Vermont Data Privacy and Online Surveillance Act: What to Know

Writing a privacy policy is straightforward. Knowing every place an organization collects, combines, analyzes, shares, and retains personal data is harder.

Vermont’s Data Privacy and Online Surveillance Act makes that distinction important.

Enacted through Senate Bill 71 in 2026, the law gives Vermont consumers new privacy rights and places requirements on qualifying organizations that handle personal information.

The law takes effect January 1, 2028.

Vermont’s approach goes beyond conventional privacy notices. It addresses sensitive data, online tracking, profiling, consumer health information, data minimization, and the information organizations derive from consumers and their devices.

That creates difficult questions for privacy, security, and data governance teams.

Can the organization identify the same consumer across a CRM system, marketing platform, cloud warehouse, and analytics environment? Can it distinguish ordinary personal information from sensitive data? Does it know which third parties receive consumer information? Can it locate data used to build a profile or automated decision?

Vermont’s privacy law makes enterprise data visibility central to operational readiness because organizations cannot consistently govern personal data they cannot find, classify, or connect to the people behind it.

This guide explains Vermont’s new privacy requirements, which organizations may fall within scope, the rights consumers receive, and how teams can connect legal obligations with the data and systems they actually manage.

What Is the Vermont Data Privacy and Online Surveillance Act?

The Vermont Data Privacy and Online Surveillance Act is a comprehensive consumer privacy law that establishes rights for Vermont residents and obligations for qualifying organizations that control or process personal data.

Vermont enacted the law through S.71, Act 145 of 2026.

The legislation adds a data privacy framework to Title 9 of the Vermont Statutes and addresses:

• Consumer access, correction, deletion, and portability rights.
• Opt-outs involving targeted advertising, personal data sales, and certain profiling.
• Sensitive personal information and consumer health data.
• Data minimization and processing limitations.
• Privacy notices and controller responsibilities.
• Relationships between controllers and processors.
• Data protection assessments for qualifying processing activities.
• Attorney General enforcement.

Vermont also expressly includes certain derived information and device-linked identifiers within its definition of personal data.

That distinction matters because a company may understand the customer information it collects directly without fully understanding the profiles, inferences, or behavioral information it creates afterward.

Organizations need to understand both the personal data they collect and the information they generate, combine, or infer from that data.

When Does Vermont’s Data Privacy Law Take Effect?

The Vermont Data Privacy and Online Surveillance Act takes effect January 1, 2028.

Who Must Comply With Vermont’s Data Privacy and Online Surveillance Act?

The law generally applies to organizations that conduct business in Vermont or produce products or services targeted to Vermont residents and meet at least one statutory threshold during the preceding calendar year.

Vermont also includes statutory entity-level and data-level exemptions.

Legal teams must determine whether the organization and its processing activities fall within scope. But that determination depends on reliable information about the data itself.

A single consumer may appear in customer records, transaction systems, marketing platforms, analytics datasets, cloud storage, and support applications.

Counting records alone may overstate the number of distinct consumers. Incomplete discovery may understate the data the organization processes.

BigID helps organizations discover and classify personal data across structured and unstructured environments and connect relevant information with identity context.

That gives privacy teams a stronger factual foundation for scope analysis while legal counsel determines how the law applies.

What Privacy Rights Does Vermont Give Consumers?

The Vermont law establishes several consumer rights involving personal information.

Eligible consumers can request that qualifying controllers:

• Confirm whether the controller processes their personal data.
• Access personal data, including qualifying inferences and information about certain profiling activities.
• Correct inaccurate personal information.
• Delete personal data provided by or obtained about them.
• Obtain a portable copy of qualifying personal data.
• Opt out of targeted advertising.
• Opt out of applicable personal data sales.
• Opt out of certain profiling that supports automated decisions with legal or similarly significant effects.
• Exercise specified rights involving certain consequential profiling decisions.
• Request information about third parties to which the controller sold personal data, subject to statutory conditions.

Controllers generally must respond to qualifying consumer requests within 45 days.

The law allows an additional 45 days when request complexity or volume reasonably requires more time and the controller provides the required notice.

Vermont also establishes procedures for appeals and authorized agents.

Why Vermont Consumer Rights Require Identity-Aware Data Discovery

Consider a consumer who requests access to their personal data.

The privacy team finds the consumer’s account in its CRM system.

But the organization also holds records in an analytics warehouse, marketing platform, customer support system, and several cloud repositories.

Some records contain information the consumer provided directly. Others contain inferred preferences, behavioral attributes, or data that analytics systems derived from previous interactions.

The organization must determine which records relate to the consumer, which rights apply, what it may disclose, and which exceptions affect fulfillment.

A request workflow cannot compensate for missing data visibility.

BigID helps connect personal data discovery with identity-aware privacy workflows so teams can locate relevant information across systems, coordinate fulfillment, and maintain operational evidence.

How Does Vermont Define Personal Data and Online Surveillance?

Vermont’s definition of personal data includes information that links or reasonably relates to an identifiable individual or to a device connected with an identifiable person.

The definition expressly includes derived data and unique identifiers.

