Vermont Privacy & Security Compliance Guide
Signed into law — not yet in effect
Vermont Data Privacy and Online Surveillance Act (S.71, Act 145 of 2026)
Takes effect January 1, 2028
The law takes effect January 1, 2028. From then until June 30, 2029, the Attorney General must offer a 60-day cure when it judges a cure is possible; after that, no cure period applies.
Low thresholds and opt-out signals: plan ahead
Vermont's law starts January 1, 2028 but reaches far: a business is covered if it sells data of just 3,000 Vermonters or processes their sensitive data, and the consumer-health-data rules apply to businesses of any size.
- Make your site honor Global Privacy Control and other opt-out signals.
- Stop targeted ads and data sales for users you know are 13 to 17.
- Add an LLM-training statement and a last-updated month and year to your privacy notice.
- Get opt-in consent before collecting health, biometric or other sensitive data.
Our free scan includes an informational GPC check. Key dates: deadline tracker.
Vermont at a Glance
645,000
Population
60 days (AG discretion) until Jun 30, 2029
Cure Period
Up to $10,000 per violation
Max civil penalty
Who Must Comply in Vermont?
Vermont Data Privacy and Online Surveillance Act (S.71, Act 145 of 2026) (from January 1, 2028):
Businesses that conduct business in Vermont or target its residents and, in the prior calendar year, processed personal data of 35,000+ Vermont consumers, sensitive data of 3,000+ consumers, or offered for sale the personal data of 3,000+ consumers; the consumer-health-data rules apply regardless of size, and there is no small-business or blanket nonprofit exemption.
- Applies to businesses that collect personal data of Vermont residents and meet the law's applicability thresholds — wherever the business is located
- Enforced by the Vermont Attorney General
- Website essentials: an accurate privacy notice, working opt-out links, and consent before sensitive-data processing
Vermont-Specific Requirements
Businesses must honor opt-out preference signals (for example, Global Privacy Control) for targeted advertising and sale. Sensitive data, including consumer health data, neural data and biometric data, needs opt-in consent, and targeted ads to, or sale of data of, known 13- to 17-year-olds are banned outright. Privacy notices must say whether data is used to train large language models and show the month and year last updated. Geofencing within 1,850 feet of health care facilities to track consumer health data is banned, and consumers can ask for a list of third parties their data was sold to.
Recent Vermont Privacy & Security Cases
S.71 signed June 16, 2026 as Act 145 — the 23rd state comprehensive consumer privacy law
Vermont assisted the 36-AG, $220M General Motors settlement (Oct 2026) over selling drivers' location and driving data
Major Vermont Business Centers
Key cities where privacy compliance is critical for business success:
- Burlington
- South Burlington
- Rutland
- Essex Junction
- Montpelier
Test Your Vermont Website's Privacy & Security Compliance
Don't wait for regulators or hackers. Check your compliance status now.
Free Privacy Scan →Last reviewed November 6, 2026. See all upcoming privacy deadlines or compare every state. This page is general information, not legal advice.