Industry - Policy Change
Executive Summary
Vermont enacted the Vermont Data Privacy and Online Surveillance Act (VDPOSA) in June 2024, becoming the 23rd U.S. state to pass a consumer privacy law. The law grants Vermont residents rights over their personal data and requires businesses meeting certain thresholds to follow specific data collection, use, and security requirements when handling that information. VDPOSA takes effect on January 1, 2028.
What Happened
Vermont enacted the Vermont Data Privacy and Online Surveillance Act (VDPOSA) in June 2024, making it the 23rd U.S. state to pass a comprehensive consumer privacy law. The law will take effect on January 1, 2028, granting Vermont residents rights over their personal data and imposing obligations on businesses that collect, process, or sell that information. VDPOSA includes requirements for data collection limitations, security measures, and consumer rights enforcement, with notably low applicability thresholds compared to many other state laws.
Who Is Affected
Vermont residents will gain new rights to access, correct, delete, and control how their personal data is collected and used. Businesses that meet specific thresholds - controlling or processing personal data of at least 35,000 Vermont residents, handling sensitive data of at least 3,000 residents, or selling personal data of at least 3,000 residents - must comply with the law's requirements. These low thresholds, particularly for sensitive data and data sales, may capture more companies than similar laws in other states.
Why It Matters
VDPOSA's low applicability thresholds for sensitive data and data sales (3,000 Vermont residents) place it among the more aggressive state privacy laws alongside Connecticut, potentially requiring companies to update their multistate compliance programs even if Vermont represents a small market. The law continues the trend of state-level privacy regulation in the absence of federal legislation, adding complexity to the fragmented U.S. privacy landscape. Its inclusion of stand-alone provisions for consumer health data and stricter thresholds may influence how other states approach privacy legislation.
What You Should Do
Vermont residents should familiarize themselves with their new privacy rights, which will include the ability to request access to, correction of, and deletion of their personal data starting January 1, 2028. When the law takes effect, residents can exercise these rights by contacting businesses directly through privacy request mechanisms that covered companies will be required to provide. Businesses operating in Vermont should assess whether they meet the law's applicability thresholds and begin preparing compliance programs, including updating privacy policies, implementing data security measures, and establishing processes to honor consumer rights requests before the 2028 deadline.
Summary generated from verified sources and reviewed before publication. How we summarize.