---
title: "Vermont privacy law: sensitive data"
canonical: "https://dposchool.com/state-privacy-laws/state/vermont/sensitive-data"
source: "https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Vermont Data Privacy and Online Surveillance Act

# Vermont privacy law: sensitive data

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Sensitive data may be processed only with consent and only where reasonably necessary for the purposes of collection, and it may not be sold without consent. The definition is wide: it adds nonbinary or transgender status, disability, consumer health data, neural data, financial account credentials and government ID numbers to the usual categories. Known children's sensitive data must be processed under COPPA, and controllers may not use data of consumers aged 13 to 17 for targeted advertising or sell it. Separate consumer health data rules ban geofencing within 1,850 feet of health care facilities and require consent to sell health data.

## Key points

1. Processing of sensitive data requires consent and must be reasonably necessary for the purposes of collection; sale requires consent.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(4)(A), (B)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

2. Sensitive data includes nonbinary or transgender status, disability, consumer health data, genetic or biometric data, neural data, financial account credentials and government ID numbers.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415a(b)(47)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

3. Known children's sensitive data must be processed under COPPA and, where applicable, 9 V.S.A. § 2449f.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(4)(C)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

4. Consumers aged 13 to 17: no targeted advertising and no sale of their personal data.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(7)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

5. Consent must be revocable as easily as given; processing must stop within 15 days of the revocation request.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415e(a)(6)](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

6. Consumer health data: no geofence within 1,850 feet of a health care facility to track or message consumers, no sale without consent, and confidentiality duties for staff and processors.

   Section: [Act 145, Sec. 1, 9 V.S.A. § 2415k](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

## Sources

- [Act 145 (S.71) as enacted, 2025-2026 session](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

[Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Vermont statute](https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf)

Reference material, not legal advice.

## Other topics for Vermont

- [Applicability](https://dposchool.com/state-privacy-laws/state/vermont/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/vermont/consumer-rights)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/vermont/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/vermont/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/vermont/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Vermont](https://dposchool.com/state-privacy-laws/state/vermont) / Sensitive data

Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/vermont/consumer-rights)

Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/vermont/controller-duties)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents