Which privacy laws apply to your business in Vermont?
No comprehensive consumer-privacy statute is in force in Vermont today. The operative state framework is sectoral: the Security Breach Notice Act governs breach response, a data-broker law requires registration and an information security program from businesses that knowingly collect and sell or license consumer data they did not get from the consumer directly , a student-data subchapter governs operators of online services used primarily for PreK-12 school purposes , and the Consumer Protection Act's ban on unfair or deceptive acts in commerce is the enforcement backbone for all of it .
Two queued changes make Vermont unusual right now. First, a comprehensive bill — S.71, the Vermont Data Privacy and Online Surveillance Act — has passed both chambers and, as of June 12, 2026, sits on the Governor's desk awaiting signature, veto, or inaction; it is covered in detail in the next section because none of its duties are law yet. Second, the Vermont Age-Appropriate Design Code Act (Act 63 of 2025) is already enacted and codified at 9 V.S.A. §§ 2449a–2449i, but by its own terms the act does not take effect until January 1, 2027 , so its duties for minors' online services belong on a compliance roadmap rather than in a current-obligations checklist.
Until either of those layers arrives, Vermont residents have no general state-law rights to access, delete, correct, or port their personal data, no right to opt out of sale or targeted advertising, and businesses face no state notice-at-collection, consent, data-protection-assessment, or processor-contract duties. The rest of a Vermont-facing privacy program rides the federal overlay: Section 5 of the FTC Act reaches deceptive or unfair privacy practices nationwide , the Gramm-Leach-Bliley Act governs financial institutions, HIPAA governs covered health entities and their business associates, and COPPA governs services directed to children under 13. A program built to that overlay plus the Vermont statutes described below upgrades rather than restarts if S.71 becomes law.
Sources for this answer
Primary law
A.1 9 V.S.A. § 2435Vermont's breach-notification statute is formally named the Security Breach Notice Act.
This section shall be known as the Security Breach Notice Act.
See 9 V.S.A. § 2435(a).
Primary law
A.2 9 V.S.A. § 2430A data broker is a business that knowingly collects and sells or licenses to third parties the brokered personal information of consumers with whom it has no direct relationship.
“Data broker” means a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship.
See 9 V.S.A. § 2430(4)(A).
Primary law
A.3 9 V.S.A. § 2443Vermont's student-data subchapter applies to operators of websites, online services, and applications used primarily for PreK-12 school purposes and designed and marketed for those purposes.
“Operator” means, to the extent that an entity is operating in this capacity, the operator of an Internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for PreK-12 school purposes and was designed and marketed for PreK-12 school purposes.
See 9 V.S.A. § 2443(2).
Primary law
A.4 9 V.S.A. § 2453The Vermont Consumer Protection Act declares unfair methods of competition and unfair or deceptive acts or practices in commerce unlawful — the enforcement hook into which the privacy statutes route violations.
Unfair methods of competition in commerce and unfair or deceptive acts or practices in commerce are hereby declared unlawful.
See 9 V.S.A. § 2453(a).
Primary law
A.5 Act 63 (2025) — Vermont Age-Appropriate Design Code ActPDFThe Age-Appropriate Design Code Act takes effect on January 1, 2027, except its effective-date section and the Attorney General rulemaking authority, which took effect July 1, 2025.
This act shall take effect on January 1, 2027, except that this section (effective dates) and, in Sec. 1, 9 V.S.A. § 2449f(b) and 9 V.S.A. § 2449g(b) (rulemaking authority) shall take effect on July 1, 2025.
See 2025, No. 63 (Act 63), Sec. 2.
Primary law
A.6 FTC Act § 5Section 5 of the FTC Act declares unfair or deceptive acts or practices in or affecting commerce unlawful, reaching deceptive privacy practices nationwide.
Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.
See 15 U.S.C. § 45(a)(1).
Is Vermont about to get a comprehensive consumer privacy law?
Possibly within days — but nothing has changed yet. S.71, the Vermont Data Privacy and Online Surveillance Act, has passed both chambers and would add a new chapter 61A to Title 9 of the Vermont Statutes. If enacted, it would apply to businesses that conduct business in Vermont or target products or services to Vermont residents and that, in the preceding calendar year, controlled or processed the personal data of at least 25,000 consumers, or at least 12,500 consumers while deriving more than 25 percent of gross revenue from selling personal data . As of June 12, 2026, the bill is not law: the official legislative record shows it delivered to the Governor on June 10, 2026, which puts the constitutional deadline to act — five days, Sundays excepted — on or about June 16, 2026. Signature, veto, and inaction are all live outcomes.
The docket context matters because Vermont has been here before: the Governor vetoed the predecessor comprehensive bill, H.121, in June 2024, and this bill reaches the same desk two years later. Some secondary reports describing an early-June 2026 veto of S.71 are inconsistent with the official legislative record, which shows the bill delivered to the Governor on June 10, 2026 with no action recorded as of this writing — so treat any veto claim dated before the delivery date as unreliable and check the official bill-status page before acting on it.
What the bill would do, stated in the subjunctive because none of it is in force: consumers would gain rights to confirm and access their personal data and to know whether their personal data is or will be used in any artificial intelligence system and for what purpose , plus rights to correct, delete, and port data and to opt out of targeted advertising, the sale of personal data, and significant-decision profiling . The bill would also ban using a geofence within 1,850 feet of any health care facility — including mental health and reproductive or sexual health facilities — to identify, track, collect data from, or send notifications to consumers about their health data, a prohibition that would apply without regard to the processing thresholds . Violations would be unfair and deceptive acts under the Consumer Protection Act, with the Attorney General holding exclusive enforcement authority outside one narrow carve-out for suits against data brokers and large data holders . The applicability thresholds would step down on a schedule: the operative provisions would take effect July 1, 2026, a middle threshold (12,500 consumers, or 6,250 plus 20 percent data-sale revenue) on July 1, 2027, and a low threshold (6,250, or 3,125 plus 20 percent) on July 1, 2028 .
Do not build compliance obligations around S.71 unless and until it becomes law — but do scope the work now, because the runway would be extraordinarily short. If the bill is signed or becomes law without signature, its operative section would take effect July 1, 2026, roughly two weeks after the Governor's decision deadline . A business near the 25,000-consumer threshold should already know which systems hold Vermont personal data and how it would honor access, deletion, and opt-out requests.
Sources for this answer
Primary law
B.1 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71 would apply to businesses operating in or targeting Vermont that processed personal data of at least 25,000 consumers, or at least 12,500 consumers with more than 25 percent of gross revenue from data sales, in the preceding calendar year.
Except as provided in subsection (b) of this section, this chapter applies to a person who conducts business in this State or a person who produces products or services that are targeted to residents of this State and that during the preceding calendar year: (1) controlled or processed the personal data of not fewer than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) controlled or processed the personal data of not fewer than 12,500 consumers and derived more than 25 percent of the person’s gross revenue from the sale of personal data.
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2416(a) (passed both chambers; not enacted).
Primary law
B.2 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71 would give consumers rights to confirm and access their personal data and to know whether their personal data is or will be used in any artificial intelligence system and for what purpose.
A consumer shall have the right to: (1) confirm whether a controller is processing the consumer’s personal data and, if a controller is processing the consumer’s personal data, access the personal data; (2) know whether a consumer’s personal data is or will be used in any artificial intelligence system and for what purpose;
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2418(a)(1)–(2) (passed both chambers; not enacted).
Primary law
B.3 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71 would give consumers the right to opt out of processing for targeted advertising, the sale of personal data, and profiling in furtherance of automated decisions with legal or similarly significant effects.
opt out of the processing of personal data for purposes of: (A) targeted advertising; (B) the sale of personal data; or (C) profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning the consumer.
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2418(a)(7) (passed both chambers; not enacted).
Primary law
B.4 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71 would prohibit using a geofence within 1,850 feet of any health care facility to identify, track, collect data from, or send notifications to a consumer regarding the consumer's health data.
use a geofence to establish a virtual boundary that is within 1,850 feet of any health care facility, including any mental health facility or reproductive or sexual health facility, for the purpose of identifying, tracking, collecting data from, or sending any notification to a consumer regarding the consumer’s consumer health data.
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2425(3) (passed both chambers; not enacted).
Primary law
B.5 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFUnder S.71, violations would be unfair and deceptive acts under the Consumer Protection Act, with the Attorney General holding exclusive enforcement authority outside the bill's narrow private-action carve-out.
A person who violates this chapter or rules adopted pursuant to this chapter commits an unfair and deceptive act in commerce in violation of section 2453 of this title, and the Attorney General shall have exclusive authority to enforce such violations except as provided in subsection (d) of this section.
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2424(a) (passed both chambers; not enacted).
Primary law
B.6 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFIf enacted, S.71's operative provisions would take effect July 1, 2026, with applicability-threshold step-downs taking effect July 1, 2027 and July 1, 2028.
(b) Sec. 1 (Vermont Data Privacy and Online Surveillance Act) shall take effect on July 1, 2026. (c) Sec. 3 (Vermont Data Privacy Online Surveillance Act middle applicability threshold) shall take effect on July 1, 2027. (d) Sec. 4 (Vermont Data Privacy Online Surveillance Act low applicability threshold) shall take effect on July 1, 2028.
See S.71 (Vt. 2026), Sec. 5 (passed both chambers; not enacted).
What new rules for kids' online privacy take effect in Vermont on January 1, 2027?
