Vermont Enacts New Data Privacy Law for Consumers

For residents across Bennington County and Southern Vermont, major new protections for personal digital data are on the horizon. Governor Phil Scott signed Senate Bill 71, officially known as the Vermont Data Privacy and Online Surveillance Act, into law on June 16, 2026, making Vermont the 23rd state in the nation to enact a comprehensive state data privacy framework, according to legal analysis outlet JD Supra.

The legislation gives our local community members unprecedented control over how companies collect, use, and sell their digital footprint. The law is scheduled to take full effect on Jan. 1, 2028.

What the New Privacy Rules Mean for Local Residents

Under the new law, Vermont residents gain the right to access, correct, delete, and request portable copies of their personal data held by covered businesses. Consumers can also opt out of data processing for targeted advertising, data sales, or automated profiling decisions that carry legal or significant impacts.

Key consumer protections established under the law include:

• Expanded sensitive data safeguards: Stronger protections cover reproductive and gender-affirming health data, genetic and biometric records, precise geolocation, neural data, financial credentials, and personal demographic details.
• Healthcare geofencing ban: Companies are prohibited from setting up digital geofences within 1,850 feet of any healthcare facility to track, collect data from, or target individuals with health-related advertising.
• Artificial intelligence transparency: Businesses must explicitly disclose in privacy notices whether personal data is collected or sold to train large language models or AI systems.
• Universal opt-out recognition: Companies must honor automated universal opt-out signals sent through consumer browser settings or privacy extensions.

Which Businesses Must Follow the Rules

The law applies to entities doing business in Vermont or targeting products and services to state residents that met specific thresholds during the prior calendar year. Companies fall under the law if they meet any of the following criteria:

• Controlled or processed the personal data of at least 35,000 Vermont consumers.
• Controlled or processed sensitive data belonging to at least 3,000 Vermont consumers.
• Offered the personal data of at least 3,000 Vermont consumers for sale.

Data processed solely to complete payment transactions is excluded from threshold calculations, though health data protections apply broadly regardless of business size. Exemptions are included for entities covered by HIPAA, financial institutions subject to the Gramm-Leach-Bliley Act, FCRA data, FERPA records, and certain licensed broadcast media organizations.

Statewide Enforcement and Multi-State Collaboration

The act does not allow individual consumers to file private lawsuits. Instead, enforcement is handled exclusively by the Vermont Attorney General’s Office, with a 60-day period for companies to fix violations through June 30, 2029.

To prepare for enforcement ahead of the 2028 launch date, Vermont Attorney General Charity Clark announced on Aug. 4, 2026, that the state had joined the Consortium of Privacy Regulators, a nationwide multistate coalition of state privacy regulators and attorneys general.

“Vermonters should not have to give up their privacy to participate in modern life,” Attorney General Clark said in a statement. “Whether we’re shopping online, using social media, or simply carrying a smartphone, companies are collecting enormous amounts of our personal information. Vermont’s new privacy law gives each of us greater control over corporate use of our data, and joining this consortium will help my office work with other states to enforce those protections effectively and hold companies accountable when they violate the law.”

How the Law Came Together and What Is Next

The passage of Senate Bill 71 follows earlier legislative efforts in Montpelier. In 2024, Governor Scott vetoed House Bill 121 over concerns regarding a private right of action and strict data minimization standards, prompting lawmakers to draft S.71 to align more closely with frameworks in states like Connecticut while adding unique AI and neural privacy rules.

While enforcement does not begin until 2028, state regulators and businesses operating in Vermont will use the interim period to establish compliance procedures and update privacy practices across the state.

