--- title: "Vermont privacy law: applicability" canonical: "https://dposchool.com/state-privacy-laws/state/vermont/applicability" source: "https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Vermont Data Privacy and Online Surveillance Act # Vermont privacy law: applicability Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) The Act applies to persons doing business in Vermont or targeting its residents that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers, or sensitive data of at least 3,000 consumers (excluding payment-only data in both cases), or offered for sale personal data of at least 3,000 consumers. The consumer health data rules apply to any person doing business in or targeting Vermont, with no threshold. There is no general exemption for nonprofits or higher education. GLBA and HIPAA exemptions are mostly data-level, with entity-level carve-outs for banks and credit unions, non-hybrid covered entities and business associates. ## Key points 1. Threshold: personal data of at least 35,000 consumers in the preceding calendar year, excluding payment-only data. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415b(a)(1)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 2. Threshold: sensitive data of at least 3,000 consumers. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415b(a)(2)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 3. Threshold: offered for sale the personal data of at least 3,000 consumers (no revenue test). Section: [Act 145, Sec. 1, 9 V.S.A. § 2415b(a)(3)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 4. Consumer health data provisions, including § 2415k, apply to all persons doing business in or targeting Vermont, regardless of size. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415b(b)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 5. Where laws conflict, including the Vermont Age-Appropriate Design Code Act, the more privacy-protective law controls. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415b(c)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 6. GLBA: data subject to Title V is exempt, and state or federally chartered banks, credit unions and their financial affiliates are exempt as entities. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415c(a)(13), (14)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 7. HIPAA: covered entities that are not hybrid entities, health care components of hybrid entities, and business associates are exempt; protected health information is exempt. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415c(a)(2), (18)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 8. No general nonprofit or higher-education exemption; only specific bodies (victim services, insurance fraud and enrollment-reporting nonprofits, noncommercial press) are exempt, along with employment, emergency-contact and benefits data. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415c(a)(20) to (24)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) ## Sources - [Act 145 (S.71) as enacted, 2025-2026 session](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) [Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Vermont statute](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) Reference material, not legal advice. ## Other topics for Vermont - [Consumer rights](https://dposchool.com/state-privacy-laws/state/vermont/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/vermont/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/vermont/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/vermont/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/vermont/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Vermont](https://dposchool.com/state-privacy-laws/state/vermont) / Applicability Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/vermont/consumer-rights) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents