Regulations › US states › Vermont
VDPOSA
Vermont Data Privacy and Online Surveillance Act
WhenTakes effect 1 January 2028
Who enforces itState Attorney General (no private right of action)
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsApplies to businesses processing data of 35,000+ Vermont consumers, or sensitive data of 3,000…
Universal opt-outControllers must honor opt-out preference signals meeting statutory criteria for targeted ads…
Cure periodFrom January 1, 2028 to June 30, 2029, the AG must give notice of curable violations and allow…
Request deadlineControllers must respond within 45 days, extendable once by 45 days
Maximum penaltyCivil penalties up to $10,000 per violation under the Consumer Protection Act
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
2
Applies to businesses processing data of 35,000+ Vermont consumers, or sensitive data of 3,000+, or selling data of 3,000+. Consumer health data rules apply regardless of size.9 V.S.A. § 2415b · secondary source · source ↗
Enacted as S.71 (2026), Act 145, signed by Gov. Scott June 16, 2026. The as-enacted text was not retrievable; the 'as passed both chambers' PDF mixes an earlier version. Cells rely on law-firm summaries. Section numbers 9 V.S.A. §§ 2415a-2415k come from DRM and are unverified.
Exemptions
2
GLBA data is exempt at the data level, with entity-level exemptions for banks, credit unions and HIPAA-regulated health care providers. Sources disagree on whether nonprofits are exempt.9 V.S.A. § 2415c · secondary source · source ↗
Hunton reports entity-level exemptions for nonprofits and higher education; DRM says only insurance-fraud nonprofits are exempt and higher education is covered. Verify against Act 145.
Sensitive data and minors
Sensitive data
2
Sensitive data, broadly including consumer health and neural data, may be processed only with consent and when reasonably necessary; sale requires consent.9 V.S.A. §§ 2415a, 2415e · secondary source · source ↗
An earlier bill version had a strictly-necessary standard and a sale ban; the enacted version per DRM and Hunton uses consent.
Children and teens
3
Sale and targeted ads using data of known 13- to 17-year-olds are prohibited; under-13 data follows COPPA and the Vermont Age-Appropriate Design Code.9 V.S.A. § 2415e · secondary source · source ↗
Data minimization
2
Collection must be reasonably necessary and proportionate to disclosed purposes; materially new incompatible purposes need consent.9 V.S.A. § 2415e · secondary source · source ↗
Consumers' rights
Rights
3
Access (with portability and inferences), correct, delete, opt out of targeted ads, sale and profiling, list of third parties sold to, and profiling explanation and reevaluation.9 V.S.A. § 2415d · secondary source · source ↗
Request deadline
2
Controllers must respond within 45 days, extendable once by 45 days.9 V.S.A. § 2415d · secondary source · source ↗
Appeals
2
Controllers must offer an appeal, decide within 60 days, and give a way to contact the Attorney General.9 V.S.A. § 2415d · secondary source · source ↗
Universal opt-out
2
Controllers must honor opt-out preference signals meeting statutory criteria for targeted ads and sale, without authenticating them.9 V.S.A. § 2415e · secondary source · source ↗
Confirmed by DRM and Hinshaw; no named technical standard.
Business duties
Assessments
3
Data protection assessments for high-risk processing plus separate impact assessments for significant profiling, available to the AG on request.9 V.S.A. § 2415g · secondary source · source ↗
Applies to processing beginning after January 1, 2028.
Processor contracts
3
Contract with instructions, data types, duration, confidentiality, return or deletion, audit cooperation, and subcontracting only after the controller can object.9 V.S.A. § 2415f · secondary source · source ↗
Privacy notice
3
Notice must disclose categories, purposes, sales, targeted ads and whether data trains large language models; material changes require notice and a chance to withdraw consent.9 V.S.A. § 2415e · secondary source · source ↗
Loyalty programs
1
Different prices or service levels allowed for voluntary bona fide loyalty, rewards or club programs.9 V.S.A. § 2415e · secondary source · source ↗
De-identified data
3
Deidentified data needs safeguards, a public commitment and contract flow-down; pseudonymous data is exempt from most rights if kept separate.9 V.S.A. § 2415h · secondary source · source ↗
Enforcement
Who enforces
1
Attorney General has exclusive enforcement authority; violations are Vermont Consumer Protection Act violations.9 V.S.A. § 2415j · secondary source · source ↗
Cure period
2
From January 1, 2028 to June 30, 2029, the AG must give notice of curable violations and allow 60 days to cure; it then expires.9 V.S.A. § 2415j · secondary source · source ↗
Maximum penalty
2
Civil penalties up to $10,000 per violation under the Consumer Protection Act.9 V.S.A. § 2415j; 9 V.S.A. § 2458 · secondary source · source ↗
Penalty figure from Hinshaw and Didomi; § 2458 cite not verified.
Private action
0
No private right of action; it was removed from the final bill.9 V.S.A. § 2415j · secondary source · source ↗
Rulemaking
–
Not addressedNot confirmed · secondary source · source ↗
Sources reviewed are silent. An earlier bill version gave the AG Consumer Protection Act rulemaking power; check Act 145.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws