Law note · Vermont
Vermont Data Privacy and Online Surveillance Act, Attorney General enforcement
This enforcement scheme does not currently bind anyone; it takes effect January 1, 2028. As enacted, a violation will be a violation of the Vermont Consumer Protection Act, enforced solely by the Attorney General, with a mandatory 60-day cure notice from January 1, 2028 through June 30, 2029 under the Act's uncodified Sec. 3.
Sec. 2415j and the Act's uncodified Sec. 2 both state the Act creates no private right of action, and Sec. 2's intent language frames this as a deliberate legislative choice made contingent on the Attorney General receiving adequate enforcement resources, not an oversight.
This directly contradicts a secondary summary encountered during research describing the enacted law as including a limited private right of action for consumers; the Act's own text, quoted here, controls, and the secondary claim is not carried into this document.
What it asks of an app
- This enforcement scheme does not bind anyone yet; it takes effect January 1, 2028.
- Once in force, expect violations to be enforced exclusively by the Vermont Attorney General as a Consumer Protection Act violation, never by a private plaintiff.
- Do not treat any report of a Vermont consumer private right of action as accurate. The Act's own text expressly declines to create one.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Vermont session law text, 2026 Vt. Acts & Resolves Act 145 (S.71) as enacted, Vermont Legislature website