On June 16, 2026, the Vermont Governor signed into law the Vermont Data Privacy and Online Surveillance Act, making Vermont the fourth state to enact a comprehensive data privacy law this year. The law will take effect on January 1, 2028.

This law most closely resembles the Connecticut Data Privacy Act, with definitions that are generally consistent with the Connecticut model. The below lists the key provisions in the law:

• Scope. The law applies to businesses that conduct business in Vermont or target products and services to state residents and that (1) control or process the personal data of at least 35,000 consumers, (2) control or process the sensitive data of at least 3,000 consumers, or (3) offer for sale the personal data of at least 3,000 consumers. However, the law’s consumer health data provisions apply more broadly.

• Exemptions. The law includes several entity-level and data-level exemptions. For example, it exempts HIPAA-covered entities, data subject to the GLBA, certain banks and their affiliates, and data subject to FERPA.

• Consumer Rights. The law gives Vermont consumers the right to access, correct, delete, and obtain copies of their personal data, as well as to opt out of the processing of their personal data for the purposes of targeted advertising, sale, or profiling in furtherance of any automated decision that produces any legal or similarly significant effect concerning the consumer. In connection with such profiling, consumers also have additional rights, including to be informed of the reason profiling resulted in the relevant decision and to question the results of such profiling. The law allows a consumer to designate an authorized agent using a technology, such as an internet link or an internet browser setting, that allows the consumer to indicate their intent to opt out of certain processing. Controllers that are subject to the law must respond to consumer rights requests without undue delay, but no later than 45 days, and must establish an appeal process for consumers if the controller denies a request.

• Data Minimization. Controllers must limit the collection of personal data to what is “reasonably necessary and proportionate” in relation to the purposes for which data are processed, as disclosed to the consumer. Controllers must obtain consent to process personal data for any “material new purpose” that is “neither reasonably necessary to, nor compatible with” the disclosed purposes for which the personal data is processed.

• Data Protection Assessments. Controllers are required to conduct data protection assessments for processing activities that present a heightened risk of harm, including processing for targeted advertising, the sale of personal data, and processing of sensitive data. The law also requires a separate impact assessment for any profiling used to make a decision that produces a legal or similarly significant effect concerning a consumer. The data protection and impact assessment requirements will apply to processing activities beginning after January 1, 2028 and are not retroactive.

• Sensitive Data. Controllers must obtain consent and limit processing of sensitive data to what is reasonably necessary in relation to the purposes for which sensitive data was collected. Controllers must also obtain consumer consent prior to selling sensitive data. Sensitive data includes, for example, consumer health data, genetic or biometric data, personal data collected from a known child, precise geolocation data, and neural data.

• Additional Controller Obligations. Controllers are required to establish reasonable data security practices and to provide a privacy policy on their website that is reasonably accessible, clear, and meaningful. Among other requirements, the privacy policy must include a statement disclosing whether the controller collects, uses, or sells personal data for the purpose of training large language models. Controllers are prohibited from selling or processing for targeted advertising purposes the data of individuals who are at least 13 and younger than 18 years old. Like the Connecticut and Maryland privacy laws, the law also imposes several obligations and restrictions on businesses that process consumer health data, including prohibiting businesses from selling consumer health data without prior consent from the consumer.

• Enforcement. The Vermont Attorney General has exclusive authority to enforce the law as a violation of the Vermont Consumer Protection Act. The law has a cure period that gives businesses 60 days to address any alleged violations until June 30, 2029.