VT S0071: An act relating to consumer data privacy and online surveillance

In one paragraph

Vermont's S.71 (Act 145) adds the Vermont Data Privacy and Online Surveillance Act. It covers businesses that in the prior year processed personal data of at least 35,000 Vermonters or sensitive data of at least 3,000, or offered for sale personal data of at least 3,000. Consumers may access, correct, delete and port their data and opt out of targeted ads, sales and profiling for automated decisions with legal or similarly significant effects. Controllers must minimize data, get consent for sensitive data, say whether they use data to train large language models, and assess risky processing and profiling. Attorney General enforcement only. Signed June 16, 2026; effective January 1, 2028.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

From January 1, 2028, businesses meeting the size thresholds must honor Vermont consumers' data rights and opt-outs (including profiling for significant decisions), get consent for sensitive data, state LLM-training use in privacy notices, and run data protection and profiling impact assessments.

Key provisions

1. 1New 9 V.S.A. chapter 61A: applies to persons doing business in Vermont or targeting its residents that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers or sensitive data of at least 3,000 consumers (excluding data handled solely to complete a payment transaction), or offered for sale personal data of at least 3,000 consumers; the consumer health data rules apply to all such persons regardless of size. Exempt: government entities, HIPAA covered entities that are not hybrid entities and business associates, data subject to Title V of Gramm-Leach-Bliley, banks and credit unions, and most insurers
2. 2§ 2415d: consumers may confirm processing and access their data (including inferences and whether it is used for profiling to make decisions with legal or similarly significant effects), correct it, delete it, get a portable copy, obtain a list of third parties it was sold to, and opt out of targeted advertising, sale, and profiling in furtherance of automated decisions with legal or similarly significant effects; controllers respond within 45 days (extendable by 45) and must honor authorized agents and opt-out preference signals
3. 3Decisions with legal or similarly significant effects are those resulting in the provision or denial of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunity or health care services. A consumer profiled for such an automated decision may, if feasible, question the result, be told the reason, review the data used and, for housing decisions, correct the data and have the decision reevaluated
4. 4§ 2415e: controllers must limit collection to what is reasonably necessary and proportionate, keep reasonable data security, get consent before processing or selling sensitive data (including biometric, genetic, neural, precise geolocation and consumer health data), not process data in violation of anti-discrimination laws, and not use targeted advertising on or sell the data of a consumer aged 13 to 17 when the controller "has actual knowledge, and willfully disregards," that age
5. 5Privacy notices must list the data processed and its purposes, data sold and the categories of buyers, and include a statement disclosing whether the controller collects, uses or sells personal data for the purpose of training large language models
6. 6§ 2415g: controllers must document a data protection assessment for targeted advertising, data sales, sensitive data and profiling with foreseeable risks of harm, and an impact assessment for any profiling used to make decisions with legal or similarly significant effects (purpose, risks and mitigations, input data and outputs, performance metrics and known limitations, transparency and post-deployment monitoring); the Attorney General may require them in an investigation; the duty covers processing activities created or generated after January 1, 2028
7. 7§ 2415k: no one may use a geofence within 1,850 feet of a health care facility to identify, track, collect data from or send notifications to consumers about their health data, or sell consumer health data without consent
8. 8Enforced only by the Attorney General under the Vermont Consumer Protection Act, with no private right of action; from January 1, 2028 to June 30, 2029 the Attorney General must first send a notice of violation and allow 60 days to cure when a cure is possible. Signed June 16, 2026 (Act 145); effective January 1, 2028

Latest legislative action

Jun 16, 2026. Signed by Governor (Act 145)

Sponsors (showing 5 of 12)

Roll call votes

Related and companion bills

• Vermont H0208An act relating to consumer data privacy and online surveillance
• Vermont S0093An act relating to consumer data privacy