Law / United States /
Vermont
Vermont Data Privacy and Online Surveillance Act, general applicability
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force in 465 days, effective 1 January 2028.
A comprehensive regime rule binding private bodies.
As of 27 August 2026.
What it requires
- This law does not bind anyone yet; it takes effect January 1, 2028. Determine now whether you would meet its thresholds so compliance work can start ahead of that date.
- Once in force, determine whether you control or process the personal data of at least 35,000 Vermont consumers, the sensitive data of at least 3,000, or offer for sale the personal data of at least 3,000, before relying on any exemption.
- Expect the most-protective-law-controls rule to apply the Vermont Age-Appropriate Design Code Act instead, where the two conflict.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
This law does not currently bind anyone; it takes effect January 1, 2028.
As enacted, it will apply to a person conducting business in Vermont, or targeting products or services to Vermont residents, that in the preceding calendar year controlled or processed the personal data of at least 35,000 consumers, controlled or processed the sensitive data of at least 3,000 consumers, or offered for sale the personal data of at least 3,000 consumers, a materially broader sweep than New Hampshire's, Kentucky's, or Rhode Island's thresholds.
Sec. 2415b(c) sets a most-protective-law-controls rule against conflicting statutes, naming the Vermont Age-Appropriate Design Code Act. Act 145 (S.71) was signed June 16, 2026, following a 2024 predecessor, H.121, that passed both chambers but was vetoed and failed a Senate override by one vote.
When LexLint raises it
automated_outreachcrawls_webdeploys_chatbotprocesses_biometricsprocesses_voicetrains_models
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.