DPO SchoolDPO School

Vermont Data Privacy and Online Surveillance Act

Vermont privacy law: sensitive data

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Sensitive data may be processed only with consent and only where reasonably necessary for the purposes of collection, and it may not be sold without consent. The definition is wide: it adds nonbinary or transgender status, disability, consumer health data, neural data, financial account credentials and government ID numbers to the usual categories. Known children's sensitive data must be processed under COPPA, and controllers may not use data of consumers aged 13 to 17 for targeted advertising or sell it. Separate consumer health data rules ban geofencing within 1,850 feet of health care facilities and require consent to sell health data.

Key points

  1. Processing of sensitive data requires consent and must be reasonably necessary for the purposes of collection; sale requires consent.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(4)(A), (B)

  2. Sensitive data includes nonbinary or transgender status, disability, consumer health data, genetic or biometric data, neural data, financial account credentials and government ID numbers.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415a(b)(47)

  3. Known children's sensitive data must be processed under COPPA and, where applicable, 9 V.S.A. § 2449f.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(4)(C)

  4. Consumers aged 13 to 17: no targeted advertising and no sale of their personal data.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(7)

  5. Consent must be revocable as easily as given; processing must stop within 15 days of the revocation request.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(6)

  6. Consumer health data: no geofence within 1,850 feet of a health care facility to track or message consumers, no sale without consent, and confidentiality duties for staff and processors.

    Section: Act 145, Sec. 1, 9 V.S.A. § 2415k

Sources

Compare sensitive data across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Vermont statute

Reference material, not legal advice.