That matters because organizations often create additional information after the initial collection event.

Examples may include:

• Behavioral attributes that analytics platforms infer from browsing activity.
• Profiles that combine information from multiple sources.
• Identifiers that connect devices, applications, and consumers.
• Predictions about consumer preferences or interests.
• Data that supports automated profiling and consequential decisions.

The statute also addresses targeted advertising, data sales, profiling, and other processing practices that can create online privacy risks.

Organizations should not assume that information becomes irrelevant to privacy governance simply because an algorithm generated it rather than a consumer providing it directly.

Data discovery must account for both original information and the additional personal data that enterprise systems derive from it.

How Does Vermont Treat Sensitive Personal Data?

Vermont identifies a broad set of sensitive data categories, including information involving:

• Racial or ethnic origin and religious beliefs.
• Sexual orientation, sex life, and specified gender-related information.
• Citizenship or immigration status.
• Physical and mental health conditions, diagnoses, disabilities, and treatment.
• Consumer health information.
• Genetic and biometric data.
• Children’s personal data.
• Precise geolocation information.
• Neural data.
• Specified financial account credentials.
• Government-issued identification numbers.

Covered controllers must evaluate the law’s consent, purpose, minimization, security, and other processing requirements before handling sensitive data.

The operational challenge starts with finding it.

A support transcript may contain health information. A cloud document may contain a government identifier. An analytics dataset may hold precise location information. A collaboration platform may contain sensitive records outside formal systems of record.

BigID helps organizations identify and classify sensitive information across enterprise data environments so teams can apply appropriate privacy, security, and lifecycle controls.

What Special Rules Apply to Consumer Health Data?

Vermont establishes additional protections for consumer health data.

The law includes requirements concerning confidentiality, processor access, certain geofencing practices, and the sale or offering for sale of consumer health information.

For example, the statute restricts using geofencing around covered health care facilities for specified consumer health data activities.

It also requires consent before selling or offering to sell consumer health data, subject to the statutory framework.

Organizations should evaluate these provisions separately from the general coverage thresholds because Vermont gives its consumer health data rules a distinct applicability provision.

Privacy teams need to identify health-related information, understand the systems and processing activities involving it, and connect that information with relevant policies and controls.

Where Do Vermont Privacy Requirements Create Operational Gaps?

What Does Vermont Require for Data Minimization?

Vermont’s law establishes responsibilities involving the collection, use, and processing of personal information.

For covered controllers, data minimization requires more than publishing a statement about responsible data collection.

Teams need to understand what information they collect, why they need it, which purposes justify continued processing, and when information no longer serves those purposes.

That becomes difficult when organizations maintain duplicate records across analytics platforms, customer applications, cloud repositories, and legacy systems.

BigID connects data discovery, classification, retention context, and lifecycle workflows to help organizations identify redundant, obsolete, trivial, and over-retained information.

That helps teams translate minimization requirements into repeatable data operations.

What Does Vermont Require for Profiling and Targeted Advertising?

Vermont provides consumer rights involving targeted advertising, personal data sales, and certain automated profiling decisions.

It also addresses additional rights when profiling supports decisions that produce legal or similarly significant effects.

Organizations should distinguish routine analytics from processing activities that fall within the statute’s definitions.

That requires understanding:

• Which personal data feeds profiling systems.
• Which applications and models create inferences.
• Which business purposes justify the processing.
• Whether automated decisions have legally significant effects.
• Which third parties receive relevant information.
• How consumer opt-outs affect downstream processing.

A consumer-facing opt-out mechanism addresses one part of this work.

Teams still need to identify the data flows and processing activities behind that mechanism.

BigID helps organizations discover personal data and connect it with privacy inventory and governance context so teams can better understand the information behind consumer choices.

Does Vermont Require Data Protection Assessments?

Yes. Vermont establishes data protection assessment requirements for qualifying processing activities that present heightened risks to consumers.

The law addresses assessments involving relevant processing risks, including specified profiling activities.

Vermont also provides rules for assessment reuse, regulatory access, and confidentiality.

The statute states that its data protection and impact assessment requirements apply to processing activities created or generated after January 1, 2028, rather than retroactively.

Assessment quality depends on accurate information about the processing activity.

Teams need to know which systems process the data, what categories they use, which purposes apply, which third parties participate, and which risks and safeguards matter.

Data intelligence helps privacy teams build more complete factual inputs for risk assessments and maintain context as processing activities change.

How Is Vermont’s Privacy Law Enforced?

The Vermont Attorney General has enforcement authority under the Data Privacy and Online Surveillance Act.

The law connects violations with Vermont’s Consumer Protection Act.

The final legislation does not create a private right of action for consumers under the Act.

During the period from January 1, 2028, through June 30, 2029, the law establishes a conditional notice-and-cure process.

If the Attorney General determines that a violation can be cured, the Attorney General must provide notice before initiating an action. The alleged violator then has 60 days after receiving notice to cure the violation.

Organizations should not interpret this conditional process as a universal exemption from enforcement or a permanent cure right.

How Should Organizations Prepare for Vermont’s Privacy Law?