The Vermont Age-Appropriate Design Code Act — Act 63 of 2025, codified at 9 V.S.A. §§ 2449a–2449i — is enacted law, but its duties do not apply until January 1, 2027 . From that date, a covered business — an entity that conducts business in Vermont, earns a majority of its annual revenue from online services, offers products reasonably likely to be accessed by a minor, and controls the processing of consumers' personal data — will owe every covered minor a statutory minimum duty of care: its data use and design choices must not result in reasonably foreseeable emotional distress, reasonably foreseeable compulsive use, or discrimination .
The act's operational core is defaults and prohibitions rather than consent flows. “A covered business shall configure all default privacy settings provided to a covered minor through the online service, product, or feature to the highest level of privacy” — including not displaying a minor's social-media account, posts, or connections to known adult users, disabling search-engine indexing of the minor's profile, and not sending push notifications by default . On the prohibition side, a covered business may not collect, sell, share, or retain a covered minor's personal data beyond what is necessary for the service the minor is actively and knowingly using , and it may not send push notifications to a covered minor between midnight and 6:00 a.m. . The act also requires age-assurance processes to be privacy-protective — collecting only the data strictly necessary for the age determination, deleting it once the user's status is known, and using it for no other purpose — and gives minors a 15-day account-deletion right on social platforms , and a transparency section requires prominent disclosure of algorithmic recommendation systems and their inputs — a duty discussed with the privacy-policy material below.
Two structural points matter for planning. First, the Attorney General must adopt implementing rules — including rules prohibiting design practices that lead to compulsive use and rules establishing age-assurance methods — on or before January 1, 2027, the same day the act takes effect , so the precise contours of covered minor status will firm up only as that rulemaking concludes. Second, enforcement rides the same Consumer Protection Act hook as the rest of Vermont privacy law: a violation of the subchapter or its rules is an unfair and deceptive act in commerce . COPPA continues to apply on its own terms to operators collecting personal information from children under 13 ; the Vermont code layers under-18 design duties on top of that federal floor.
The codified design-code sections already appear in chapter 62 of Title 9 with bracketed effective-date annotations, so statutory research can make the duties look current. They are not: the act takes effect January 1, 2027, and only the Attorney General's rulemaking authority is operative today . Treat 2026 as the build year — audit whether your service is reasonably likely to be accessed by Vermont minors and what your default settings would need to become — rather than the compliance year.
Sources for this answer
Primary law
C.1 Act 63 (2025) — Vermont Age-Appropriate Design Code ActPDFThe Age-Appropriate Design Code Act takes effect January 1, 2027; only the effective-date section and the Attorney General's rulemaking authority took effect July 1, 2025.
This act shall take effect on January 1, 2027, except that this section (effective dates) and, in Sec. 1, 9 V.S.A. § 2449f(b) and 9 V.S.A. § 2449g(b) (rulemaking authority) shall take effect on July 1, 2025.
See 2025, No. 63 (Act 63), Sec. 2.
Primary law
C.2 9 V.S.A. § 2449aA covered business is an entity that conducts business in Vermont, generates a majority of its annual revenue from online services, offers products reasonably likely to be accessed by a minor, and determines the purposes and means of processing consumers' personal data.
“Covered business” means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (A) that conducts business in this State; (B) that generates a majority of its annual revenue from online services; (C) whose online products, services, or features are reasonably likely to be accessed by a minor; (D) that collects consumers’ personal data or has consumers’ personal data collected on its behalf by a processor; and (E) that alone or jointly with others determines the purposes and means of the processing of consumers’ personal data.
See 9 V.S.A. § 2449a(10) (effective Jan. 1, 2027).
Primary law
C.3 9 V.S.A. § 2449cA covered business that processes a covered minor's data owes a minimum duty of care: its data use and design must not result in reasonably foreseeable emotional distress, reasonably foreseeable compulsive use, or discrimination.
A covered business that processes a covered minor’s data in any capacity owes a minimum duty of care to the covered minor. (b) As used in this subchapter, “a minimum duty of care” means the use of the personal data of a covered minor and the design of an online service, product, or feature will not result in: (1) reasonably foreseeable emotional distress as defined in 13 V.S.A. § 1061(2) to a covered minor; (2) reasonably foreseeable compulsive use of the online service, product, or feature by a covered minor; or (3) discrimination against a covered minor based upon race, ethnicity, sex, disability, sexual orientation, gender identity, gender expression, religion, or national origin.
See 9 V.S.A. § 2449c(a)–(b) (effective Jan. 1, 2027).
Primary law
C.4 9 V.S.A. § 2449dA covered business must configure all default privacy settings provided to a covered minor to the highest level of privacy.
A covered business shall configure all default privacy settings provided to a covered minor through the online service, product, or feature to the highest level of privacy, including the following default settings:
See 9 V.S.A. § 2449d(a)(1) (effective Jan. 1, 2027).
