June 18, 2026
On June 16, 2026, Vermont Governor Phil Scott signed Senate Bill 71, the Vermont Data Privacy and Online Surveillance Act, into law. With the governor's signature, Vermont joins more than 20 other states with comprehensive consumer data privacy laws. The law will take effect on January 1, 2028.
While the law follows the structure of other comprehensive consumer data privacy laws, there are significant differences, including unique provisions, to which businesses must give attention. Specifically, the VDPOSA provides for a unique scope, definition of personal data, exemptions (including its Gramm-Leach-Bliley Act entity and public records exemptions), privacy notice requirements, and consent requirements, among others.
The VDPOSA applies to any entity that does business in Vermont or sells goods or services to Vermont consumers and either controls or processes personal data of at least 35,000 Vermont residents or sensitive data of at least 3,000 residents (not including data controlled or processed solely for payments) or offers for sale the personal data of at least 3,000 residents. Certain categories of entities and individuals are exempt, including government entities, certain regulated financial institutions, securities broker-dealers, and health care providers. The law also exempts data regulated by the GLBA, various categories of health care data, certain public record data (through a unique definition), certain activities regulated by the Fair Credit Reporting Act, and data controlled or processed in the context of an individual's employment with a controller, processor, or third party. Like other state laws, the law distinguishes between controllers, who decide how and why personal data is processed, and processors, who process the personal data on controllers' behalf.
The VDPOSA grants several rights to Vermont consumers regarding the processing of their personal data, which the law defines uniquely as compared to other states. Here, the term refers to information that is linked or reasonably linkable to not only one or more identified or identifiable individuals but also devices. The law provides for common consumer rights, including rights to know whether a controller or processor is accessing or processing any of the consumer's personal data, correct inaccuracies in the data, have the data deleted, get a copy of previously provided data in a usable format, and opt out of the processing of the data for the purposes of targeted advertising, the sale of the data, and profiling in furtherance of automated decisions concerning the consumer. A consumer also has the right to know certain information regarding automated decisions made using the consumer's personal data and to obtain a list of third parties to which the controller disclosed either the consumer's personal data or personal data in general. A controller must respond to a consumer's request to exercise any of these rights within 45 days of receipt of the request. The controller may refuse to comply with the request if it cannot authenticate the request or may take an additional 45 days for numerous or complex requests (but must notify the consumer within the initial 45 days that it needs additional time). A controller must allow a consumer to opt out through a conspicuous notice on its website or through an opt-out preference signal.
The VDPOSA requires controllers to obtain consumer consent to process sensitive data, engage in certain activities with regard to personal data on certain minors, or process personal data for purposes not previously disclosed. The latter is the law's data minimization requirement, a unique approach among the states.
The VDPOSA also requires controllers to institute safeguards to limit the risks resulting from the processing of consumers' personal data. A controller must limit its collection of personal data to what is reasonably necessary and proportionate to accomplish the purposes of the processing. It must also establish reasonable data security practices appropriate to the volume and nature of the data. The law requires further safeguards for sensitive data. Additionally, a controller must allow a consumer to revoke consent to data processing at least as easily as the consumer provided consent. A controller must provide a privacy notice with some unique content requirements. Particularly, the notice must explain what categories of personal data the controller processes, the purpose for data processing, how consumers may exercise their rights under the VDPOSA, the categories of personal data that the controller shares with third parties, the categories of third parties with which the controller shares the data, how the controller processes or sells the data for targeted advertising, the controller's contact information (e.g., an active email address), whether the controller collects, uses, or sells the data to train large language models, and the month and year of the most recent update to the privacy notice. The VDPOSA also regulates processors, such as by requiring a processor to establish data security measures and requiring certain provisions in any contract for data processing between a controller and a processor.
The attorney general has the authority to enforce the VDPOSA. Until July 1, 2029, the attorney general must give 60 days' notice of any violation, and if the controller corrects the violation within the 60-day period, the attorney general may not sue for that violation. A violation of the VDPOSA is treated as a violation of the Vermont Consumer Protection Act, which provides for penalties of up to $1 million, plus restitution to consumers and reimbursement of the state's costs in pursuing the violation. The law does not provide for a private right of action.