--- title: "Vermont privacy law: consumer rights" canonical: "https://dposchool.com/state-privacy-laws/state/vermont/consumer-rights" source: "https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Vermont Data Privacy and Online Surveillance Act # Vermont privacy law: consumer rights Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Consumers may confirm and access their data, including inferences and whether it is used for consequential profiling, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and profiling for automated decisions with legal or similarly significant effects. They may also question a profiling decision, learn its reasons and review the data used, and obtain a list of third parties to which their data (or any data) was sold. Controllers must respond within 45 days, extendable by 45 days, and must answer appeals within 60 days. ## Key points 1. Access includes inferences derived from personal data and whether data is processed for consequential profiling. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415d(a)(1)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 2. Rights to correct, delete and obtain a portable copy of data processed by the controller. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415d(a)(2) to (4)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 3. Opt out of targeted advertising, sale, and profiling in furtherance of any automated decision with legal or similarly significant effects. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415d(a)(5)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 4. After consequential profiling: question the result, learn the reason, review the data used and, for housing decisions, correct data and have the decision reevaluated. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415d(a)(6)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 5. Right to a list of the specific third parties to which the consumer's data was sold, or of all third parties to which the controller sold data. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415d(a)(7)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 6. Response within 45 days, extendable by 45 days with notice; free once per 12 months. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415d(c)(1), (3)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 7. Appeal process required; written answer within 60 days; on denial, the controller must show how to complain to the Attorney General. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415d(d)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) 8. Authorized agents, including browser settings, extensions or global device settings, may opt out on a consumer's behalf. Section: [Act 145, Sec. 1, 9 V.S.A. § 2415d(b)(2)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) ## Sources - [Act 145 (S.71) as enacted, 2025-2026 session](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) [Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access) - [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion) - [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Vermont statute](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf) Reference material, not legal advice. ## Other topics for Vermont - [Applicability](https://dposchool.com/state-privacy-laws/state/vermont/applicability) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/vermont/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/vermont/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/vermont/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/vermont/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Vermont](https://dposchool.com/state-privacy-laws/state/vermont) / Consumer rights Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/vermont/applicability) Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/vermont/sensitive-data) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents