DPO SchoolDPO School

Vermont Data Privacy and Online Surveillance Act

Vermont privacy law: consumer rights

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Consumers may confirm and access their data, including inferences and whether it is used for consequential profiling, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and profiling for automated decisions with legal or similarly significant effects. They may also question a profiling decision, learn its reasons and review the data used, and obtain a list of third parties to which their data (or any data) was sold. Controllers must respond within 45 days, extendable by 45 days, and must answer appeals within 60 days.

Key points

  1. Access includes inferences derived from personal data and whether data is processed for consequential profiling.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415d(a)(1)

  2. Rights to correct, delete and obtain a portable copy of data processed by the controller.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415d(a)(2) to (4)

  3. Opt out of targeted advertising, sale, and profiling in furtherance of any automated decision with legal or similarly significant effects.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415d(a)(5)

  4. After consequential profiling: question the result, learn the reason, review the data used and, for housing decisions, correct data and have the decision reevaluated.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415d(a)(6)

  5. Right to a list of the specific third parties to which the consumer's data was sold, or of all third parties to which the controller sold data.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415d(a)(7)

  6. Response within 45 days, extendable by 45 days with notice; free once per 12 months.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415d(c)(1), (3)

  7. Appeal process required; written answer within 60 days; on denial, the controller must show how to complain to the Attorney General.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415d(d)

  8. Authorized agents, including browser settings, extensions or global device settings, may opt out on a consumer's behalf.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415d(b)(2)

Sources

Compare consumer rights across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Vermont statute

Reference material, not legal advice.