June 26, 2026
Signed into law: June 16, 2026
Law: Vermont Data Privacy and Online Surveillance Act – S.71 / Act 145
Effective date: January 1, 2028
Status: Enacted; not yet effective.
Vermont has enacted a comprehensive consumer privacy law. On June 16, 2026, Governor Phil Scott signed S.71 into law as Act 145, establishing the Vermont Data Privacy and Online Surveillance Act. It takes effect January 1, 2028.
The law creates consumer privacy rights and requirements involving data minimization, sensitive data, targeted advertising, data sales, opt-out preference signals, privacy notices, processor contracts, security, and assessments. It also contains consumer-health-data protections that can apply to businesses below the general coverage thresholds.
For businesses with multi-state privacy programs, Vermont warrants a specific gap review, not simply another paragraph in the privacy notice.
Which Businesses are Covered?
The law generally applies to a person conducting business in Vermont or producing products or services targeted to Vermont residents that, during the preceding calendar year:
-
Controlled or processed personal data of at least 35,000 consumers.
-
Controlled or processed sensitive data of at least 3,000 consumers.
-
Offered for sale in trade or commerce personal data of at least 3,000 consumers.
The first two thresholds exclude data controlled or processed solely to complete a payment transaction. The third threshold concerns offering data for sale, not only completed sales.
“Consumer” excludes individuals acting in commercial or employment contexts and certain role-based business interactions.
Consumer Health Data Has a Separate Coverage Rule.
Businesses should not assume that falling below the numerical thresholds places all processing outside the law.
The consumer-health-data provisions apply to persons conducting business in Vermont or targeting products or services to Vermont residents without requiring them to meet those thresholds, subject to applicable exemptions.
Consumer health data includes personal data used to identify a consumer’s physical or mental health condition, diagnosis, or status, including reproductive, sexual, and gender-affirming health data.
The law imposes confidentiality and processor-access requirements, requires consent before selling or offering to sell consumer health data, and prohibits specified geofencing uses within 1,850 feet of health-care facilities. The geofencing restriction concerns particular health-data-related identification, tracking, collection, and notification practices, not every use of location technology near a facility.
What Exemptions Apply?
The statute contains organization-, information-, and activity-level exemptions. Examples include specified government entities, HIPAA covered entities and business associates, certain financial and insurance entities, and information governed by particular federal laws.
Vermont does not provide a blanket exemption for nonprofit organizations or institutions of higher education. Specific exemptions may still apply to particular organizations, activities, or records.
Businesses should identify the precise exemption and its scope rather than assume that all regulated health or financial information, or every nonprofit, is outside the law.
What Rights Will Vermont Consumers Have?
Subject to statutory conditions and exceptions, consumers may:
-
Confirm processing and access their personal data, including certain inferences.
-
Correct inaccuracies.
-
Request deletion.
-
Obtain a portable copy of personal data processed by automated means.
-
Opt-out of targeted advertising, personal-data sales, and qualifying automated profiling.
-
Obtain a list of third-parties to which the controller sold their data, or a broader list if a consumer-specific list is not maintained.
For qualifying profiling decisions, consumers also have rights, where feasible, to question the result, obtain the reason for the decision, and review the data used. Housing-related decisions carry additional correction and reevaluation rights.
Controllers generally must respond within 45 days, with one additional 45-day extension when reasonably necessary and properly explained. Appeals must be decided within 60 days. Information generally must be provided free of charge once per consumer during a 12-month period.
The law does not require authentication of opt-out requests, although it permits denial of documented fraudulent requests with the required notice. Authorized-agent requests have separate verification rules.
Website Opt-Outs and Preference Signals.
Covered controllers must provide a clear and conspicuous website link through which consumers or authorized agents can exercise applicable opt-out rights. They must also allow qualifying opt-out preference signals for targeted advertising and personal-data sales.
Website operators should therefore review both manual request mechanisms and browser- or platform-based signal handling. A preference center alone may not address the full requirement.
Vermont defines a sale to include exchanges for monetary or other valuable consideration, subject to statutory exclusions. A business should not assume that data sharing falls outside the definition merely because no cash payment occurs.
Sensitive Data and Teen Protections.
Vermont’s sensitive-data definition includes health information, precise geolocation, genetic and biometric data, neural data, certain financial-access information, government-issued identification numbers, and specified personal characteristics.
Controllers generally may process sensitive data only with consent and when reasonably necessary for the collection purposes. Selling sensitive data also requires consent. Known-child processing must comply with COPPA and, where applicable, Vermont’s age-appropriate design requirements.
The law separately prohibits sales and targeted advertising involving consumers the controller actually knows, or willfully disregards, are ages 13–17. This is not simply a teen-consent requirement.
Consent must be affirmative and cannot be obtained through dark patterns. Controllers must provide an easy and effective withdrawal mechanism and stop consent-based processing as soon as practicable, no later than 15 days after the revocation request.
What Other Business Obligations Apply?
Covered controllers must address several core requirements:
-
Data minimization: Limit collection to what is reasonably necessary and proportionate for disclosed purposes.
-
Purpose limitation: Obtain consent for a material new purpose that is neither reasonably necessary to nor compatible with the original purposes.
-
Security: Maintain reasonable administrative, technical, and physical safeguards.
-
Privacy notices: Explain processing, rights and appeals, sales, targeted advertising, contact methods, and request procedures.
-
Processor contracts: Establish required processing instructions, confidentiality, deletion or return, compliance information, and subcontractor obligations.
Privacy notices must also disclose whether personal data is collected, used, or sold to train large language models and identify the month and year of the latest update. The law includes language, disability-accessibility, and website or application placement requirements.
Assessments and Automated Profiling.
Controllers must conduct and document data protection assessments for specified higher-risk processing, including targeted advertising, personal-data sales, sensitive-data processing, and certain risky profiling.
Profiling used for decisions producing legal or similarly significant effects also requires an impact assessment with specified content, including intended uses, foreseeable risks, data and outputs, performance limitations, transparency measures, and post-deployment safeguards.
The Attorney General may request relevant assessments during an investigation. Assessments provided to the Attorney General receive confidentiality and public-records protections.
Enforcement and the Temporary Cure Period.
The Vermont Attorney General has exclusive enforcement authority under the Vermont Consumer Protection Act. The law does not create a private right of action.
From January 1, 2028 through June 30, 2029, the Attorney General must provide notice before enforcement when the Attorney General determines that a cure is possible. The organization then has 60 days to correct the violation. This mandatory cure mechanism is temporary and conditional; it does not postpone the effective date.
Businesses with an existing multi-state privacy program should integrate Vermont into that program while documenting the requirements that need additional controls.
For operational guidance and structured compliance documentation tools, visit the CLIClaw Privacy Compliance Library.
© 2026 CLIClaw.com
This article is for information purposes only. This article provides general information and operational commentary. It is not legal advice. Applicability and compliance obligations depend on an organization’s activities, data practices, exemptions, and circumstances. It is not intended to be and should not be relied on as legal advice for any particular matter.