Vermont Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines

What Vermont’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed August 2026.

What You Need to Know

Vermont is the 23rd state to enact a broad consumer privacy law, following the 2025 version of Connecticut’s. Its definitions run broader than most — personal data reaches derived and device-linked information, publicly available information is defined narrowly, and biometric data covers information collected or used to identify someone, so collection alone can trigger coverage. The rights are correspondingly expansive: consumers can access inferences drawn about them, question profiling decisions that produce legal or similarly significant effects, and obtain a list of third parties a controller sold their data to.

Read the full analysis →

Official law text

S. 71

Who the law applies to

Threshold	Requirement
Main Provisions
Annual gross revenue	N/A
Consumers whose data is processed	35,000 consumers 5.42% of state’s 645,000 population
Revenue from sale of personal data	–
Other conditions	Controlled or process sensitive data of not fewer than 3,000 consumers, excluding personal data controlled or processed solely for the purposes of completing a payment transaction Offer for sale in trade or commerce personal data of not fewer than 3,000 consumers
Consumer Health Provisions
Annual gross revenue	N/A
Consumers whose data is processed	–
Revenue from sale of personal data	–
Other conditions	Section 2415k of the law (Consumer Health Data Privacy) and the provisions of law concerning consumer health data and consumer health data controllers apply to a person that conducts business in Vermont or a person that produces products or services that are targeted to residents of Vermont

Consumer rights under Vermont's law15

Right	Provided?
Know	Yes
Access	Yes
Obtain list of third parties to which personal data was disclosed note Consumers can obtain a list of the third parties the controller sold the consumer's personal data to, or if such controller does not maintain a list of the third parties to which the controller sold the consumer's personal data, a list of all third parties to which such controller has sold personal data.	Partial
Data portability	Yes
Delete	Yes
Correct inaccuracies	Yes
Not be discriminated against for exercising rights	Yes
Opt-out of sale	Yes
Opt-out of targeted advertising/sharing	Yes
Opt-out of certain types of profiling note If the consumer’s personal data were processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer, and if feasible, the consumer has the right to question the result of such profiling, be informed of the reason that such profiling resulted in such decision, review the consumer’s personal data that were processed for the purposes of such profiling, and if the profiling decision concerned housing, taking into account the nature of the personal data and the purposes for which such personal data were processed, allow the consumer the right to correct any incorrect personal data that were processed for the purposes of such profiling and have the profiling decision reevaluated based on the corrected personal data.	Yes
Opt-out of ADMT	No
Recognize opt-out signals	Yes
Revoke consent	Yes
Not process data in discriminatory manner	No
Appeal	Yes

Tracking Vermont’s privacy law? We write about it as the law changes.

Categories treated as sensitive data17

Racial or ethnic origin
Religious beliefs
Mental or physical health diagnosis
Mental or physical health condition
Mental or physical health treatment
Mental or physical disability
Sexual orientation
Sex life
Status as transgender or nonbinary
Citizenship or immigration status
Genetic or biometric data or information derived therefrom
Personal data from individual controller has actual knowledge or willfully disregards is a child
Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.
Consumer health data
Government-issued identification #, including, but not limited to, Social Security #, passport #, state identification card # or driver's license #, that applicable law does not require to be publicly displayed
Financial account number, financial account log-in information or credit card or debit card number that, in combination with any required access or security code, password or credential, would allow access to a consumer's financial account
Neural data

How sensitive data must be treated3

Obtain Consent to Process and Processing is Reasonably Necessary for Purposes for Which Sensitive Data are Processed
Must Obtain Consent to Sell Sensitive Data
Conduct Data Protection or Risk Assessment

Requirements for minors' data2

Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent
Cannot sell personal data or process personal data for targeted advertising for children 13-17

Activities that trigger a risk or impact assessment6

Targeted advertising (“sharing”)
Sale of personal data
Processing of sensitive data
Processing personal data for purposes of profiling where it presents reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial, physical, or reputational injury to consumers; physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; other subject injury to consumers
Any processing activities involving personal data that present a heightened risk of harm to consumers
Profiling for purposes of making a decision that produces any legal or similarly significant effect concerning a consumer
note
Decision that produces any legal or similarly significant effect means any decision made by the controller, or on behalf of the controller, that results in the provision or denial by the controller of any financial or lending service, any housing, any insurance, any education enrollment or opportunity, any criminal justice, any employment or any health care service.

Other notable provisions10

Definition of “Sale” Includes “Other Valuable Consideration”
Applies to Nonprofits
Data Processing Agreements
Privacy Policy
Implement Reasonable Data Security Measures
Duty to Avoid Secondary Use
Data Minimization
Attorney General Enforcement
Right to Cure
note
60 day right to cure that sunsets June 30, 2029.
Rulemaking
note
The law does not mandate rulemaking, but requires the attorney general to “provide, and update as necessary, guidance to controllers and processors for compliance with the terms of the” law.

Key dates2

Date	What happens
January 1, 2028	Vermont's consumer data privacy law takes effect
June 30, 2029	Vermont's 60-day right to cure sunsets

Questions about Vermont’s privacy law?

Stauss PLLC advises companies on state privacy, AI, and data broker compliance.

Contact Stauss PLLC

Follow Vermont’s privacy law

Our analysis, by email, as the law moves.

This page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.