Vermont Data Privacy and Online Surveillance Act

Vermont's comprehensive privacy law, signed June 16, 2026, gives Vermont consumers rights to access, correct, delete and port their personal data, opt out of targeted advertising, sales and certain profiling, and get a list of the third parties their data was sold to. Controllers must minimise collection, get consent before processing or selling sensitive data, honor opt-out preference signals and run data protection and profiling impact assessments. It adds consumer health data protections, including a ban on geofencing within 1,850 feet of health care facilities, that apply to businesses of any size. Sensitive data is defined broadly and includes consumer health, genetic, biometric, neural and precise geolocation data and government ID numbers (§ 2415a(b)(47)).