Vermont has enacted a comprehensive consumer privacy law. On June 16, 2026, Governor Phil Scott signed S.71, now Act 145, creating the Vermont Data Privacy and Online Surveillance Act. The law takes effect on January 1, 2028.
Who Must Comply?
The law applies to businesses that conduct business in Vermont or target products or services to Vermont residents and meet one of several thresholds.
A business may be covered if it controls or processes the personal data of at least 35,000 Vermont consumers, controls or processes sensitive data of at least 3,000 Vermont consumers, or offers for sale the personal data of at least 3,000 Vermont consumers. The law also includes broader obligations for consumer health data, making Vermont one of the more notable state privacy developments of 2026.
Consumer Rights
The Vermont law creates familiar privacy rights, including rights to access, correct, delete, and obtain a copy of personal data. Consumers will also have the right to opt out of targeted advertising, the sale of personal data, and certain profiling decisions.
The law goes further than some state privacy laws by giving consumers additional rights related to profiling. These include the ability to question certain profiling results and obtain information about why a profiling decision was made.
Business Obligations
For covered businesses, the law creates practical compliance duties that go beyond updating a privacy notice. Controllers must limit personal data collection to what is reasonably necessary and proportionate. They must also maintain reasonable security practices, obtain consent before processing sensitive data, and provide a clear method to revoke consent.
The law also requires data protection assessments for processing activities that present a heightened risk of harm. These assessments apply to activities such as targeted advertising, sale of personal data, sensitive data processing, and certain profiling.
Vermont Data Broker Update
Vermont also amended its data broker law through H.211, now Act 138, which was approved on the same date. That means organizations should not look at Vermont’s 2026 privacy changes as a single consumer privacy update.
Businesses that buy, sell, license, or otherwise use brokered personal information should review the comprehensive privacy law together with Vermont’s updated data broker requirements.
Enforcement and Cure Period
The Vermont Attorney General has exclusive authority to enforce the new comprehensive privacy law. The law does not create a private right of action.
A temporary 60-day cure period applies from January 1, 2028 through June 30, 2029. After that period, the opportunity to cure becomes discretionary.
Centraleyes will keep you updated on the status of Vermont’s data privacy law, as well as other state privacy laws.