Sources

• https://news.google.com/rss/articles/CBMif0FVX3lxTE80dGNRaUkxaVRJSUtzYkFLZEF2NDRicXludmdvQm9HXzNTSE9qblRwdG5weU5ET184WmxSQlpHeXpQWWZnUmxpbTMySUFrdF9DZ2gzdDZnTzItZWVmWlF1Wl9xRTBqazRuSEhrMEtweEVJTmE5V1VtMzl5RU14cVk?oc=5
• https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFu2ficFw_ke5bUIrcoVL1zWmxcBsd-sgQwcMUuEyK8fIo0X7Afwqv0ByMOpA5RMsnWlk4T4C2_5BDY8qiLqqIjeX2kF_rBfUbRCT4–O0kMai5xGmiJJ2LZ2jQcYqNbkBT2eaeP4e6L47ENFezTXu8Qo7GUdqgKob_QbG1azJb2edvJtWAaBw=
• https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEqH_DqOC4w4nw8E-6Z_9gIsws2JbccIGVDbxcbXsy6VjRT38ObVfCedXyRdnaz_kdrNiM52cACUrJCbDc20r968LqKyUK41qcSRK3jcuAaX-CxdfIQCXcnqL38GvowsqmFRNaZDNfnu3JJ9ljecqe2jTK9lHQVxO7G15ARXMYnocoAX_BUkfWuHqk1CmGEH8HLjHvk5p7e4ZyJ6kS1S6dZFfpr5bAQxsggbVvDwZrNs0g=
• https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEGPMC20nzHhgkyaKhLpHpvnX8RKehG5GDMBhfjex6SsvmudHZjOFZ3tz79GniaYPyzlv_twmZdx13SwZDf0KIfjVKj4nWwvwYUxW4Fz5iyuUrSlReekkEgYkvGFs-BZLvWAQ6Vs9ekc_nDRfUQ2W8sZ5GU40Pvo4ZtINj84ro7IBtDeadQ7cLzx-sa
• https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQEzbhbDR4qDdUvGvE4o1UkrjFhojbhXmz2UsRaVYbHgBK7_sjAJjjpgOaHN-APSVBncCB7sV5y9uKahj0x8bpY7cA9HQtHrVaFAE612DAziKtYqyRqIE0NWWGiARCcQ4_09eUVWN6yChBlX8-BEfu25rM3mpT1HAlWitVqqfVG0pZMbrbqn8rtA2FeGJp5O7V-I5sx2qp4riV-jz8wq9F7uQvVwan8egtbxxcGw2L8=
• https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQFRJiLvloL38wR3qPq6wzFbZAgdWWIQN_6QATz8Vyv0a4x-HvHPyViQpLIZlUxFsboziQmSrLyKAbwfs5-CsuHqZ6S2MWMAxptNkf8tml4jNc8rzqWk0OL7Rj1KX5zpLuQILSfKYUkX70SkG1wFvD05gKQMYkdfPUj6f9h-P0BFCNmPhorpVjCItBsItRm-hQaMV2t6ncqVk2eD3gX5AeKjIxYC
• https://vertexaisearch.cloud.google.com/grounding-api-redirect/AUZIYQHjHq4D87vqSdE5d6akoOEGOfq-HRid_I0u08SsWPTVyQLYHyXJRi1x5Po2U7xw5veyR4uEXXe0KLrynzwAm1sjzIEvc0egPNTTlkWsG2LAYLESXeVVlgXMq5beMZ7XDToZfxSTZOUlx14eD3M8wqpev2zfDECzRVcYm1EPWw==
• Vermont’s Privacy Law Reaches Far Beyond Its Borders: What Companies Everywhere Need to Know – JD Supra
• Inside the VDPOSA: Vermont’s Unique Take on Data Privacy – JD Supra
• Compliance Guidance for the New Vermont Data Privacy and Online Surveillance Act (VDPOSA) – Vermont Becomes the 23rd US State to Enact a Consumer Privacy Law – JD Supra
• From Maple to Mind Taps: New Vermont Law Puts Neurotech on Notice – JD Supra
• JD Supra – Vermont Data Privacy and Online Surveillance Act

This article was produced with the assistance of AI and reviewed by our editorial team.