Vermont Enacts Data Privacy and Online Surveillance Act

On June 16, 2026, Vermont enacted Act 145, the Vermont Data Privacy and Online Surveillance Act (S.71), establishing a comprehensive consumer data privacy framework. The law introduces broad consumer rights, data minimization requirements, consent obligations for sensitive data, and specific protections for consumer health data and teens.

The law applies to businesses that operate in Vermont or target Vermont residents and meet defined data-processing thresholds. Consumer health-data provisions apply more broadly and are not subject to the same threshold.

This update applies to covered businesses with Vermont consumer-facing operations. Data collected in a commercial or employment context is excluded. The law takes effect on January 1, 2028.

What Employers Need to Do

• Determine whether the business meets applicability thresholds.

• Identify consumer-facing data practices that may fall within scope, including data collection through websites, apps, marketing activities, and any handling of consumer health data, which is subject to broader applicability than the general thresholds.

• Update privacy notices to meet Vermont’s specific disclosure requirements, including categories of data collected, processing purposes, third-party disclosures, opt-out methods, and any use of personal data for automated decision-making or model training.

• Implement processes for consumer rights requests (access, correction, deletion, portability, and opt-out) within the required timelines, including managing permitted extensions.

• Conduct data protection assessments for high-risk processing activities, including targeted advertising, sale of personal data, certain profiling, and processing of sensitive data, and conduct separate impact assessments for profiling used in decisions with legal or similarly significant effects.

Overview

Who is Covered

• The law applies to a person that does business in Vermont or targets products or services to Vermont residents and, during the prior calendar year, met one of these thresholds: controlled or processed personal data of 35,000 or more consumers; controlled or processed sensitive data of 3,000 or more consumers; or offered for sale the personal data of 3,000 or more consumers.
• The consumer health data provisions apply more broadly to any person doing business in Vermont or targeting Vermont residents.
• A “consumer” is a Vermont resident but does not include a person acting in a commercial or employment context.

Consumer Rights

• Consumers have the right to access, correct, delete, and obtain a portable copy of their personal data. They may also opt out of targeted advertising, data sales, and certain profiling tied to decisions. Consumers can request a list of third parties that received their data and, for qualifying profiling decisions, may challenge results, review underlying data, and request reevaluation (including for housing-related decisions).
• Controllers must respond within 45 days, with a 45-day extension when reasonably necessary, and provide an appeals process for denied requests.

Core Controller Duties

• Limit collection of personal data to what is reasonably necessary and proportionate. Obtain consent before using data for a new purpose, or processing or selling sensitive data.
• Maintain reasonable security practices, honor consent revocations within 15 days, and avoid discriminating against consumers for exercising their rights.

Teen Data Protections: If a controller has actual knowledge, or willfully disregards, that a consumer is between the ages of 13 and 17, the controller may not process that individual’s data for targeted advertising or sell it.

Privacy Notices, Opt-Outs, and Assessments

• Privacy notices must clearly describe categories of data processed, purposes, consumer rights, appeals processes, sales practices, and opt-out methods. Notices must also disclose whether personal data is used for automated decision-making or model training and include the most recent update date.
• Controllers must conduct and document a data protection assessment for high-risk activities, including targeted advertising, sale of personal data, certain profiling, and processing of sensitive data, and a separate impact assessment for profiling tied to decisions with legal or similarly significant effects.

Consumer Health Data Rules: Access to consumer health data must be limited to authorized personnel subject to confidentiality obligations. The law prohibits geofencing within 1,850 feet of a healthcare facility and restricts the sale of consumer health data without consent.

Enforcement: Violations of the Vermont Consumer Protection Act are enforced by the Attorney General, with no private right of action. From January 1, 2028, through June 30, 2029, businesses must be given notice and a 60-day cure opportunity to cure violations where possible. This cure period ends on June 30, 2029.

Why This Matters

Vermont’s law is one of the most comprehensive state consumer privacy frameworks to date, with broad consumer rights, strong data minimization duties, and stand-alone protections for consumer health data and teen data. The 35,000-consumer threshold is relatively low, and the consumer health data provisions, including the 1,850-foot geofence restriction near health care facilities, apply more broadly than the general thresholds.

Key Risks for Employers

• Assuming the Law Does Not Apply Because of Employment-data Exclusions: Personal data collected from individuals acting in commercial or employment contexts is not covered, but consumer-facing data such as customer accounts, website tracking, marketing databases, and health-related information, may still bring the business into scope.

• Falling Within Consumer Health Data Scope Unexpectedly: The consumer health data provisions extend beyond standard applicability thresholds and may impact marketing, mobile apps, and location-based services, especially due to the 1,850-foot geofencing restriction near healthcare facilities.

• Failing to Obtain Consent Before Processing or Selling Sensitive Data: Consent is required for both processing and selling sensitive data, and Vermont’s definition of sensitive data is broad.

• Targeted Advertising and Sale of Teen Data: Controllers with actual knowledge, or willful disregard, that a consumer is at least 13 but younger than 18 may not process that data for targeted advertising or sell it.

• Overlooking Data Protection and Impact Assessment Requirements: Heightened-risk activities, including profiling that affects employment, housing, insurance, lending, or other significant areas, require documented assessments before processing begins.

Source References

• Vermont SB 71 – An act relating to consumer data privacy and online surveillance

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.