Vermont’s data brokers law aimed to bring data traders out of the shadows, but it’s not without limitations