Vermont VDPOSA
Enacted Vermont · In force Jan 1, 2028 · next deadline Jan 1, 2028 (in 15 months)
Deadlines
| Date | What happens | When |
|---|---|---|
| Jan 1, 2028 | Vermont Data Privacy and Online Surveillance Act takes effectin 15 months | in 15 months |
| Jun 30, 2029 | Mandatory 60-day cure period expiresin 2.8 years | in 2.8 years |
Summaries for reference, not legal advice. Check the official text.
What it does
New comprehensive privacy law with low applicability thresholds, broad consumer health data provisions that apply to all businesses, an expanded sensitive data definition, profiling and automated-decision transparency, and a disclosure requirement for using personal data to train AI models. Consumers get the usual access, correction, deletion, portability and opt-out rights.
- Who it applies to
- Persons conducting business in Vermont or targeting Vermont residents that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers (excluding payment-only data), controlled or processed sensitive data of at least 3,000 consumers, or offered for sale personal data of at least 3,000 consumers. Consumer health data provisions apply regardless of thresholds.
- Penalties
- Violations are unfair and deceptive acts under the Vermont Consumer Protection Act (9 V.S.A. ch. 63): civil penalty up to $10,000 per unfair or deceptive act (9 V.S.A. 2458(b)(1)). Mandatory 60-day cure notice, where a cure is possible, from Jan 1, 2028 through June 30, 2029 (Act 145 sec. 3). No private right of action.
- Enforced by
- Vermont Attorney General (exclusive)
- Official name
- Vermont Data Privacy and Online Surveillance Act (S.71, Act 145 of 2026)
- Citation
- S.71, Act No. 145 (2026)
- Topics
- privacy, health, ai
Research notes
The act has no penalty amount of its own; the $10,000 figure comes from the Vermont Consumer Protection Act's general civil penalty for unfair or deceptive acts. The AG must report annually by Dec 1 on notices of violation. Sources disagree on whether Vermont is the 23rd or 24th state with a comprehensive privacy law.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI ActQuestions about Vermont VDPOSA
- What are the Vermont VDPOSA compliance deadlines?
- Jan 1, 2028: Vermont Data Privacy and Online Surveillance Act takes effect. Jun 30, 2029: Mandatory 60-day cure period expires.
- When does Vermont VDPOSA take effect?
- Vermont VDPOSA takes effect on Jan 1, 2028. The next milestone is Jan 1, 2028: Vermont Data Privacy and Online Surveillance Act takes effect.
- Who does Vermont VDPOSA apply to?
- Persons conducting business in Vermont or targeting Vermont residents that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers (excluding payment-only data), controlled or processed sensitive data of at least 3,000 consumers, or offered for sale personal data of at least 3,000 consumers. Consumer health data provisions apply regardless of thresholds.
- What are the penalties under Vermont VDPOSA?
- Violations are unfair and deceptive acts under the Vermont Consumer Protection Act (9 V.S.A. ch. 63): civil penalty up to $10,000 per unfair or deceptive act (9 V.S.A. 2458(b)(1)). Mandatory 60-day cure notice, where a cure is possible, from Jan 1, 2028 through June 30, 2029 (Act 145 sec. 3). No private right of action.