The law generally applies to persons conducting business in Vermont or producing products or services targeted to Vermont residents that, during the preceding calendar year:
-
Controlled or processed personal data of at least 35,000 consumers.
-
Controlled or processed sensitive data of at least 3,000 consumers.
-
Offered for sale in trade or commerce personal data of at least 3,000 consumers.
The first two thresholds exclude data processed solely to complete a payment transaction. The third concerns offering data for sale, not only completed sales. Statutory exemptions must also be considered.
The consumer-health-data provisions have broader applicability and do not require satisfaction of these numerical thresholds. A business should therefore review health-data coverage separately before concluding that it is outside the law.
For operational guidance and structured compliance documentation tools, visit the CLIClaw Privacy Compliance Library.
These FAQs provide general information and operational commentary. They are not legal advice. Applicability and compliance obligations depend on an organization’s activities, data practices, exemptions, and circumstances. It is intended as a starting point for understanding the issues discussed and should not be relied on as a substitute for advice from qualified legal counsel.
These materials were obtained directly from the Federal Government public website and are posted here for your review and reference only. No Claim to Original U.S. Government Works. This may not be the most recent version. The U.S. Government may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.