Vermont Enacts Comprehensive Privacy Law Effective 2028
Vermont has enacted Senate Bill 71, a comprehensive privacy law set to take effect on January 1, 2028. This legislation will regulate how businesses collect, use, disclose, sell, and protect personal data of Vermont residents. The law applies to entities that meet specific thresholds, such as processing the personal data of at least 35,000 consumers or the sensitive data of at least 3,000 consumers. It includes provisions for consumer health data and offers heightened protections for children and minors. The law mandates that businesses provide clear privacy notices, allow consumers to opt out of data processing for targeted advertising, and maintain data protection assessments for high-risk activities. Enforcement will be managed by the Vermont Attorney General, who will provide guidance and annual reports on enforcement activities. 