Primary law
C.5 9 V.S.A. § 2449fA covered business may not collect, sell, share, or retain a covered minor's personal data beyond what is necessary to provide the service the minor is actively and knowingly engaged with.
A covered business shall not: (1) collect, sell, share, or retain any personal data of a covered minor that is not necessary to provide an online service, product, or feature with which the covered minor is actively and knowingly engaged;
See 9 V.S.A. § 2449f(a)(1) (effective Jan. 1, 2027).
Primary law
C.6 9 V.S.A. § 2449fA covered business may not send push notifications to a covered minor between midnight and 6:00 a.m.
send push notifications to a covered minor between 12:00 midnight and 6:00 a.m.
See 9 V.S.A. § 2449f(a)(5) (effective Jan. 1, 2027).
Primary law
C.7 9 V.S.A. § 2449gDuring age assurance, a covered business may collect only the personal data strictly necessary for the age determination, must delete it (except the age range) once a user's status is determined, and may not use it for any other purpose.
During the process of conducting age assurance, covered businesses and processors shall: (1) only collect personal data of a user that is strictly necessary for age assurance; (2) immediately upon determining whether a user is a covered minor, delete any personal data collected of that user for age assurance, except the determination of the user’s age range; (3) not use any personal data of a user collected for age assurance for any other purpose;
See 9 V.S.A. § 2449g(a)(1)–(3) (effective Jan. 1, 2027).
Primary law
C.8 9 V.S.A. § 2449dA covered business must provide a prominent, accessible, and responsive tool for a covered minor to request that a social-media account be unpublished or deleted, and must honor the request within 15 days.
A covered business shall: (1) provide a prominent, accessible, and responsive tool to allow a covered minor to request the covered minor’s account on a social media platform be unpublished or deleted; and (2) honor that request not later than 15 days after a covered business receives the request.
See 9 V.S.A. § 2449d(b) (effective Jan. 1, 2027).
Primary law
C.9 9 V.S.A. § 2449fThe Attorney General must adopt rules on or before January 1, 2027 prohibiting data processing or design practices that lead to compulsive use or subvert user autonomy, and must review them at least every two years.
The Attorney General shall, on or before January 1, 2027, adopt rules pursuant to this subchapter that prohibit data processing or design practices of a covered business that, in the opinion of the Attorney General, lead to compulsive use or subvert or impair user autonomy, decision making, or choice during the use of an online service, product, or feature of the covered business.
See 9 V.S.A. § 2449f(b).
Primary law
C.10 9 V.S.A. § 2449hA violation of the design-code subchapter or its rules is an unfair and deceptive act in commerce under the Consumer Protection Act.
A covered business or processor that violates this subchapter or rules adopted pursuant to this subchapter commits an unfair and deceptive act in commerce in violation of section 2453 of this title.
See 9 V.S.A. § 2449h(a) (effective Jan. 1, 2027).
Primary law
C.11 COPPACOPPA makes it unlawful for an operator of a child-directed website or online service, or one with actual knowledge it is collecting children's personal information, to collect that information in violation of the FTC's implementing regulations.
It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b).
See 15 U.S.C. § 6502(a)(1).
Does Vermont require your business to post a privacy policy?
No. Vermont has no general privacy-policy mandate — no statute requires an ordinary consumer-facing business to post a privacy policy or fixes what one must say. The duties that exist are scoped: whatever you do publish must be true, because Vermont's Consumer Protection Act tracks FTC Act § 5 deception doctrine by legislative design , and a policy that misstates how you collect, use, share, or secure data is the classic deceptive practice under the federal rule .
Notice obligations in Vermont arise setting by setting rather than from a general mandate. A registered data broker must disclose its opt-out practices and data-collection activities in its annual registry filing, covered in the next section. A breach triggers a prescribed consumer notice, covered below. From January 1, 2027, a covered business under the design code must prominently and clearly provide its privacy information, terms of service, policies, and community standards on its website or application, along with the purpose of each algorithmic recommendation system it uses . And the sectoral federal regimes supply their own notice content where they apply: a financial institution may not share nonpublic personal information with nonaffiliated third parties unless it has given the consumer a GLBA-compliant privacy notice , and a HIPAA covered entity must give individuals adequate notice of the uses and disclosures of their protected health information and of their rights and the entity's duties .
If S.71 becomes law, this picture would change fundamentally: the bill would require every covered controller to provide a reasonably accessible, clear, and meaningful privacy notice listing the categories of personal data processed — including sensitive-data categories — with a clear description of what each category includes , along with processing purposes, third-party sharing, and retention periods and a description of any targeted-advertising, sale, or profiling processing together with the procedure for opting out of it . For now, the practical drafting rule in Vermont is the federal one: build the policy from the regimes that actually apply to you, describe your real practices, and honor what you publish, because consistency between statement and conduct is the enforceable obligation.
