Law / United States / 
Vermont
Vermont Data Privacy and Online Surveillance Act, general applicability
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Determine whether you control or process the personal data of at least 35,000 Vermont consumers, the sensitive data of at least 3,000, or offer for sale the personal data of at least 3,000, before relying on any exemption.
- Where this Act conflicts with any other law, including the Vermont Age-Appropriate Design Code Act, follow whichever law affords consumers the greatest protection for the right of privacy.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which law "afford[s] the greatest protection for the right of privacy for consumers" when the Vermont Age-Appropriate Design Code Act conflicts with 9 V.S.A. ยง 2415b, and who decides the comparison?
What it makes you log
Logging duty
Section 2415a holds the short title and definitions and section 2415b sets the thresholds (35,000 consumers, 3,000 consumers of sensitive data, or sale of the data of 3,000 consumers) and a rule that the most protective conflicting law controls. A threshold counts consumers in the preceding calendar year and the sections do not require a record of that count; the assessment and record duties sit in sections the row does not cite (2415g requires a documented data protection assessment that the Attorney General may require to be disclosed). The reach is stated in 2415b(a): a person that conducts business in the State or produces products or services targeted to State residents.
- Kind
- None
- As of
What this law does
As enacted, it applies to a person conducting business in Vermont, or targeting products or services to Vermont residents, that in the preceding calendar year controlled or processed the personal data of at least 35,000 consumers, controlled or processed the sensitive data of at least 3,000 consumers, or offered for sale the personal data of at least 3,000 consumers, a materially broader sweep than New Hampshire's, Kentucky's, or Rhode Island's thresholds.
Sec. 2415b(c) sets a most-protective-law-controls rule against conflicting statutes, naming the Vermont Age-Appropriate Design Code Act. Act 145 (S.71) was signed , following a 2024 predecessor, H.121, that passed both chambers but was vetoed and failed a Senate override by one vote.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .