DPO SchoolDPO School

Vermont Data Privacy and Online Surveillance Act

Vermont privacy law: enforcement

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

A violation is a violation of the Vermont Consumer Protection Act, and the Attorney General enforces it with that Act's powers, including civil penalties of up to $10,000 for each unfair or deceptive act or practice. There is no private right of action. From 1 January 2028 to 30 June 2029, the Attorney General must give a notice of violation and 60 days to cure where it decides a cure is possible. The Attorney General must report yearly to the General Assembly and publish guidance.

Key points

  1. Violations are violations of the Consumer Protection Act, enforced by the Attorney General.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415j(a)

  2. Civil penalty up to $10,000 for each unfair or deceptive act or practice.

    Section: 9 V.S.A. § 2458(b)(1)

  3. No private right of action.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415j(a)

  4. Temporary cure: 60 days after a notice of violation, only where the Attorney General finds a cure possible, from 1 January 2028 to 30 June 2029.

    Section: Act 145, Sec. 3

  5. Annual enforcement report to the General Assembly by 1 December, and compliance guidance.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415j(b), (c)

  6. The legislature states it may add a private right of action if enforcement resources are not provided.

    Section: Act 145, Sec. 2(a)

Sources

Compare enforcement across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Vermont statute

Reference material, not legal advice.