In June 2026, Vermont lawmakers signed the Vermont Data Privacy and Online Surveillance Act (VDPOSA).
This upcoming consumer privacy law outlines rights individuals have over their personal information and describes obligations entities must follow to lawfully collect and use that data.
- What Is the Vermont Data Privacy and Online Surveillance Act (VDPOSA)?
- When is the VDPOSA Effective?
- What Does the VDPOSA Cover?
- What Are the Requirements of the Vermont Data Privacy and Online Surveillance Act?
- Who Does the Vermont Data Privacy and Online Surveillance Act Apply To?
- How Will Consumers Be Impacted by the Vermont Data Privacy and Online Surveillance Act?
- How Will Businesses Be Impacted by the Vermont Privacy Law?
- How Will the VDPOSA Affect My Privacy Policy?
- How Will the VDPOSA Affect My Cookie Policy?
- Who Must Comply with Vermont’s New Privacy Law?
- Who is Exempt from the Vermont Data Privacy and Online Surveillance Act?
- How Will the Vermont Data Privacy and Online Surveillance Act Be Enforced?
- What Are the Fines and Penalties Under the Vermont Data Privacy and Online Surveillance Act?
- Vermont Data Privacy and Online Surveillance Act Key Terms and Definitions
- How Will Termly Help Businesses with the Vermont Data Privacy and Online Surveillance Act?
What Is the Vermont Data Privacy and Online Surveillance Act (VDPOSA)?
The Vermont Data Privacy and Online Surveillance Act is a new consumer data privacy law that gives people in the state rights regarding if, when, and how their personal information is collected, used, and shared by entities online.
It outlines strict guidelines entities must follow when using that information and describes the penalties for noncompliance.
This law is intended to give Vermont residents more transparency and control over their own privacy.
When is the VDPOSA Effective?
The VDPOSA becomes effective on January 1, 2028.
What Does the VDPOSA Cover?
The VDPOSA covers the personal data of residents of the state of Vermont.
Any personal data being collected about Vermont residents by entities who meet the legal thresholds is subject to the requirements outlined by this new law.
What Are the Requirements of the Vermont Data Privacy and Online Surveillance Act?
Requirements of the Vermont Data Privacy and Online Surveillance Act that impact businesses and website owners include:
- Data collection limitations: As a controller, your website must limit the collection of personal data to what is reasonably necessary and proportionate in relation to the purposes for which the data are processed, as disclosed to the consumer.
- Security and safety measures: You must implement and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of the data you collect.
- Extra protection for sensitive data: You cannot process sensitive data unless the consumer has provided consent, and the processing is reasonably necessary in relation to the purposes for which the data is being collected. You also cannot sell the data unless you get the consent of the consumer.
- Provide a consent mechanism: You must provide a mechanism for consumers to remove or revoke their consent, and it must be as easy as it was for them to give consent.
- Extra protection for children 13-18 years: You cannot process personal data for consumers of these ages for the purposes of targeted advertising or sell their information.
- Provide a privacy notice: As a controller, your website must provide consumers with a reasonably accessible, clear privacy notice that includes specific details about your data processing.
- Create sufficient contracts between controllers and processors: If you work with a data processor or become a data processor, a specific contract outlining specific details must be signed by both parties. Requirements include requiring the processor to follow all guidelines of the VDPOSA, return all data to the controller at their request, and be subject to a duty of confidentiality.
- Data Protection and Impact Assessments: As a controller, you must perform a Data Protection and Impact Assessment for all processing activities that present a heightened risk of harm to consumers, including processing their data for targeted ads, the sale of data, processing data for the purposes of profiling, and processing sensitive data.
Who Does the Vermont Data Privacy and Online Surveillance Act Apply To?
The Vermont data privacy law applies to individuals who are residents of the state, and the law refers to them as ‘consumers’.
The term does not include individuals acting in a commercial or employment context.
How Will Consumers Be Impacted by the Vermont Data Privacy and Online Surveillance Act?
The Vermont Data Privacy and Surveillance Act impact consumers by granting them the following rights over the personal information:
- Right to know if a controller is processing their information,
- Right to access their data,
- Right to correct their data,
- Right to delete their data,
- Right to obtain a list of third parties the controller sold their data to,
- Right to opt out of targeted advertising,
- Right to question the results of a controller’s profiling and be informed of the reason for the decision.
- Right to review their data that was processed for the purposes of profiling,
- If the decision concerns housing, right to take into account the nature of the data and the purposes for why it was processes,
- Be allowed to correct inaccuracies processed for the purposes of profiling and have the decision be reevaluated based on the corrections.
- Right to Portability
- Right to Non-Discrimination
Unique to this law is its interpretation of ‘right to know’ which includes the following:
“including any inferences about the consumer derived from such personal data and whether a controller or processor is processing a consumer’s personal data for the purposes of profiling to make a decision that produces any legal or similarly significant effect concerning a consumer, unless such confirmation or access would require the controller to reveal a trade secret or the controller is prohibited from disclosing such personal data”
In other words, if a consumer asks for it, you must inform them what inferences your business implied about them by processing their data.
How Will Businesses Be Impacted by the Vermont Privacy Law?
Businesses are impacted by the new Vermont privacy law in several ways as noted by the list of requirements above, but it explicitly impacts website privacy policies and cookie policies.
How Will the VDPOSA Affect My Privacy Policy?
The VDPOSA heavily impacts websites’ privacy policies.
Under the new Vermont law, you’re required to provide consumers with a clear and reasonable privacy notice that include the following information:
- Categories of personal data being processing,
- Purposes for the processing and a description of the processing,
- A description of how consumers can submit requests to follow through on all of their privacy rights,
- The categories of personal data sold to third parties, if any,
- The categories of the third parties themselves that data is sold to, if any,
- A clear, conspicuous disclosure of any processing done for the purposes of targeted advertising or the sale of data to a third party for targeted advertising,
- An active email address or other online mechanism that consumers can use to contact you,
- A statement disclosing whether you use personal data for the purpose of training large language models,
- The most recent year during which you updated your privacy policy.
