: the Age-Appropriate Design Code and the strengthened data broker law take effect on 1 January 2027, and the Data Privacy and Online Surveillance Act a year later. Businesses are now deciding how they will establish age and how little they can collect, and the Attorney General's Office, which enforces both the design code and the privacy act, is finalising its age-assurance rules. A pilot designed now would produce evidence while those decisions are still being made.
Vermont also offers the hardest market in which to test the economic proposition. The United States has no general federal privacy statute. If relying businesses accept an answer in place of a record in Vermont, and pay for it, the result carries weight well beyond the state.
At about 645,000 people, with a citizen legislature and a compact set of institutions, Vermont is of a scale at which a bounded experiment is meaningful and its results legible.
The Vermont pilot would test four forms of viability, weighted towards the institutional and the economic.
A threshold computation on a date of birth is simple. What remains open is binding the answer to the person presenting it, online and at the counter, without a national electronic identity, and a leakage budget on a date of birth queried at more than one threshold.
Can a personal information protection company, bound by fiduciary duty and licence conditions, hold a credible separation between custody and exploitation? Does the fiduciary duty strengthen that separation in practice?
Will adults open an account so as not to show or upload a document? Will businesses pay for a one-bit answer when less accurate methods cost less? Does the individual's share of the fee matter, and at what level?
Can the Attorney General accept a Databank answer as privacy-minded age assurance and as proportionate collection? Can the Department of Financial Regulation license a Databank under the statute as it stands?
The initial transaction should be selected jointly with the participating organisations and regulators. One candidate fits Vermont's new laws closely enough to be proposed as the starting point.
Age is checked often and is rarely needed in full. A business that must know whether a customer is 21 or over learns, from a driver's licence, the customer's name, address, date of birth, licence number and photograph. From 1 January 2027 an online service within the Age-Appropriate Design Code must establish whether its users are minors by privacy-minded methods, collecting only what that determination strictly requires and deleting it afterwards. From 1 January 2028 the Data Privacy and Online Surveillance Act requires businesses above its thresholds to collect only what is proportionate, and treats government identification numbers as sensitive data. One threshold is the processing of sensitive data of 3,000 Vermonters in a year, which a busy retailer scanning licences can reach, so that scanning can itself bring a retailer within the act. In the pilot the age check runs inside a Databank:
The design code's own question, whether a user is a minor, is the same query at a lower threshold.
A Databank answer gives a business a credential's certainty about the holder's age with less disclosure than self-declaration, since a user who declares a date of birth reveals more than one bit. The relying businesses are under legal duties, so the regulatory question is precise. The baseline already exists, since the same checks run today by inspection, upload or facial estimation, so the pilot can compare answer against document directly. Date of birth is the standard target for leakage, since threshold questions at different ages progressively narrow it, and the pilot would test the leakage budget on exactly the class of query that most needs one. The transaction is frequent and of low value, which makes it the sternest test of whether a per-query fee, and the individual's share of it, can sustain a custodian. And both sides can see the benefit: the customer shows no document, and the business holds no identity document or date of birth that it must secure, retain and delete.
At the counter the same answer could replace the inspection of a licence for sales of alcohol, cannabis and tobacco, where the law and the regulators allow it. In place of a licence handed over and read by the cashier, the customer would tap a phone or a linked payment card, and the till would show a signed yes or no. The cashier sees neither name nor address, a forged licence can no longer pass, and the Databank's audit ledger shows that the check was made. The age assurance case treats the same query in general terms.
Other Vermont candidates remain open: residency and eligibility attestations; consumer health data, which the privacy act protects at every business regardless of size; and research access to health records, the most institutionally demanding of them, discussed in the health data case.
A realistic Databanking transaction involves four roles, and in Vermont all four already have a legal footing. The pilot brings them together, with two custodians rather than one.
Above these sits the governance layer: the Department of Financial Regulation, which licenses and supervises the custodians; the Attorney General's Office, which enforces the design code and the privacy act; the Department of Motor Vehicles; the Cannabis Control Board and the Department of Liquor and Lottery for sales at 21; and an independent auditor. In Vermont the authority that licenses the custodians is known before the pilot begins.
The whitepaper allows a Databank to be a commercial company, a non-profit or a state-backed institution, and the pilot custodians may take any of these forms, provided each is independent of both the source registry and the relying businesses. Two custodians are the minimum at which choice, switching and portability on a common schema can be observed in practice.
Databanking has an inherent multi-sided network problem. Individuals have little reason to open an account until organisations accept its answers, organisations have little reason to integrate until enough individuals hold one, and data providers have little reason to build interfaces before either.
In Vermont the new laws supply an early incentive. From 2027 online services within the design code must establish age by privacy-minded methods, and from 2028 every covered business must collect no more than is proportionate. Relying businesses therefore have a reason to integrate before many individuals hold accounts, and an answer that keeps identity documents out of their systems has value to them from the first day. The pilot needs only a closed group of businesses that agree in advance to accept a defined Databank answer, and a bounded cohort of adults recruited at the point where the age check appears. A user asked to establish their age can be offered the choice between the methods the business already uses and a Databank answer, which also gives the pilot a natural comparison group.
