Vermont (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Vermont Data Privacy and Online Surveillance Act | 2025, No. 145 (Adj. Sess.) (S.71), 9 V.S.A. chapter 61A, §§ 2415a to 2415k | Enacted, not yet in force | 1 January 2028 |
| Security Breach Notice Act | 9 V.S.A. § 2435 | In force | 1 January 2007 |
| Vermont Age-Appropriate Design Code Act | 2025, No. 63, 9 V.S.A. §§ 2449a to 2449j | Enacted, not yet in force | 1 January 2027 |
| Data broker law | 9 V.S.A. §§ 2430 to 2431 and 2446 to 2447 | In force | 1 January 2019 |
- Vermont Data Privacy and Online Surveillance Act: Signed on 16 June 2026. Takes effect on 1 January 2028.
- Security Breach Notice Act: 2025, No. 138 (Adj. Sess.) makes small changes from 1 January 2027, such as five call attempts before a voicemail notice and a compliance certification from HIPAA-covered collectors.
- Vermont Age-Appropriate Design Code Act: The Attorney General is still finalising its rules, including on age assurance.
- Data broker law: 2025, No. 138 (Adj. Sess.) tightens registration from 1 January 2027.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”From 2028, applies to businesses that operate in Vermont or target its residents and last year handled personal data of 35,000 consumers or sensitive data of 3,000 (excluding payment-only data), or offered 3,000 consumers’ data for sale. Its health data rules (no geofence within 1,850 feet of a health care facility, consent to sell health data, staff confidentiality, processor contracts) apply regardless of size. Government, HIPAA entities, GLBA data, banks, credit unions and insurers are exempt, but not nonprofits or colleges. Employee and business-contact data are out of scope.
Sources: legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145 As Ena…
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases, but strict minimisation. Collect only what’s reasonably necessary and proportionate to the disclosed purposes, and get consent for new incompatible purposes. Sensitive data needs consent and must be reasonably necessary; selling it also needs consent. Rights include access (with inferences), correction, deletion, portability, opt-outs and a list of buyers. Reply within 45 days (one 45-day extension); appeals within 60 days.
Sources: legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145 As Ena…
Consent age for online services
Section titled “Consent age for online services”A child is under 13, as in COPPA; a controller that knows, or wilfully disregards, that a consumer is a child processes their sensitive data under COPPA. For 13 to 17-year-olds, targeted ads and sales are banned outright, with no consent option. That rule says “actual knowledge, and willfully disregards” where the child rule says “or”, so treat actual knowledge of a teen’s age as enough. Covered businesses must also follow the design code for covered minors.
Sources: legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145 As Ena…
Children
Section titled “Children”From 1 January 2027, the Age-Appropriate Design Code applies to businesses earning most of their revenue online whose services minors (under 18) are likely to use. It protects covered minors, meaning users a business actually knows are minors or labels as minors under the Attorney General’s age-assurance rules. They’re owed a duty of care against foreseeable emotional distress, compulsive use and discrimination, highest-privacy defaults and minimal collection. Their data mostly can’t personalise feeds, and push notifications to them are banned from midnight to 6 a.m.
Sources: legislature.vermont.gov/statutes/section/09/062/02449a · legislature.vermont.gov/statutes/section/09/062/02449c · legislature.vermont.gov/statutes/section/09/062/02449f · ago.vermont.gov/vermont-age-appropriate-design-code-rulemaking
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. From 2028, controllers must put a clear opt-out link on their website and honour opt-out preference signals, such as a browser or device setting, for targeted advertising and sales. A signal can’t be on by default. It overrides conflicting site settings, though the controller may ask the person to confirm.
Sources: legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145 As Ena…
Electronic marketing
Section titled “Electronic marketing”Adds to CAN-SPAM and the TCPA. Telemarketers must register with the Secretary of State ($125) before calling Vermont numbers and follow the federal Do Not Call rules, which Vermont law repeats. Robocalls that break the TCPA also break state law, and people can sue for their damages or a civil penalty of $500 for a first violation and $1,000 for each later one, whichever is greater.
Sources: legislature.vermont.gov/statutes/section/09/063/02464a · legislature.vermont.gov/statutes/section/09/063/02464b · legislature.vermont.gov/statutes/section/09/063/02464e
Breach notification
Section titled “Breach notification”Tell affected consumers within 45 days of discovering a breach of personal information or login credentials. Within 14 business days of discovery (or when consumers are told, if sooner), send the Attorney General, or the Department of Financial Regulation for firms it regulates, a preliminary notice. Tell the nationwide credit reporting agencies if more than 1,000 consumers are notified. A HIPAA-covered collector whose breach involves only health data complies by following HIPAA’s breach rule; from 2027 it must also send that preliminary notice with a certification of HIPAA compliance.
Sources: legislature.vermont.gov/statutes/section/09/062/02435
Registration and fees
Section titled “Registration and fees”Data brokers must register with the Secretary of State. Until the end of 2026 that’s by 31 January each year, with a $100 fee. From 1 January 2027, they must register within 30 days of becoming a data broker and every 1 July, pay $900, keep a $20,000 bond and disclose more, such as sales to foreign actors or AI developers.
Sources: legislature.vermont.gov/statutes/section/09/062/02446
Data protection officer
Section titled “Data protection officer”No duty to appoint a data protection officer.
Sources: legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145 As Ena…
International transfers
Section titled “International transfers”Vermont law doesn’t restrict sending personal data outside the state or the US. Federal rules are in us-federal.
Sources: legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145 As Ena…
Impact assessments
Section titled “Impact assessments”Do and document a data protection assessment for targeted advertising, selling personal data, risky profiling and sensitive data. Profiling for significant decisions also needs an impact assessment covering purpose, risks, inputs and outputs, metrics and monitoring. Both apply to processing created after 1 January 2028 and go to the Attorney General on request.
Sources: legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145 As Ena…
Automated decisions and AI
Section titled “Automated decisions and AI”People can opt out of profiling for automated decisions with legal or similarly significant effects. Where feasible, they can question the result, learn the reason and review the data used; for housing decisions they can correct the data and get a re-evaluation. Privacy notices must say whether personal data is collected, used or sold to train large language models.
Sources: legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145 As Ena…
Penalties
Section titled “Penalties”Only the Attorney General enforces, under the Consumer Protection Act, with civil penalties up to $10,000 per violation. The act expressly gives no private right of action. From 1 January 2028 to 30 June 2029, the Attorney General must first allow 60 days to cure where a cure is possible.
Sources: legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145 As Ena… · legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145 Act Su… · legislature.vermont.gov/statutes/section/09/063/02458
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-vt.yaml.