Privacy Law Library

Vermont Data Privacy and Online Surveillance Act

VDPOSA

Comprehensive privacy · Health · Biometric · Genetic · Location · Children · Artificial intelligence

Vermont's comprehensive privacy law, signed June 16, 2026, gives Vermont consumers rights to access, correct, delete and port their personal data, opt out of targeted advertising, sales and certain profiling, and get a list of the third parties their data was sold to. Controllers must minimise collection, get consent before processing or selling sensitive data, honor opt-out preference signals and run data protection and profiling impact assessments. It adds consumer health data protections, including a ban on geofencing within 1,850 feet of health care facilities, that apply to businesses of any size. Sensitive data is defined broadly and includes consumer health, genetic, biometric, neural and precise geolocation data and government ID numbers (§ 2415a(b)(47)).

Where
Vermont
Citation
9 V.S.A. ch. 61A, subch. 1 (9 V.S.A. §§ 2415a-2415k), added by 2026 Acts and Resolves No. 145 (S.71)
Status
Enacted, not yet in force
In force since
2028-01-01
Enforced by
Vermont Attorney General (exclusive), under the Vermont Consumer Protection Act, 9 V.S.A. ch. 63
People can sue
No
Penalties
A violation is a violation of the Vermont Consumer Protection Act; the Attorney General may seek civil penalties of up to $10,000 per violation (9 V.S.A. § 2458(b)(1)), injunctions and restitution. From Jan. 1, 2028 through June 30, 2029, the AG must give a notice of violation and a 60-day cure period before suing when cure is possible (Act 145, Sec. 3). The act expressly bars a private right of action (§ 2415j(a)).
Applies to
  • Persons conducting business in Vermont or producing products or services targeted to Vermont residents that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers (excluding data processed solely to complete a payment transaction)
  • Persons that controlled or processed sensitive data of at least 3,000 consumers, or offered for sale the personal data of at least 3,000 consumers
  • Consumer health data provisions (including § 2415k) apply to any person conducting business in Vermont or targeting Vermont residents, regardless of the volume thresholds
  • Processors acting on behalf of controllers
  • Exempts government entities, HIPAA covered entities that are not hybrid entities, health care components of hybrid entities and business associates, GLBA Title V data, and most insurers, among other listed exemptions (§ 2415c)

What a privacy notice must say

  • Provide a reasonably accessible privacy notice describing categories of data processed, purposes, rights and how to exercise them, data shared with third parties, and any sale or targeted advertising.9 V.S.A. § 2415e(c) · From 2028-01-01

Rights it gives people

  • Consumers may confirm processing and access, correct, delete and obtain a portable copy of their personal data, and opt out of targeted advertising, sale, and profiling in furtherance of any automated decision with legal or similarly significant effects.9 V.S.A. § 2415d(a)(1)-(5) · From 2028-01-01
  • Consumers may question the result of profiling used for significant decisions and may obtain a list of the specific third parties to which the controller sold their personal data.9 V.S.A. § 2415d(a)(6)-(7) · From 2028-01-01

Practices it requires

  • Controllers must respond to rights requests within 45 days (extendable once by 45 days with notice) and provide an appeal process decided within 60 days.9 V.S.A. § 2415d(c)(1), (d) · From 2028-01-01
  • Limit collection to what is reasonably necessary and proportionate to the disclosed purposes, and get consent for materially new, incompatible purposes.9 V.S.A. § 2415e(a)(1)-(2) · From 2028-01-01
  • Do not process sensitive data without consent and only when reasonably necessary; do not sell sensitive data without consent.9 V.S.A. § 2415e(a)(4) · From 2028-01-01
  • No targeted advertising to, or sale of personal data of, consumers the controller knows are 13 to 17 years old; children's sensitive data must be processed per COPPA and, where applicable, the Age-Appropriate Design Code.9 V.S.A. § 2415e(a)(4)(C), (a)(7), (a)(9) · Only if: Controller has actual knowledge or willfully disregards the consumer's age · From 2028-01-01
  • Any person may not geofence within 1,850 feet of a health care facility to track or message consumers about consumer health data, and may not sell consumer health data without consent.9 V.S.A. § 2415k(3)-(4) · From 2028-01-01
  • Provide a clear and conspicuous opt-out link and honor opt-out preference signals for targeted advertising and sales; do not require account creation to exercise rights.9 V.S.A. § 2415e(d)(1)-(2) · From 2028-01-01
  • Controller-processor contracts must set processing instructions, confidentiality, deletion or return of data, and audit cooperation.9 V.S.A. § 2415f(b) · From 2028-01-01

Security duties

  • Maintain reasonable administrative, technical and physical data security practices appropriate to the volume and nature of the data.9 V.S.A. § 2415e(a)(3) · From 2028-01-01

Other duties

  • Conduct and document data protection assessments for targeted advertising, sale, risky profiling and sensitive data processing, plus impact assessments for profiling; produce them to the Attorney General on request.9 V.S.A. § 2415g(a), (c), (d) · From 2028-01-01

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: The Vermont Statutes Online currently reflects only the 2025 session, so the codified chapter 61A text is not yet posted; section cites are taken from the act as enacted.

Research reference, not legal advice.