The demonstrator should sit alongside an interdisciplinary research programme. The lead use case keeps some of these questions narrow and sharpens others, and the last is specific to Vermont. Several are already open research strands in their own right.
A question at 21 bisects the date of birth beneath it, and questions at further thresholds would narrow it more. The retention-bounded leakage budget described in the whitepaper, a per-datum quota shared by all Requestors and derived from the short period for which a result may lawfully be held, would be tested on live traffic, including against Requestors that combine their answers.
The pilot fixes the approved queries in advance as a small catalogue of threshold questions. This makes scrutiny tractable, and tests the premise that a regulator can approve the questions a Requestor may ask in place of the data it may hold.
Motor vehicle records are authoritative but not infallible. The pilot must define how corrections flow back to the Department of Motor Vehicles, and who is responsible when the source is wrong.
The United States has no national electronic identity. The pilot must bind each account to its holder at enrolment, and bind each answer to the person presenting it, without the relying business learning more than it already knows.
Responsibility has to be allocated among the Department of Motor Vehicles, the Databank and the relying business when an answer is wrong.
A service could make a broader query a condition of access. The design code rules' limit to data strictly necessary, and the privacy act's proportionality standard, give the governance model a legal anchor for defining which queries a business may request.
With two custodians, breach containment and continuity can be tested directly, including the transfer of accounts if one custodian fails.
Accounts must move between the two pilot Databanks on a common schema. Because a personal information protection company may serve consumers wherever they live, a later phase can extend the pilot to residents of neighbouring states and test whether an answer is accepted across a state line.
The pilot should measure the cost of custody, computation, audit and support against fee income and the individual's share, and set both against what businesses spend today on age verification and on securing the identity data it produces.
Vermont law makes the custodian a fiduciary of the consumer. The pilot can establish what that duty requires of a custodian that answers rather than discloses, and whether it already reaches the prohibition on analysing what the custodian holds. It can also test whether payment per query is compatible with that duty, since a custodian paid for each answer gains from more questions being asked, and which safeguards keep that incentive in check.
The decisive test is whether three propositions hold at the same time. Individuals are willing to entrust the relevant record to a custodian they chose. Relying organisations accept the minimal authenticated result instead of the underlying record, and their regulator accepts that they have done so lawfully. The Databanks provide the service on economically sustainable terms while remaining strictly independent of commercial exploitation of what they hold.
Three further criteria are specific to the Vermont design: the two custodians are licensed under the statute with the Databanking conditions attached; accounts move between them on the common schema without loss and without passing through any relying business; and the individual's share of each access fee is paid and visible on their statement.
Secondary measures include the number of identity documents not shown, uploaded or scanned, accuracy, latency, dispute and correction rates, the frequency with which leakage budgets bind, integration cost for businesses, and compliance cost. Failure on any of these is itself evidence, and identifies where the model requires modification.
The adult cohort shows how the method treats adults. How it performs for minors, the design code's own concern, would need a separate study with its own safeguards.
The pilot custodians would operate under 8 V.S.A. chapter 78 as it stands. The Databanking conditions would be imposed through the licence, or by rule under § 2457, which already allows the Department of Financial Regulation to govern a company's safeguarding of personal information and its interaction with third parties.
For a relying business, the central question of the Data Privacy and Online Surveillance Act, whether collection is reasonably necessary and proportionate, has an unusually clear answer when what it receives is a yes or no, with no identity document or date of birth. The consumer rights the act creates, to access, correct, delete and obtain a portable copy of personal data, are the ordinary operations of a Databank account.
The proposed age-assurance rules define a ladder on which accuracy rises with intrusion. A Databank answer matches a credential's certainty about the holder's age and sits below self-declaration in disclosure. The pilot would give the Attorney General's Office the evidence on which to decide where such an answer belongs in its framework. Under the proposed rules, data collected to establish a user's age must be deleted once the determination is made, and a vendor acting for the business is bound by the same terms. The pilot would need to establish that a Databank holds the date of birth as the individual's custodian rather than as the business's vendor, so that the deletion duty attaches to what the business receives and not to the custodian's record.
The Driver's Privacy Protection Act permits a motor vehicle department to release a record to a requester holding the written consent of the person it concerns. The pilot enrols adults only, so its own processing does not engage the Children's Online Privacy Protection Act. The United States has no general federal privacy statute, so a pilot conducted under Vermont law tests what a state can establish within its own powers.
A successful pilot leads not automatically to scale-up but to an evidence-based decision about which parts of the model merit further development.
The only commitments needed at this stage are those that allow the first two phases, scoping and design, to begin. None involves legislation, statewide deployment or funding.
If the answer can be demonstrated convincingly, the resulting architecture, regulatory treatment and economic evidence would provide a basis for deciding whether Databanking should develop into a broader infrastructure industry, in Vermont and beyond.
The model itself is set out in the Databanking whitepaper, and the FAQ addresses the objections it most often meets. Enquiries about participation in a pilot are welcome at contact@databanking.org.