Preparation should start with legal scope analysis and move quickly into data discovery, classification, privacy operations, and governance.

How BigID Supports Vermont Privacy Compliance Readiness

Vermont establishes legal obligations. BigID provides data intelligence and privacy automation capabilities that help organizations operationalize relevant requirements.

• Personal data discovery and classification: Identify personal and sensitive information across structured, unstructured, cloud, SaaS, and enterprise environments.
• Identity-aware data intelligence: Connect personal data across systems with relevant identity context.
• Data rights automation: Support access, correction, deletion, portability, and related privacy request workflows.
• Privacy automation and compliance: Connect privacy workflows with enterprise data discovery and governance context.
• Sensitive data governance: Identify information that may require additional consent, security, or processing controls.
• Data minimization and lifecycle management: Find redundant, obsolete, trivial, and over-retained information and coordinate appropriate action.
• Data access governance: Connect sensitive information with identity and access context to prioritize excessive exposure.
• Governance evidence: Maintain relevant discovery, policy, ownership, assessment, workflow, and remediation context.

BigID does not independently determine whether an organization complies with Vermont law.

BigID helps organizations understand and govern the personal data behind their privacy obligations so teams can move from policy to action.

Why Vermont’s Privacy Law Matters Beyond Vermont

Vermont adds another set of jurisdiction-specific obligations to the U.S. privacy landscape.

Organizations operating across multiple states need to account for differences in applicability, sensitive data, profiling, consumer rights, assessments, and enforcement.

Building a separate manual inventory for every state creates unnecessary complexity.

A stronger model starts with a shared foundation of enterprise data intelligence.

Organizations can discover personal information, classify sensitive categories, connect identities, document processing context, understand access, and coordinate privacy workflows, then apply jurisdiction-specific legal requirements to that foundation.

That approach supports Vermont readiness while helping privacy teams scale governance across multiple regulatory frameworks.

Vermont Data Privacy and Online Surveillance Act: Frequently Asked Questions

What is the Vermont Data Privacy and Online Surveillance Act?

The Vermont Data Privacy and Online Surveillance Act is a comprehensive consumer privacy law enacted through S.71, Act 145 of 2026. It establishes consumer rights and requirements for qualifying organizations that process personal data.

When does Vermont’s privacy law take effect?

The law takes effect January 1, 2028.

Who must comply with Vermont’s privacy law?

The law generally covers organizations doing business in Vermont or targeting Vermont residents that meet at least one threshold involving 35,000 consumers’ personal data, 3,000 consumers’ sensitive data, or offering 3,000 consumers’ personal data for sale. Exemptions and special consumer health data applicability rules apply.

What rights does the Vermont privacy law give consumers?

Eligible consumers receive rights involving access, correction, deletion, portability, opt-outs, certain profiling decisions, and information about third parties that purchase personal data, subject to statutory conditions.

How long do organizations have to respond to privacy requests?

Controllers generally must respond within 45 days. The law allows an additional 45 days when reasonably necessary and when the controller provides the required notice.

Does Vermont’s law cover sensitive personal data?

Yes. Vermont includes detailed sensitive data categories, including health, genetic, biometric, location, financial, identification, children’s, and neural information.

Does Vermont regulate consumer health data?

Yes. The law establishes specific consumer health data protections involving confidentiality, processor access, certain geofencing activities, and data sales. Special applicability rules apply.

Does Vermont require data protection assessments?

Yes. Vermont establishes assessment requirements for qualifying processing activities that present heightened risks. The statute applies these assessment requirements to processing activities created or generated after January 1, 2028.

Does Vermont’s privacy law create a private right of action?

No. The enacted Vermont Data Privacy and Online Surveillance Act does not create a private right of action for consumers under the Act. The Vermont Attorney General has enforcement authority.

How can BigID help with Vermont privacy readiness?

BigID helps organizations discover personal data, classify sensitive information, connect individuals with relevant records, automate privacy workflows, identify access risks, apply lifecycle controls, and maintain governance evidence. These capabilities support privacy readiness but do not replace legal analysis or independently establish compliance.

Sources and Further Reading

• Vermont Legislature: S.71, Act 145, Bill Status and Enacted Legislation
• Office of Governor Phil Scott: Legislative Action, June 16, 2026
• BigID Privacy Automation & Compliance
• BigID Data Discovery & Classification
• BigID Data Rights Automation

This article provides general educational information and does not constitute legal advice. Organizations should consult qualified counsel regarding Vermont’s statutory requirements, applicability thresholds, exemptions, consumer rights, sensitive data provisions, and implementation obligations.

Author

Lonnie Ross

Digital Experience Marketing Lead

Lonnie is the Digital Experience Marketing Lead at BigID, bringing over a decade of SEO and digital marketing expertise across B2C and B2B businesses in SaaS and eCommerce. Having worked both in tech and on the agency side, Lonnie combines a strong foundation in search strategy, UX, and content development with a passion for the evolving landscape of data protection. From aligning content with search intent to sharpening brand voice, Lonnie ensures that organizations not only stand out in a competitive SaaS market but also build trust through thought leadership on critical issues like compliance, data risk, and responsible innovation.