Sources for this answer
Primary law
D.1 9 V.S.A. § 2453Vermont courts construing the Consumer Protection Act are directed by the legislature to follow the construction of FTC Act § 5(a)(1) by the FTC and the federal courts.
It is the intent of the Legislature that in construing subsection (a) of this section, the courts of this State will be guided by the construction of similar terms contained in Section 5(a)(1) of the Federal Trade Commission Act as from time to time amended by the Federal Trade Commission and the courts of the United States.
See 9 V.S.A. § 2453(b).
Primary law
D.2 FTC Act § 5Section 5 of the FTC Act declares unfair or deceptive acts or practices unlawful, which reaches a privacy policy that misstates a business's actual data practices.
Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful.
See 15 U.S.C. § 45(a)(1).
Primary law
D.3 9 V.S.A. § 2449eFrom January 1, 2027, a covered business must prominently and clearly post its privacy information, terms, policies, and community standards, plus the purpose of each algorithmic recommendation system it uses.
A covered business shall prominently and clearly provide on their website or mobile application: (1) the covered business’s privacy information, terms of service, policies, and community standards; (2) the purpose of each algorithmic recommendation system in use by the covered business;
See 9 V.S.A. § 2449e(1)–(2) (effective Jan. 1, 2027).
Primary law
D.4 GLBA § 502A financial institution may not disclose nonpublic personal information to a nonaffiliated third party unless it has provided the consumer a notice complying with the GLBA's privacy-notice requirements.
Except as otherwise provided in this subchapter, a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 6803 of this title.
See 15 U.S.C. § 6802(a).
Primary law
D.5 HIPAA Notice of Privacy PracticesA HIPAA covered entity must give individuals adequate notice of the uses and disclosures of their protected health information and of their rights and the entity's legal duties.
an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information
See 45 C.F.R. § 164.520(a)(1).
Primary law
D.6 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71 would require controllers to provide a reasonably accessible, clear, and meaningful privacy notice listing the categories of personal data — including sensitive data — that the controller processes.
A controller shall provide to consumers a reasonably accessible, clear, and meaningful privacy notice that: (A) lists the categories of personal data, including the categories of sensitive data, that the controller processes with a clear description of what data each category includes;
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2419(f)(1)(A) (passed both chambers; not enacted).
Primary law
D.7 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71's privacy notice would also have to describe processing purposes, rights-exercise and appeal methods, the categories of personal data sold or shared with third parties, the categories of those third parties, and retention periods.
(B) describes the controller’s purposes for processing each category of personal data the controller processes in a way that gives consumers a meaningful understanding of how each category of their personal data will be used; (C) describes how a consumer may exercise the consumer’s rights under this chapter, including how a consumer may appeal a controller’s denial of a consumer’s request under section 2418 of this title; (D) lists all categories of personal data, including the categories of sensitive data, that the controller sells or shares with third parties; (E) describes all categories of third parties with which the controller sells or shares personal data at a level of detail that enables the consumer to understand what type of entity each third party is and, to the extent possible, how each third party may process personal data; (F) describes the length of time the controller intends to retain each category of personal data or, if it is not possible to identify the length of time, the criteria used to determine the length of time the controller intends to retain categories of personal data;
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2419(f)(1)(B)–(F) (passed both chambers; not enacted).
Primary law
D.8 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71's privacy notice would have to clearly and conspicuously describe any processing for targeted advertising, sale to third parties, or significant-decision profiling, plus a procedure for opting out of that processing.
provides a clear and conspicuous description of any processing of personal data in which the controller engages for the purposes of targeted advertising, sale of personal data to third parties, or profiling the consumer in furtherance of decisions that produce legal or similarly significant effects concerning the consumer, and a procedure by which the consumer may opt out of this type of processing;
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2419(f)(1)(J) (passed both chambers; not enacted).
Do you have to register as a data broker in Vermont?
Yes, if you meet the definition: a data broker is a business, or unit of a business, that knowingly collects and sells or licenses to third parties the brokered personal information of consumers with whom the business has no direct relationship . A business that qualifies must register with the Vermont Secretary of State annually, on or before January 31 following any year in which it met the definition, pay a $100 registration fee, and file disclosures about its practices . Failing to register carries a civil penalty of $50 per day, capped at $10,000 per year, plus the unpaid fees .
Vermont enacted this regime in 2018, and it remains the state's most distinctive privacy obligation. The registry disclosures cover the broker's contact addresses, its opt-out practices (method, scope, and whether third-party agents may opt out on a consumer's behalf), whether it credentials purchasers, the number of data-broker security breaches it experienced in the prior year, and its practices regarding minors' data . The direct relationship concept does the main scoping work: a business collecting and selling data about its own customers, users, employees, or investors is generally not a data broker as to those people, and the statute carves out activities like operating third-party e-commerce platforms and providing publicly available professional information.
