Vermont Privacy Law

The Vermont Data Privacy and Online Surveillance Act was enacted as Act 145 of 2026 (Senate Bill S.71). Governor Phil Scott signed it on June 16, 2026, and Section 4 of the act sets a single effective date of January 1, 2028. The act adds a new chapter 61A to Title 9 of the Vermont Statutes (9 V.S.A. §§ 2415a–2415k). The act is enforced exclusively by the Attorney General, although Section 2 records the General Assembly's intent to fund the Attorney General's enforcement work and says that, if those resources are not provided, it may consider adding a private right of action.

Vermont's applicability test is among the broadest in the country. The act applies to a person that conducts business in Vermont, or produces products or services targeted to Vermont residents, and that during the preceding calendar year controlled or processed the personal data of at least 35,000 consumers, controlled or processed the sensitive data of at least 3,000 consumers, or offered for sale the personal data of at least 3,000 consumers (9 V.S.A. § 2415b(a)); payment-only data is excluded from the first two counts. The consumer-health-data provisions in § 2415k — including a ban on geofencing within 1,850 feet of a health care facility and a consent requirement before selling consumer health data — apply to every person doing business in Vermont, with no threshold. Nonprofits are not exempt as a class; only specific nonprofits (insurance-fraud organizations, a postsecondary enrollment-data clearinghouse, and victim-services data) are carved out. Government entities, HIPAA covered entities that are not hybrid entities, business associates, banks and credit unions, regulated insurers, and GLBA Title V data are exempt.

Consumers may confirm and access their personal data (including inferences), correct it, delete it, obtain a portable copy, opt out of targeted advertising, the sale of personal data, and profiling in furtherance of automated decisions with legal or similarly significant effects, and obtain a list of the third parties to which the controller sold their data (§ 2415d). Where a profiling decision has been made and it is feasible, consumers may question it, learn the reason for it, and review the data used. Controllers must honor opt-out preference signals such as Global Privacy Control (§ 2415e(d)(2)(C)), may not process sensitive data without consent and only when reasonably necessary, may not sell sensitive data without consent, and — for consumers aged 13 to 17 — may not process personal data for targeted advertising or sell it at all (§ 2415e(a)(7)). Privacy notices must state whether the controller collects, uses, or sells personal data to train large language models.

Violations are violations of the Vermont Consumer Protection Act, enforced by the Attorney General (§ 2415j), which provides civil penalties of up to $10,000 per violation (9 V.S.A. § 2458(b)(1)). From January 1, 2028 through June 30, 2029, the Attorney General must issue a notice of violation before suing whenever a cure is possible, and the business has 60 days to cure (Act 145, Section 3); that requirement expires after June 30, 2029.

Vermont's thresholds are set low. Under 9 V.S.A. § 2415b(a), a business is covered if, in the preceding calendar year, it controlled or processed the personal data of at least 35,000 Vermont consumers; controlled or processed the sensitive data of at least 3,000 consumers; or offered for sale in trade or commerce the personal data of at least 3,000 consumers. Payment-only data is excluded from the first two counts. There is no revenue threshold, and there is no general exemption for nonprofits.

The 3,000-consumer prongs reach businesses that most other state laws ignore. A regional pharmacy, a fitness or health app, a dating service, or any business that processes precise location data — all sensitive data under § 2415a(b)(47) — can cross 3,000 Vermont consumers long before it approaches 35,000. So can any business that sells customer lists, given the act's definition of a sale as an exchange "for monetary or other valuable consideration."

• 35,000 consumers' personal data (payment-only data excluded) — § 2415b(a)(1)
• 3,000 consumers' sensitive data (payment-only data excluded) — § 2415b(a)(2)
• Offering for sale the personal data of 3,000 consumers — § 2415b(a)(3)
• Consumer health data rules in § 2415k: every business, no threshold — § 2415b(b)

Section 2415k applies to any person that conducts business in Vermont, with no consumer-count threshold. It prohibits giving employees or contractors access to consumer health data unless they are bound by a duty of confidentiality, prohibits giving processors access without a compliant processor contract, prohibits selling or offering to sell consumer health data without the consumer's consent, and prohibits using a geofence within 1,850 feet of any health care facility — including mental health and reproductive or sexual health facilities — to identify, track, collect data from, or send notifications to a consumer about their health data.