Privacy Map

Vermont. Comprehensive data protection. Act

Vermont privacy lawVermont Data Privacy and Online Surveillance Act (S.71, 2026)

Enacted – not yet in force

§1Summary

Synopsis

Comprehensive law with very low thresholds, data minimisation tied to disclosed purposes, and consumer health data provisions that apply to any business targeting Vermont residents.

Key themes
  • consumer rights (access, deletion, correction, portability)
  • opt-out of sale, targeted advertising and profiling
  • sensitive data consent
  • data protection assessments
  • processor contracts
  • data minimisation
  • consumer health data
Unique features

Thresholds as low as 3,000 residents for sensitive data or sales; health data provisions have no threshold; no private right of action in final version.

SaaS relevance

Even small SaaS businesses with a few thousand Vermont users or any sensitive data processing can be caught.

§2Obligations

Extraterritorial
Yes
Breach notification
See 9 V.S.A. § 2435 (separate statute)
DPO
No
Cross-border transfers
None

§3Dates

Key dates
  • Adopted
  • In force
  • Mandatory 60-day cure until 2029-06-30, discretionary afterwards.

§4Text and authority

Text
Authority
Vermont Attorney General

§5Where it applies

Domestic law of
Vermont

§6Sources and verification

Verification

High confidence.

Penalty amount not confirmed.