DPO SchoolDPO School

Vermont Data Privacy and Online Surveillance Act

Vermont privacy law: applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Act applies to persons doing business in Vermont or targeting its residents that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers, or sensitive data of at least 3,000 consumers (excluding payment-only data in both cases), or offered for sale personal data of at least 3,000 consumers. The consumer health data rules apply to any person doing business in or targeting Vermont, with no threshold. There is no general exemption for nonprofits or higher education. GLBA and HIPAA exemptions are mostly data-level, with entity-level carve-outs for banks and credit unions, non-hybrid covered entities and business associates.

Key points

  1. Threshold: personal data of at least 35,000 consumers in the preceding calendar year, excluding payment-only data.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415b(a)(1)

  2. Threshold: sensitive data of at least 3,000 consumers.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415b(a)(2)

  3. Threshold: offered for sale the personal data of at least 3,000 consumers (no revenue test).

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415b(a)(3)

  4. Consumer health data provisions, including § 2415k, apply to all persons doing business in or targeting Vermont, regardless of size.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415b(b)

  5. Where laws conflict, including the Vermont Age-Appropriate Design Code Act, the more privacy-protective law controls.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415b(c)

  6. GLBA: data subject to Title V is exempt, and state or federally chartered banks, credit unions and their financial affiliates are exempt as entities.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415c(a)(13), (14)

  7. HIPAA: covered entities that are not hybrid entities, health care components of hybrid entities, and business associates are exempt; protected health information is exempt.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415c(a)(2), (18)

  8. No general nonprofit or higher-education exemption; only specific bodies (victim services, insurance fraud and enrollment-reporting nonprofits, noncommercial press) are exempt, along with employment, emergency-contact and benefits data.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415c(a)(20) to (24)

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Vermont statute

Reference material, not legal advice.