It’s important to note that the Vermont privacy law explicitly requires you to inform consumers if you’re using their data to train an AI model of any kind.
This reflects more modern ways personal data is being used and fed to different technologies.
Additionally, the notice must also be publicly available in all of the following ways:
- Through a conspicuous link including the word “privacy” on the home page of the website, the app store page or download page of an app, in the settings menu or a similarly conspicuous location,
- If you don’t have a website, through a medium in which you regularly interact with your consumers, like the mail or email,
- In each language the controller provides any product or service that is subject to the privacy notice,
- In a manner that is reasonably accessible and usable by individuals with disabilities.
You must inform consumers about all material changes to your privacy policy and enable them to easily withdraw from any processing changes.
How Will the VDPOSA Affect My Cookie Policy?
Vermont’s new data privacy law also affects cookie policies.
The VDPOSA gives consumers the right to opt out of targeted ads and selling data to third parties, which typically is performed by websites by deploying cookies, pixels, or other trackers on users’ browsers or devices.
Your cookie policy must reflect which cookies are used for these purposes, and state that purpose clearly and conspicuously. It must also be presented to the consumer.
Ensure your cookie policy is updated, so it meets all of Vermont’s transparency and disclosure requirements.
Consider linking it to a consent banner, the footer of your site, and a dedicated privacy page.
Who Must Comply with Vermont’s New Privacy Law?
Anyone who conducts business in Vermont or produces services targeted at residents of the state and meets the following during the preceding calendar year must follow the Vermont Data Privacy and Online Surveillance Act:
- Controls of processes the personal data of no less than 35,000 consumers, excluding data processes solely for completed payment transactions, or
- Controls or processes the sensitive personal data of no less than 3,000 consumers, excluding data processes solely for completed payment transactions, or
- Offers for sale in trade of commerce the personal data of no less than 3,000 consumers.
Who is Exempt from the Vermont Data Privacy and Online Surveillance Act?
The following organizations are exempt from following the VDPOSA:
- Federal, state, tribal, or local government entities
- Entities governed by HIPAA
- Nonprofit organizations
- Nonprofit organizations established to detect and prevent insurance fraud
- State- or federally chartered bank or credit unions
- Entities regulated by the Department of Financial Regulation or the Securities and Exchange Commission
- Noncommercial activity of anyone connected with the publication of a general circulation, radio or television stations that hold a license issued by the Federal Communications Commission, nonprofits that provide programming to radio or TV networks, or a press association or wire service
How Will the Vermont Data Privacy and Online Surveillance Act Be Enforced?
The Vermont Data Privacy and Online Surveillance Act will be enforced by the state Attorney General.
The Attorney General will also submit a report on or before December first of each year disclosing:
- The number of notices of violations that have been handed out,
- The nature of the violations,
- The number of violations that resulted in enforcement actions,
- The number of actions that proceeded to trial,
- Whether an opportunity was granted for the controller to cure the violation or not,
- Any other matter deemed fit by the Attorney General.
Consumers do not have a right to civil action under this law.
What Are the Fines and Penalties Under the Vermont Data Privacy and Online Surveillance Act?
Civil fines for violating the Vermont Data Privacy and Online Surveillance act could reach as high as $10,000 per incident.
Vermont Data Privacy and Online Surveillance Act Key Terms and Definitions
In the table below, you can read through several key terms from the VDPOSA and their definitions as they appear directly in the legal text itself.
| Key Terms | Definition |
| Consent | A clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to allow the processing of personal data relating to the consumer.
May include a written statement, including by electronic means, or any other unambiguous affirmative action. Does NOT include:
|
| Consumer | An individual who is a resident of the state.
Does NOT include:
|
| Controller | A person who, alone or jointly with others, determines the purpose and means of processing personal data. |
| Personal Data | Any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals.
Does NOT include:
|
| Process/Processing | Any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data. |
| Processor | A person who collects or processes personal data on behalf of a controller, or another processor. |
| Sale of personal data | The exchange of a consumer’s personal data by the controller with a third party for monetary or other valuable consideration.
Does NOT include:
|
| Sensitive Data | Personal data that includes:
|
| Targeted advertising | Displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred from that consumer’s activities over time and across nonaffiliated websites or online applications to predict the consumer’s preferences or interests.
Does NOT include:
|
How Will Termly Help Businesses with the Vermont Data Privacy and Online Surveillance Act?
Termly helps businesses simplify compliance with privacy laws from around the world, including the existing U.S. state level laws that are currently in force.
Our team works hard to ensure our policy generators and consent management tools are updated to keep up with evolving and new laws.
We’ll apply the adequate updates and notify our customers before the Vermont Data Privacy and Online Surveillance Act enters into force.
Check back for more updates!
Natasha Piirainen is a privacy writer with a Bachelor’s Degree in English and Philosophy from Wheaton College and over 10 years of professional experience in research-driven content development.
Read all posts by Natasha Piirainen
Reviewed by Masha Komnenic CIPP/E, CIPM, CIPT, FIP
Masha Komnenic is a legal counsel and Termly’s Director of Global Privacy, who received her law degree from Belgrade University. She specializes in implementing, monitoring, and auditing business compliance with privacy regulations (HIPAA, PIPEDA, ePrivacy Directive, GDPR, CCPA, POPIA, LGPD).
Read all posts reviewed by Masha Komnenic CIPP/E, CIPM, CIPT, FIP
Generate a FREE Privacy Policy
