Does Vermont have a comprehensive privacy law? Yes. Governor Phil Scott signed S.71 (Act 145), the Vermont Data Privacy and Online Surveillance Act, on June 16, 2026; it takes effect January 1, 2028.
- Status: Enacted (Not Yet in Effect)
- Law: Vermont Data Privacy and Online Surveillance Act (S.71, 2026; Act 145; 9 V.S.A. §§ 2415a to 2415k)
- Signed: June 16, 2026 · Effective: January 1, 2028
- Applies to: Persons that conduct business in Vermont or target products or services to Vermont residents and, in the preceding calendar year, controlled or processed the personal data of at least 35,000 consumers or the sensitive data of at least 3,000 consumers (in both cases excluding data processed solely to complete a payment transaction), or offered for sale the personal data of at least 3,000 consumers; the consumer health data provisions apply without a threshold
- Cure period: Temporary: from January 1, 2028, through June 30, 2029, the Attorney General must give 60 days to cure when a cure is possible
- Enforcement: Attorney General, under the Vermont Consumer Protection Act (9 V.S.A. chapter 63); no private right of action
- Last verified: November 4, 2026 · Official source: Vermont Legislature, S.71 (Act 145)
Vermont has enacted a comprehensive consumer privacy law. On June 16, 2026, Governor Phil Scott signed S.71, now Act 145, creating the Vermont Data Privacy and Online Surveillance Act. The law takes effect on January 1, 2028.
Who Must Comply?
The law applies to businesses that conduct business in Vermont or target products or services to Vermont residents and meet one of several thresholds.
A business may be covered if it controls or processes the personal data of at least 35,000 Vermont consumers, controls or processes sensitive data of at least 3,000 Vermont consumers, or offers for sale the personal data of at least 3,000 Vermont consumers. The law also includes broader obligations for consumer health data, making Vermont one of the more notable state privacy developments of 2026.
Consumer Rights
The Vermont law creates familiar privacy rights, including rights to access, correct, delete, and obtain a copy of personal data. Consumers will also have the right to opt out of targeted advertising, the sale of personal data, and certain profiling decisions.
The law goes further than some state privacy laws by giving consumers additional rights related to profiling. These include the ability to question certain profiling results and obtain information about why a profiling decision was made.
Business Obligations
For covered businesses, the law creates practical compliance duties that go beyond updating a privacy notice. Controllers must limit personal data collection to what is reasonably necessary and proportionate. They must also maintain reasonable security practices, obtain consent before processing sensitive data, and provide a clear method to revoke consent.
The law also requires data protection assessments for processing activities that present a heightened risk of harm. These assessments apply to activities such as targeted advertising, sale of personal data, sensitive data processing, and certain profiling.
Vermont Data Broker Update
Vermont also amended its data broker law through H.211, now Act 138, which was approved on the same date. That means organizations should not look at Vermont’s 2026 privacy changes as a single consumer privacy update.
Businesses that buy, sell, license, or otherwise use brokered personal information should review the comprehensive privacy law together with Vermont’s updated data broker requirements.
Enforcement and Cure Period
The Vermont Attorney General has exclusive authority to enforce the new comprehensive privacy law. The law does not create a private right of action.
A temporary 60-day cure period applies from January 1, 2028 through June 30, 2029. After that period, the opportunity to cure becomes discretionary.
Centraleyes will keep you updated on the status of Vermont’s data privacy law, as well as other state privacy laws.