Comprehensive state privacy law
Vermont privacy law
Vermont Data Privacy and Online Surveillance Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- 9 V.S.A. §§ 2415a to 2415k (9 V.S.A. chapter 61A, subchapter 1, added by 2026 Act 145, Sec. 1)
- Official text
- https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf
- Enacted
- June 16, 2026. 2026 Acts and Resolves No. 145 (S.71), signed by the Governor 16 June 2026
- In force
- Enacted, in force January 1, 2028
- Effective dates
- January 1, 2028: whole act (Act 145, Sec. 4)
- January 1, 2028: data protection and impact assessments apply only to processing activities created or generated after this date (9 V.S.A. § 2415g(e)(3))
- January 1, 2028: discretionary 60-day cure period runs from this date to 30 June 2029 (Act 145, Sec. 3)
- Enforcer
- Attorney General (under the Vermont Consumer Protection Act)
- Private right of action
- No. No private right of action under the Act or any other law (9 V.S.A. § 2415j(a)). Act 145, Sec. 2 states that the General Assembly may consider adding one if enforcement resources are not provided.
- Cure period
- 60 days. Ends June 30, 2029. From 1 January 2028 to 30 June 2029 the Attorney General must issue a notice of violation before suing, but only where it determines a cure is possible; the person then has 60 days to cure. No cure period applies after 30 June 2029. (Act 145, Sec. 3 (uncodified))
- Rulemaking
- No, Attorney General. No rulemaking power; the Attorney General must issue and update compliance guidance (9 V.S.A. § 2415j(c)) and report annually to the General Assembly (§ 2415j(b)).
Amendments
No amendments recorded.
Topics
- ApplicabilityThe Act applies to persons doing business in Vermont or targeting its residents that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers, or sensitive data of at least 3,000 consumers (excluding payment-only data in both cases), or offered for sale personal data of at least 3,000 consumers. The consumer health data rules apply to any person doing business in or targeting Vermont, with no threshold. There is no general exemption for nonprofits or higher education. GLBA and HIPAA exemptions are mostly data-level, with entity-level carve-outs for banks and credit unions, non-hybrid covered entities and business associates.
- Consumer rightsConsumers may confirm and access their data, including inferences and whether it is used for consequential profiling, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and profiling for automated decisions with legal or similarly significant effects. They may also question a profiling decision, learn its reasons and review the data used, and obtain a list of third parties to which their data (or any data) was sold. Controllers must respond within 45 days, extendable by 45 days, and must answer appeals within 60 days.
- Sensitive dataSensitive data may be processed only with consent and only where reasonably necessary for the purposes of collection, and it may not be sold without consent. The definition is wide: it adds nonbinary or transgender status, disability, consumer health data, neural data, financial account credentials and government ID numbers to the usual categories. Known children's sensitive data must be processed under COPPA, and controllers may not use data of consumers aged 13 to 17 for targeted advertising or sell it. Separate consumer health data rules ban geofencing within 1,850 feet of health care facilities and require consent to sell health data.
- Controller dutiesControllers must limit collection to what is reasonably necessary and proportionate to the disclosed purposes, need consent for material new purposes, and keep reasonable security. The privacy notice must include, among other things, the categories of data sold and of buyers, a statement on whether data is collected, used or sold to train large language models, and the date of the last update, and it must be linked from the home page. From 1 January 2028 controllers must honour opt-out preference signals for targeted advertising and sale. Data protection assessments and separate impact assessments for consequential profiling are required.
- ProcessorsProcessors must follow controller instructions and help with consumer requests, security and breach notification, and assessments. A binding contract must set out instructions, nature and purpose, data types, duration and both parties' rights and obligations. It must also require confidentiality, deletion or return at the end, compliance information on request, and subcontracting only after the controller can object and under a written flow-down contract. Processors must provide assessment reports on request.
- EnforcementA violation is a violation of the Vermont Consumer Protection Act, and the Attorney General enforces it with that Act's powers, including civil penalties of up to $10,000 for each unfair or deceptive act or practice. There is no private right of action. From 1 January 2028 to 30 June 2029, the Attorney General must give a notice of violation and 60 days to cure where it decides a cure is possible. The Attorney General must report yearly to the General Assembly and publish guidance.
Sources
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Vermont statute
Reference material, not legal advice.