Registration is only half the regime. Every data broker must also develop, implement, and maintain a comprehensive written information security program with administrative, technical, and physical safeguards appropriate to its size, resources, data volume, and the sensitivity of the information — with statutorily enumerated minimum features running from employee training and access controls to encryption of personally identifiable information transmitted over public networks or stored on portable devices. Separately, the law bans everyone (not just brokers) from acquiring brokered personal information through fraudulent means or acquiring or using it to stalk or harass, commit fraud, or engage in unlawful employment or housing discrimination . Violations of the security-program duty and the misuse bans are per se unfair and deceptive acts under the Consumer Protection Act , which puts the Attorney General's full enforcement toolkit behind them.
Sources for this answer
Primary law
E.1 9 V.S.A. § 2430A data broker is a business that knowingly collects and sells or licenses to third parties the brokered personal information of consumers with whom it has no direct relationship.
“Data broker” means a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship.
See 9 V.S.A. § 2430(4)(A).
Primary law
E.2 9 V.S.A. § 2446A data broker must register with the Secretary of State annually by January 31, pay a $100 fee, and disclose its addresses, opt-out practices, and other prescribed information.
Annually, on or before January 31 following a year in which a person meets the definition of data broker as provided in section 2430 of this title, a data broker shall: (1) register with the Secretary of State; (2) pay a registration fee of $100.00; and (3) provide the following information: (A) the name and primary physical, e-mail, and Internet addresses of the data broker;
See 9 V.S.A. § 2446(a).
Primary law
E.3 9 V.S.A. § 2446A data broker that fails to register is liable for a civil penalty of $50 per day capped at $10,000 per year, plus the registration fees it should have paid.
A data broker that fails to register pursuant to subsection (a) of this section is liable to the State for: (1) a civil penalty of $50.00 for each day, not to exceed a total of $10,000.00 for each year, it fails to register pursuant to this section; (2) an amount equal to the fees due under this section during the period it failed to register pursuant to this section; and (3) other penalties imposed by law.
See 9 V.S.A. § 2446(b).
Primary law
E.4 9 V.S.A. § 2447A data broker must develop, implement, and maintain a comprehensive written information security program with administrative, technical, and physical safeguards appropriate to its size, resources, data volume, and confidentiality needs.
A data broker shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to: (A) the size, scope, and type of business of the data broker obligated to safeguard the personally identifiable information under such comprehensive information security program; (B) the amount of resources available to the data broker; (C) the amount of stored data; and (D) the need for security and confidentiality of personally identifiable information.
See 9 V.S.A. § 2447(a)(1).
Primary law
E.5 9 V.S.A. § 2431No person may acquire brokered personal information through fraudulent means or acquire or use it to stalk or harass, commit fraud, or engage in unlawful discrimination.
A person shall not acquire brokered personal information through fraudulent means. (2) A person shall not acquire or use brokered personal information for the purpose of: (A) stalking or harassing another person; (B) committing a fraud, including identity theft, financial fraud, or e-mail fraud; or (C) engaging in unlawful discrimination, including employment discrimination and housing discrimination.
See 9 V.S.A. § 2431(a).
Primary law
E.6 9 V.S.A. § 2447A violation of the data-broker security-program duty is a per se unfair and deceptive act in commerce under the Consumer Protection Act.
A person who violates a provision of this section commits an unfair and deceptive act in commerce in violation of section 2453 of this title.
See 9 V.S.A. § 2447(d)(1).
What must your contracts with vendors say?
Vermont has no omnibus data-processing-agreement requirement — no statute in force prescribes controller-to-processor contract terms, audit rights, deletion clauses, or subprocessor flow-downs for ordinary businesses. The one Vermont statute that mandates vendor contract terms is the data-broker security law: a data broker's information security program must include supervising service providers by taking reasonable steps to select providers capable of maintaining appropriate security and requiring them by contract to implement and maintain security measures for personally identifiable information .
Outside the data-broker context, the binding vendor rules come from the breach statute and the federal overlay. A data collector that maintains or possesses personal information it does not own — a vendor or service provider holding your data — must notify the owner or licensee of any security breach immediately following discovery , so a Vermont-aware services agreement should pin that statutory duty down with a contractual notice window, cooperation duties, and cost allocation. Where a sectoral regime applies, it supplies the contract terms: the GLBA Safeguards Rule requires financial institutions to oversee service providers by contract and to require them to maintain appropriate safeguards , and HIPAA requires a written business-associate agreement with mandatory data-protection, breach-reporting, and subcontractor terms before protected health information changes hands .
