---
title: "Vermont privacy law: enforcement"
canonical: "https://dposchool.com/state-privacy-laws/state/vermont/enforcement"
source: "https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Vermont Data Privacy and Online Surveillance Act

# Vermont privacy law: enforcement

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

A violation is a violation of the Vermont Consumer Protection Act, and the Attorney General enforces it with that Act's powers, including civil penalties of up to $10,000 for each unfair or deceptive act or practice. There is no private right of action. From 1 January 2028 to 30 June 2029, the Attorney General must give a notice of violation and 60 days to cure where it decides a cure is possible. The Attorney General must report yearly to the General Assembly and publish guidance.

## Key points

1. Violations are violations of the Consumer Protection Act, enforced by the Attorney General.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415j(a)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

2. Civil penalty up to $10,000 for each unfair or deceptive act or practice.

   Section: [9 V.S.A. § 2458(b)(1)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

3. No private right of action.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415j(a)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

4. Temporary cure: 60 days after a notice of violation, only where the Attorney General finds a cure possible, from 1 January 2028 to 30 June 2029.

   Section: [Act 145, Sec. 3](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

5. Annual enforcement report to the General Assembly by 1 December, and compliance guidance.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415j(b), (c)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

6. The legislature states it may add a private right of action if enforcement resources are not provided.

   Section: [Act 145, Sec. 2(a)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

## Sources

- [Act 145 (S.71) as enacted, 2025-2026 session](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)
- [9 V.S.A. § 2458 (Consumer Protection Act, restraining prohibited acts and civil penalties)](https://legislature.vermont.gov/statutes/section/09/063/02458)

[Compare enforcement across all states](https://dposchool.com/state-privacy-laws/topic/enforcement)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 83: General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83) (enforcement)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Vermont statute](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

Reference material, not legal advice.

## Other topics for Vermont

- [Applicability](https://dposchool.com/state-privacy-laws/state/vermont/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/vermont/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/vermont/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/vermont/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/vermont/processors)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Vermont](https://dposchool.com/state-privacy-laws/state/vermont) / Enforcement

Previous: [Processors](https://dposchool.com/state-privacy-laws/state/vermont/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents