VOW compliance requirements

VOW compliance is the set of operating conditions attached to the VOW data feed: register consumers before they see gated data, capture terms-of-use acceptance, expire passwords on schedule, enforce the gate on the server, keep auditable records, and respect display limits. The board holds the operator to these conditions, and your website vendor is the party that actually implements most of them. This page turns the conditions into a checklist you can hand to any vendor, with how BrokerFold satisfies each line. General information, not legal advice.

The checklist, requirement by requirement

The rest of this page expands the lines that most often separate a real implementation from a brochure claim.

Registration, terms and the password clock

The wall is a three-part contract with the consumer. They register, they affirmatively accept terms of use that establish a broker-consumer relationship and bind them to personal, non-commercial use, and they hold a password whose validity is capped at 90 days under TRREB’s terms, renewable thereafter. Operationally the details are unforgiving: the acceptance has to be recorded, the expiry has to be derived per request rather than trusted to a cron job, and a renewal must restore access without silently manufacturing a terms acceptance that never happened. These are the mechanics BrokerFold runs in production for every tenant site, described from the visitor’s side on what is a VOW.

Server-side gating is the load-bearing requirement

Every other line on the checklist can be satisfied on paper while the site still leaks. The test is simple: open a sold listing as an anonymous visitor and inspect the page source. If the address, price or photo URLs are present but visually obscured, the site is publishing gated data and decorating it. A compliant implementation redacts on the server, so the anonymous response never contains the gated values, and shows purpose-built blurred preview images generated in the image pipeline. This is how BrokerFold is built, and it is the single most revealing question to put to any vendor on this list.

Records: what you want to exist when someone asks

The agreement makes the operator accountable for who accessed gated data. Two artifacts cover that accountability: a per-visitor record of terms acceptance with its timestamp, and a log of sold-data access by registered visitors that cannot be edited after the fact. BrokerFold writes both automatically, which means the audit answer is a query, not an archaeology project. Vendors who cannot say what they log have answered the question.

Boundaries that persist even for signed-in visitors

Compliance does not end at the login. Per-inquiry result caps apply to VOW consumers. Fields licensed for brokerage-internal use, private remarks being the obvious example, stay out of every consumer surface regardless of session state. And the sold-data permission is a display permission on your registered VOW, not a general publication right; marketing a specific transaction remains a separate, consent-based activity under RECO’s advertising rules.

Using this list

If you are evaluating platforms, send the table above and ask for a demonstration of lines 1, 4 and 5 on a live site, since those are the ones that cannot be faked in a sales deck. If you are already running a VOW, the TRREB VOW website page shows what a current implementation looks like, and the VOW website pillar covers the platform end to end.