Business Compliance Guidance for the New Vermont Data Privacy and Online Surveillance Act (VDPOSA)

• • The VDPOSA adopts one of the lowest applicability thresholds in the country, closely tracking the 2025 version of the Connecticut Data Privacy Act. 

• • The law will be enforced exclusively by the Vermont Attorney General, with civil penalties of up to $10,000 per violation.

The VDPOSA applies to any person or entity that conducts business in Vermont, or that produces products or services targeted to Vermont residents, and that during the preceding calendar year (excluding data processed solely to complete a payment transaction) either:

• • controlled or processed the personal data of at least 35,000 consumers; 

• • controlled or processed the sensitive personal data of at least 3,000 consumers; or 

• • offered for sale the personal data of at least 3,000 consumers.

Enforcement discretion is tempered by a 60-day cure period running from January 1, 2028, through June 30, 2029, after which the right to cure sunsets. Businesses should treat the cure window as a planning phase, not a safety net.

Vermont provides consumers with the now familiar suite of data subject rights, but with several important expansions that will require operational tuning.

Controllers must honor the following rights, generally responding within 45 days of receipt (with a 60-day appeal decision window):

• • Access and confirmation, including whether the controller is using profiling to make legally or similarly significant decisions.

• • Correction, deletion, and portability of personal data.

• • Opt-out of targeted advertising, the sale of personal data, and profiling in furtherance of solely automated decisions producing legal or similarly significant effects.

• • Third-party disclosure list. 

• • • Consumers have the right to obtain a list of specific third parties to which their personal data has been disclosed. Or, if the controller does not maintain that data on a per-consumer basis, a disclosure list of all third parties to which personal data has been disclosed must be provided.

• • Human review and appeal of profiling. 

• • • Consumers whose data was profiled in furtherance of a decision producing a legal or similarly significant effect may question the outcome, be informed of the reasoning, and review the data used. For housing decisions, consumers also have the right to correct inaccurate data and have the decision reevaluated.

• • Restricted access response categories. 

• • • Unlike most state laws, the VDPOSA prohibits controllers from disclosing (and instead requires controllers only to confirm the existence of) certain data categories in response to access requests, including Social Security numbers, government-issued ID numbers, financial account numbers, health insurance and medical identification numbers, passwords and security questions, and biometric data.

Consumers may also designate an authorized agent to exercise opt-out rights (including for profiling) and may transmit an opt-out preference signal to opt out of the sale of personal data or targeted advertising.

Vermont’s definition of “sensitive data” is one of the broadest in the country, and consumer health data protections apply without a threshold—meaning even businesses outside the general scope of the law may be subject to them.

• • The expansive “sensitive data” definition includes data revealing: 

• • • racial or ethnic origin, religious beliefs, sex life, sexual orientation, nonbinary or transgender status, citizenship or immigration status, or a mental or physical health condition, diagnosis, disability, or treatment;

• • • consumer health data (separately defined to capture gender affirming health data and reproductive or sexual health data);

• • • genetic and biometric data;

• • • data collected from an individual known to be a child; precise geolocation data; neural data;

• • • financial account credentials; and

• • • government issued identification numbers.

• • • Processing sensitive data generally requires consumer consent, and the sale of sensitive data likewise requires consent.

• • No threshold for consumer health data. 

• • • The consumer health data restrictions apply to any person conducting business in Vermont or targeting Vermont residents, regardless of the general applicability thresholds. Covered persons:

• • • • may not give employees or contractors access to consumer health data unless those individuals are bound by a contractual or statutory duty of confidentiality;

• • • • may not provide processor access absent a compliant processor contract;

• • • • may not use a geofence to establish a virtual boundary within 1,850 feet of any healthcare facility—including any mental health facility or reproductive or sexual health facility—for purposes of identifying, tracking, collecting data from, or sending notifications to a consumer regarding the consumer’s health data; and

• • • • may not sell or offer to sell consumer health data without first obtaining the consumer’s consent.

Vermont goes further than most states by requiring a separate impact assessment for any profiling used to make legally or similarly significant decisions, layered on top of the more familiar data protection assessment requirement.

Controllers must conduct and document data protection assessments for processing activities presenting a heightened risk of harm, including:

1. 1. processing for targeted advertising;
   2. the sale of personal data;
   3. profiling that presents a reasonably foreseeable risk of unfair treatment, financial or reputational injury, intrusion on privacy, or other substantial injury; and
   4. the processing of sensitive data.

A separate profiling impact assessment is required for any profiling used to make decisions producing legal or similarly significant effects, with prescribed components including purpose disclosure and the categories of a minor’s personal data possessed by the online product, service, or feature.

Assessments are confidential but may be requested by the Attorney General.

Vermont is only the second state—after Connecticut—to require businesses to disclose AI training practices in their privacy notices.

The privacy notice a controller provides to consumers must state whether the controller collects, uses, or sells personal data for the purpose of training large language models.

The provision should be read alongside Connecticut’s amended privacy law, which took effect July 1, 2026, and reflects a growing state legislative focus on AI transparency.

The VDPOSA supplements Vermont’s Age Appropriate Design Code Act (S.69/Act 63, signed the same day) by imposing specific restrictions on the processing of teenagers’ data.

• • Where a controller has actual knowledge, and willfully disregards, that a consumer is at least 13 but younger than 18 years of age, the controller may not process that consumer’s personal data for targeted advertising and may not sell that consumer’s personal data.

• • The combined “actual knowledge and willful disregard” formulation is worth flagging for businesses accustomed to a pure “actual knowledge” standard, as it may affect how teenage signals are evaluated. Companies already complying with Connecticut’s teen-focused restrictions will find the substantive prohibition familiar, but should confirm that their age signaling and knowledge attribution controls extend to Vermont operations.