If S.71 becomes law, the bill would mandate a full data-processing agreement: processing by a processor would have to be governed by a binding contract setting clear processing instructions, the nature and purpose of processing, data types, limitations, and duration, plus confidentiality duties, deletion-or-return obligations, audit cooperation, and subcontractor flow-downs . Carrying those terms in vendor templates now is low-cost insurance: it satisfies the sectoral regimes that already apply, and nothing would need renegotiating if the comprehensive bill takes effect.
Sources for this answer
Primary law
F.1 9 V.S.A. § 2447A data broker's information security program must include supervising service providers by selecting capable providers and requiring them by contract to implement and maintain appropriate security measures.
supervision of service providers, by: (A) taking reasonable steps to select and retain third-party service providers that are capable of maintaining appropriate security measures to protect personally identifiable information consistent with applicable law; and (B) requiring third-party service providers by contract to implement and maintain appropriate security measures for personally identifiable information;
See 9 V.S.A. § 2447(b)(6).
Primary law
F.2 9 V.S.A. § 2435A data collector that maintains personal information it does not own or license must notify the owner or licensee of any security breach immediately following discovery.
Any data collector that maintains or possesses computerized data containing personally identifiable information or login credentials that the data collector does not own or license or any data collector that acts or conducts business in Vermont that maintains or possesses records or data containing personally identifiable information or login credentials that the data collector does not own or license shall notify the owner or licensee of the information of any security breach immediately following discovery of the breach, consistent with the legitimate needs of law enforcement as provided in subdivisions (3) and (4) of this subsection.
See 9 V.S.A. § 2435(b)(2).
Primary law
F.3 GLBA Safeguards RuleThe GLBA Safeguards Rule requires a financial institution to oversee service providers, including by requiring them by contract to implement and maintain appropriate safeguards for customer information.
Requiring your service providers by contract to implement and maintain such safeguards
See 16 C.F.R. § 314.4(f)(2).
Primary law
F.4 HIPAA Business Associate ContractsHIPAA requires the business-associate contract to establish the permitted uses and disclosures of protected health information and to bind the business associate to use appropriate safeguards, report unauthorized uses and disclosures including breaches, and flow the same restrictions down to subcontractors.
A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity, except that: (A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section; and (B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity. (ii) Provide that the business associate will: (A) Not use or further disclose the information other than as permitted or required by the contract or as required by law; (B) Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract; (C) Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410; (D) In accordance with § 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information;
See 45 C.F.R. § 164.504(e)(2).
Primary law
F.5 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71 would require processing by a processor to be governed by a binding contract setting clear processing instructions, the nature and purpose of processing, data types, limitations, and duration, plus confidentiality, deletion-or-return, compliance-information, subcontractor flow-down, and audit-cooperation terms.
Processing by a processor must be governed by a contract between the controller and the processor. The contract must: (1) be valid and binding on both parties; (2) set forth clear instructions for processing data, the nature and purpose of the processing, the type of data that is subject to processing, limitations, and the duration of the processing; (3) specify the rights and obligations of both parties with respect to the subject matter of the contract; (4) ensure that each person that processes personal data is subject to a duty of confidentiality with respect to the personal data; (5) require the processor to delete the personal data or return the personal data to the controller at the controller’s direction or at the end of the provision of services, unless a law requires the processor to retain the personal data; (6) require the processor to make available to the controller, at the controller’s request, all information the controller needs to verify that the processor has complied with all obligations the processor has under this chapter; (7) require the processor to enter into a subcontract with a person the processor engages to assist with processing personal data on the controller’s behalf and in the subcontract require the subcontractor to meet the processor’s obligations concerning personal data; (8)(A) allow the controller, the controller’s designee, or a qualified and independent person the processor engages, in accordance with an appropriate and accepted control standard, framework, or procedure, to assess the processor’s policies and technical and organizational measures for complying with the processor’s obligations under this chapter; (B) require the processor to cooperate with the assessment; and (C) at the controller’s request, report the results of the assessment to the controller;
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2420(b)(1)–(8) (passed both chambers; not enacted).
What rights do Vermont consumers have over their personal data?
Under current law, Vermont consumers have no general rights to access, delete, correct, or port their personal data, no right to opt out of its sale or use in targeted advertising, and no statute requires businesses to honor universal opt-out preference signals. What Vermonters have instead is a set of scoped protections: no one may acquire brokered personal information through fraudulent means or use it for stalking, fraud, or unlawful discrimination , businesses must safely destroy customer records containing personal information they no longer retain , and the data-broker registry gives consumers visibility — each registered broker must disclose whether and how it permits consumers to opt out of its collection, databases, or sales .
The registry disclosure is worth reading precisely: the statute requires a broker to describe its opt-out method, scope, and third-party-agent policy if it offers one, and to state which activities a consumer may not opt out of — it does not force every broker to offer an opt-out. That transparency-over-rights design is the clearest marker of where Vermont law stands today: the statute compels disclosure about opt-outs, not the opt-out itself.
