What's Happening?
Vermont Governor Phil Scott signed S.71 into law as Act 145 on June 16, 2026, establishing the Vermont Data Privacy and Online Surveillance Act. This new legislation, which will become effective on January 1, 2028, aims to regulate data brokers and the handling
of personal information within the state. The Act introduces various provisions, including consumer rights to confirm, access, correct, delete, and obtain their personal data in a portable format. It also grants consumers the right to opt out of targeted advertising, the sale of personal data, and profiling that leads to significant automated decisions. Businesses operating in Vermont or targeting its residents will be subject to the law if they control or process personal data of at least 35,000 consumers, sensitive data of at least 3,000 consumers, or offer for sale the personal data of at least 3,000 consumers. The law also has broader applicability for consumer health data provisions, regardless of these numerical thresholds. Controllers are required to limit data collection to what is reasonably necessary and proportionate, provide clear privacy notices, and conduct data protection assessments for high-risk processing activities.
Why It's Important?
The Vermont Data Privacy and Online Surveillance Act represents a significant step in strengthening consumer data protection within the United States, following a trend seen in other states. This law will impact a wide range of businesses, particularly those involved in online advertising, data brokerage, and any entity collecting personal or sensitive health data from Vermont residents. Companies will need to re-evaluate their data collection, processing, and sharing practices to ensure compliance, potentially leading to increased operational costs for data management and privacy infrastructure. The Act's emphasis on consumer consent for sensitive data processing and the prohibition of geofencing near healthcare facilities for specific purposes highlight a growing concern for privacy in sensitive areas. The requirement for controllers to recognize qualifying opt-out preference signals, such as Global Privacy Control (GPC), could set a precedent for broader adoption of such mechanisms, empowering consumers with more control over their digital footprint. The law's enforcement by the Vermont Attorney General, with potential civil penalties up to $10,000 per violation, underscores the serious implications for non-compliant entities.
What's Next?
Businesses affected by the Vermont Data Privacy and Online Surveillance Act have until January 1, 2028, to prepare for its implementation. During this period, companies will need to conduct thorough inventories of their data collection and processing activities, map data flows, and identify any practices that may constitute a 'sale' of personal data or targeted advertising under the new definitions. They will also need to implement mechanisms for obtaining consent for sensitive data processing, facilitating opt-outs for targeted advertising and data sales, and updating privacy notices to reflect the new requirements. Processor contracts and data protection assessments will also need to be reviewed and updated. The Vermont Attorney General is expected to issue and update compliance guidance, which businesses should closely monitor. A temporary 60-day cure period for violations will be in effect from January 1, 2028, through June 30, 2029, allowing businesses to rectify issues before legal action, though this is not a general grace period. After this temporary period, the Attorney General will enforce the Act through the Vermont Consumer Protection Act, with no private right of action for consumers.
Beyond the Headlines
The Vermont Data Privacy and Online Surveillance Act reflects a broader societal shift towards greater individual control over personal data in the digital age. This legislation, alongside similar state-level initiatives, indicates a growing fragmentation of data privacy regulations across the U.S., posing challenges for businesses operating nationwide. The Act's detailed definitions of 'sensitive data,' including nonbinary or transgender status and neural data, highlight an evolving understanding of what constitutes highly personal information requiring enhanced protection. The prohibition on geofencing near healthcare facilities for specific data collection purposes raises ethical considerations about digital surveillance and its potential impact on individuals seeking medical care, particularly in sensitive areas like reproductive health. The law's focus on 'dark patterns' in obtaining consent underscores a commitment to genuine, informed consent, pushing companies towards more transparent and user-friendly privacy interfaces. This legislative trend could ultimately lead to a more robust and consumer-centric approach to data privacy, potentially influencing future federal regulations or encouraging a more unified national standard.
