Vermont

S.69 (2025), Vermont Age-Appropriate Design Code Act (Act 63 of 2025)

Requires covered businesses offering online services, products, or features reasonably likely to be accessed by minors under 18 to minimize collection and use of covered minors' personal data, refrain from using minors' data in algorithmic recommendation systems except at the minor's request, bar unsignaled monitoring or location tracking of minors, prohibit push notifications to minors between midnight and 6:00 a.m., and protect age assurance data. Violations are unfair and deceptive acts in commerce under 9 V.S.A. section 2453.

Security Breach Notice Act

A data collector that owns or licenses computerized personally identifiable information or login credentials must notify an affected Vermont consumer of a security breach in the most expedient time possible and without unreasonable delay, but not later than 45 days after discovery.

Notice to the Attorney General or the Department of Financial Regulation, as applicable, is faster, with a preliminary description due within 14 business days, faster than New Hampshire's, Kentucky's, or Rhode Island's regulator-notice timelines in this batch. The source page's own history note dates original enactment to 2005, No. 162 (Adj. Sess.), sec. 1, effective January 1, 2007, since amended in 2011, 2013 (twice), 2015, and 2019; the source page itself flags as an unofficial online copy.

The enforcement subsection ties Attorney General and State's Attorney remedies to those they hold under 9 V.S.A. chapter 63, Vermont's Consumer Fraud Act, which independently grants consumers a private right of action for practices barred by section 2453; whether that cross-reference extends a private cause of action to a section 2435 notice violation, rather than only borrowing the state's own enforcement remedies, is not resolved by the text read and is left unset here, unlike the express private right of action in RSA 359-C:21 (New Hampshire) or the express denial in Act 145's own sec. 2415j.

Vermont Data Privacy and Online Surveillance Act, general applicability

This law does not currently bind anyone; it takes effect January 1, 2028.

As enacted, it will apply to a person conducting business in Vermont, or targeting products or services to Vermont residents, that in the preceding calendar year controlled or processed the personal data of at least 35,000 consumers, controlled or processed the sensitive data of at least 3,000 consumers, or offered for sale the personal data of at least 3,000 consumers, a materially broader sweep than New Hampshire's, Kentucky's, or Rhode Island's thresholds.

Sec. 2415b(c) sets a most-protective-law-controls rule against conflicting statutes, naming the Vermont Age-Appropriate Design Code Act. Act 145 (S.71) was signed June 16, 2026, following a 2024 predecessor, H.121, that passed both chambers but was vetoed and failed a Senate override by one vote.

Vermont Data Privacy and Online Surveillance Act, consumer rights

This right and this deadline do not currently bind anyone; they take effect January 1, 2028.

As enacted, sec. 2415d will grant access (including a right to know about profiling used for legal or significant-effect decisions), correction, deletion, portability, opt-out of targeted advertising, sale, and profiling, a profiling-specific explanation and correction-and-reevaluation right for housing decisions, and a right to a list of third parties personal data was sold to, a broader rights list than New Hampshire, Kentucky, or Rhode Island.

A controller will have to respond without undue delay and not later than 45 days after receipt, with one 45-day extension available.

Vermont Data Privacy and Online Surveillance Act, Attorney General enforcement

This enforcement scheme does not currently bind anyone; it takes effect January 1, 2028. As enacted, a violation will be a violation of the Vermont Consumer Protection Act, enforced solely by the Attorney General, with a mandatory 60-day cure notice from January 1, 2028 through June 30, 2029 under the Act's uncodified Sec. 3.

Sec. 2415j and the Act's uncodified Sec. 2 both state the Act creates no private right of action, and Sec. 2's intent language frames this as a deliberate legislative choice made contingent on the Attorney General receiving adequate enforcement resources, not an oversight.

This directly contradicts a secondary summary encountered during research describing the enacted law as including a limited private right of action for consumers; the Act's own text, quoted here, controls, and the secondary claim is not carried into this document.

Vermont Data Privacy and Online Surveillance Act, sensitive data and biometric data definitions

This provision does not currently bind anyone; it takes effect January 1, 2028. As enacted, any genetic or biometric data (as defined) will be sensitive data, with no unique-identification qualifier, unlike New Hampshire's, Kentucky's, and Rhode Island's sensitive-data clauses.

"Biometric data" will list more enumerated modalities than those three states, including iris or retina scans, fingerprints, facial or hand geometry, vein patterns, voiceprints, and gait, and will exclude a photograph or recording, or data generated from one, only until that data is generated to identify a specific individual, the same clawback structure New Hampshire, Kentucky, and Rhode Island each use.