Law / United States / 
Vermont
Vermont Data Privacy and Online Surveillance Act, Attorney General enforcement
9 V.S.A. sec. 2415j; 2026 Vt. Acts & Resolves Act 145, Secs. 2-3
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Cure a violation within 60 days after receiving the Attorney General's notice of violation; from through the Attorney General must give that notice before bringing an action where a cure is possible.
- Do not treat any report of a Vermont consumer private right of action as accurate. The Act's own text expressly declines to create one.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Act directs the Attorney General to provide, and update as necessary, guidance to controllers and processors.
- As of
- Open questions
- What makes a cure "possible" under Sec. 3 of Act 145, so that the Attorney General must issue a notice of violation before suing between and ?
What it makes you log
Logging duty
Section 2415j makes a violation a violation of the Vermont Consumer Protection Act, gives the Attorney General the enforcement authority of chapter 63, bars a private right of action, and requires the Attorney General to report annually to the General Assembly on notices of violation and enforcement actions. Secs. 2 and 3 of the act state the enforcement intent and a cure period from to . The annual report is the Attorney General's own and no controller record is required. The data protection assessment that the Attorney General may require to be disclosed is in section 2415g, which the row does not cite. The cited provisions carry no territorial clause, so no hook is coded.
- Kind
- None
- As of
What this law does
As enacted, a violation is a violation of the Vermont Consumer Protection Act, enforced solely by the Attorney General, with a mandatory 60-day cure notice from through under the Act's uncodified Sec. 3.
Sec. 2415j and the Act's uncodified Sec. 2 both state the Act creates no private right of action, and Sec. 2's intent language frames this as a deliberate legislative choice made contingent on the Attorney General receiving adequate enforcement resources, not an oversight. Secondary summaries describing the enacted law as including a limited private right of action for consumers are wrong: the Act's own text, quoted here, controls, and that claim is not carried.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .