74%
of Vermont's 19 requirements are already met by California (CA). Here is what VDPOSA adds, biggest gaps first.
ThresholdsWho it coversBig gap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
VDPOSA adds2 Applies to businesses processing data of 35,000+ Vermont consumers, or sensitive data of 3,000+, or selling data of 3,000+. Consumer health data rules apply regardless of size.
9 V.S.A. § 2415b · source ↗
Sensitive dataSensitive data and minorsBig gap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
VDPOSA adds2 Sensitive data, broadly including consumer health and neural data, may be processed only with consent and when reasonably necessary; sale requires consent.
9 V.S.A. §§ 2415a, 2415e · source ↗
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
VDPOSA adds2 Controllers must offer an appeal, decide within 60 days, and give a way to contact the Attorney General.
9 V.S.A. § 2415d · source ↗
Children and teensSensitive data and minorsGap
CA2 Opt-in consent needed to sell or share data of consumers under 16: parental consent under 13, the teen's own consent for ages 13 to 15.
VDPOSA adds3 Sale and targeted ads using data of known 13- to 17-year-olds are prohibited; under-13 data follows COPPA and the Vermont Age-Appropriate Design Code.
9 V.S.A. § 2415e · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
VDPOSA adds3 Deidentified data needs safeguards, a public commitment and contract flow-down; pseudonymous data is exempt from most rights if kept separate.
9 V.S.A. § 2415h · source ↗
Already covered by CA: Exemptions, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means VDPOSA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
