Law note · Vermont
Vermont Data Privacy and Online Surveillance Act, general applicability
This law does not currently bind anyone; it takes effect January 1, 2028.
As enacted, it will apply to a person conducting business in Vermont, or targeting products or services to Vermont residents, that in the preceding calendar year controlled or processed the personal data of at least 35,000 consumers, controlled or processed the sensitive data of at least 3,000 consumers, or offered for sale the personal data of at least 3,000 consumers, a materially broader sweep than New Hampshire's, Kentucky's, or Rhode Island's thresholds.
Sec. 2415b(c) sets a most-protective-law-controls rule against conflicting statutes, naming the Vermont Age-Appropriate Design Code Act. Act 145 (S.71) was signed June 16, 2026, following a 2024 predecessor, H.121, that passed both chambers but was vetoed and failed a Senate override by one vote.
What it asks of an app
- This law does not bind anyone yet; it takes effect January 1, 2028. Determine now whether you would meet its thresholds so compliance work can start ahead of that date.
- Once in force, determine whether you control or process the personal data of at least 35,000 Vermont consumers, the sensitive data of at least 3,000, or offer for sale the personal data of at least 3,000, before relying on any exemption.
- Expect the most-protective-law-controls rule to apply the Vermont Age-Appropriate Design Code Act instead, where the two conflict.
When LexLint raises it
Declared activities: automated_outreach, crawls_web, deploys_chatbot, processes_biometrics, processes_voice, trains_models
Primary source: official Vermont session law text, 2026 Vt. Acts & Resolves Act 145 (S.71) as enacted, Vermont Legislature website