Vermont
Vermont Data Privacy and Online Surveillance Act (Act 145)
Vermont’s consumer privacy law. It gives Vermont residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- Starts January 1, 2028
- Citation
- Act 145 (2026)
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses that handle data of 35,000+ Vermont residents a year, or 3,000+ if they earn revenue from selling data.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Honor Global Privacy Control as an opt-out (from Jan 1, 2028).
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer an appeal when you turn down a privacy request.
Who has to comply, from January 1, 2028
The Vermont Data Privacy and Online Surveillance Act (Act 145, S.71) was signed on June 16, 2026 and takes effect on January 1, 2028. Its thresholds are among the lowest in the country, with no revenue test. It applies to a business that meets any one of these: personal data of 35,000 or more Vermont consumers; sensitive data of 3,000 or more; or offering for sale the personal data of 3,000 or more.
There’s no general nonprofit exemption, only narrow ones such as insurance-fraud nonprofits. Government bodies are exempt.
Visitors’ rights and your deadlines
- Rights to access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling for significant automated decisions.
- A right to a list of the third parties you sold their data to.
- Respond within 45 days, extendable by 45 more. You don’t have to verify identity for an opt-out.
- Appeals: answer in writing within 60 days.
Opt-out preference signals from 2028
From January 1, 2028, businesses must let consumers opt out of targeted advertising and sale through an opt-out preference signal, such as Global Privacy Control, sent with the consumer’s consent. It can’t be a default setting. If the signal conflicts with a consumer’s other settings, follow the signal.
Sensitive data and minors under 18
Processing or selling sensitive data needs consent. The definition includes consumer health data, status as nonbinary or transgender, and citizenship or immigration status. Collection must be reasonably necessary and proportionate.
For consumers you know, or willfully disregard, are 13 to 17, you may not use their data for targeted advertising or sell it. Under 13, COPPA applies.
Your privacy notice
Keep it reasonably accessible, clear and meaningful. Vermont adds two items: whether you use or sell personal data to train AI, and the month and year you last updated the notice.
Enforcement
A violation is a violation of the Vermont Consumer Protection Act, with civil penalties of up to $10,000 per violation. The Act gives no private right of action, though the Legislature said it may consider adding one. From January 1, 2028 to June 30, 2029, where the Attorney General decides a cure is possible, a business gets notice and 60 days to fix the problem.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Global Privacy Control
On by default. Honored as an opt-out, shown to the visitor, and logged with the consent record.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
When does Vermont’s privacy law take effect?
January 1, 2028.
How low are Vermont’s thresholds?
Personal data of 35,000 consumers, or sensitive data of just 3,000, or offering 3,000 consumers’ data for sale.
Will Vermont require Global Privacy Control?
Yes. From January 1, 2028, businesses must honor opt-out preference signals such as GPC.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
