Vermont, The Green Mountain State, Gives Green Light To Comprehensive Privacy Law

Vermont has become the latest state to pass a comprehensive consumer privacy law. Governor Scott signed the Vermont Data Privacy and Online Surveillance Act on June 16. The law takes effect on January 1, 2028 and like others, applies to companies that do business in the state, or target Vermont residents, and meet certain thresholds.

The law will apply to businesses that either: (1) control or process personal data of at least 35,000 consumers; (2) control or process sensitive data of at least 3,000 consumers; or (3) offer for sale the personal data of at least 3,000 consumers. The law’s requirements will, for the most part, mirror those of other state privacy laws:

• Data security, including heightened measures for health data. Unlike other states, in Vermont, all companies -regardless of whether they meet the applicability thresholds- will have obligations around protecting health data. This includes not giving employees or contractors access to consumer health data unless subject to a duty of confidentiality. And, having contractual measures in place with vendors who might process such data. The law will also prohibit geofencing within 1,850 feet of any health care facility to identify, track, or collect data from a consumer, or send any notification to a consumer regarding their consumer health data. Sale of this data will also be prohibited without prior consumer's consent. Like other states, though, the law also contains some standard data security obligations that apply if thresholds are met. These include using reasonable administrative, technical, and physical safeguards to protect personal data and keep it accurate, available, and confidential. Additionally,
• Privacy notice. Covered companies will need to provide consumers with a clear, easy-to-read privacy notice. In that notice, they will need to list the types of personal data that will be processed, explain why the data is processed, and describe the types of personal data the business sells. It will also need to name the types of third parties who receive that data.
• Privacy rights. Once in effect, companies subject to the law will need to give Vermont residents rights like those in other states. These include access, deletion and correction. In Vermont, consumers will also have the right to ask what inferences the business has drawn from their data and if it uses their data for profiling that could create a legal or similarly serious impact. They will also be able to opt out of targeted advertising, the sale of their personal data, and certain kinds of risky profiling. If a business sells a Vermont resident’s personal data, the resident can ask for a list of the specific third parties that bought it. If the business does not keep that kind of list, the resident can ask for a list of all third parties to whom the business sells personal data.
• Data minimization. Companies will need to follow data minimization tenets, namely to collect only the personal data reasonably needed to do what the business told consumers.
• Consent for sensitive data. As in other states, covered companies will need to get the consumer’s consent before processing or selling sensitive data. Sensitive data includes race, ethnicity, religion, health, sexuality, biometrics, neural data, precise geolocation, and data from known children under 13.
• Data protection assessments. Review and write down a data protection assessment when a processing activity could create a higher risk of harm. This includes targeted advertising, selling personal data, certain profiling, and processing sensitive data.

The Attorney General has exclusive enforcement authority: there will be no private right of action. There will be a right to cure for businesses for the first 18 months (January 1, 2028, through June 30, 2029). During that time, the Attorney General must send a cure notice and give a business 60 days to remediate before the Attorney General takes more action.

Putting It into Practice: While Vermont’s privacy law requirements are familiar, its thresholds are some of the lowest. Moreover, the consumer health data provisions of § 2415k apply to any business that conducts business in Vermont or targets Vermont residents, with no threshold whatsoever. Thus, for companies who are building nationwide privacy programs, Vermont will be one to keep track of before the January 2028 effective date.