S.71 would close the gap if it becomes law. The bill would create the standard suite — confirmation, access, correction, deletion (including derived data), and portability — plus a right to know whether personal data is or will be used in any artificial intelligence system and for what purpose , and opt-out rights covering targeted advertising, data sales, and significant-decision profiling . It would also require controllers to let consumers exercise the advertising and sale opt-outs through an opt-out preference signal sent by a platform, technology, or mechanism — the universal-opt-out architecture that current Vermont law lacks. Until the bill's fate is resolved, businesses fielding data-rights requests from Vermont residents are doing so voluntarily or under another state's law, not under a Vermont mandate.
Sources for this answer
Primary law
G.1 9 V.S.A. § 2431No person may acquire or use brokered personal information for stalking or harassment, fraud, or unlawful employment or housing discrimination.
A person shall not acquire or use brokered personal information for the purpose of: (A) stalking or harassing another person; (B) committing a fraud, including identity theft, financial fraud, or e-mail fraud; or (C) engaging in unlawful discrimination, including employment discrimination and housing discrimination.
See 9 V.S.A. § 2431(a)(2).
Primary law
G.2 9 V.S.A. § 2445A business must take all reasonable steps to destroy customer records containing personal information that it no longer retains, by shredding, erasing, or otherwise making the information unreadable.
A business shall take all reasonable steps to destroy or arrange for the destruction of a customer’s records within its custody or control containing personal information that is no longer to be retained by the business by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or indecipherable through any means for the purpose of: (1) ensuring the security and confidentiality of customer personal information;
See 9 V.S.A. § 2445(b).
Primary law
G.3 9 V.S.A. § 2446A data broker's annual registration must disclose whether it permits consumer opt-outs, the method for requesting one, the activities it covers, and whether a third-party agent may exercise it.
if the data broker permits a consumer to opt out of the data broker’s collection of brokered personal information, opt out of its databases, or opt out of certain sales of data: (i) the method for requesting an opt-out; (ii) if the opt-out applies to only certain activities or sales, which ones; and (iii) whether the data broker permits a consumer to authorize a third party to perform the opt-out on the consumer’s behalf;
See 9 V.S.A. § 2446(a)(3)(B).
Primary law
G.4 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71 would give consumers rights to confirm and access their personal data and to know whether it is or will be used in any artificial intelligence system and for what purpose.
A consumer shall have the right to: (1) confirm whether a controller is processing the consumer’s personal data and, if a controller is processing the consumer’s personal data, access the personal data; (2) know whether a consumer’s personal data is or will be used in any artificial intelligence system and for what purpose;
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2418(a)(1)–(2) (passed both chambers; not enacted).
Primary law
G.5 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71 would give consumers the right to opt out of processing for targeted advertising, the sale of personal data, and profiling in furtherance of significant automated decisions.
opt out of the processing of personal data for purposes of: (A) targeted advertising; (B) the sale of personal data; or (C) profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning the consumer.
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2418(a)(7) (passed both chambers; not enacted).
Primary law
G.6 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71 would require controllers to let consumers or authorized agents exercise the sale and targeted-advertising opt-outs through a preference signal sent by a platform, technology, or mechanism.
allow a consumer or authorized agent to send a signal to the controller that indicates the consumer’s preference to opt out of the sale of personal data or targeted advertising pursuant to subdivision 2418(a)(7) of this title by means of a platform, technology, or mechanism that:
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2419(g)(3) (passed both chambers; not enacted).
When must you notify people of a data breach in Vermont?
A data collector that owns or licenses computerized personally identifiable information or login credentials must notify affected consumers after discovering or being notified of a security breach — “Notice of the security breach shall be made in the most expedient time possible and without unreasonable delay, but not later than 45 days after the discovery or notification, consistent with the legitimate needs of the law enforcement agency, as provided in subdivisions (3) and (4) of this subsection, or with any measures necessary to determine the scope of the security breach and restore the reasonable integrity, security, and confidentiality of the data system” . A separate, faster clock runs to the regulator: a preliminary description of the breach must reach the Attorney General — or the Department of Financial Regulation for its licensees — within 14 business days of discovery or of consumer notice, whichever is sooner .
A security breach is the unauthorized acquisition, or reasonable belief of unauthorized acquisition, of electronic data that compromises the security, confidentiality, or integrity of personally identifiable information or login credentials . Personally identifiable information means a consumer's first name or initial and last name combined with unencrypted, unredacted data elements such as a Social Security number, a government identification number, or a financial account number usable without further information — the definition also reaches biometric data, genetic information, and health records. Vermont treats login credentials — a username or email plus a password or security-question answer — as a standalone trigger, with channel rules to match: when a breach involves credentials for an email account, notice must not be sent through that email account .
The notice itself has fixed contents: a clear and conspicuous description of the incident in general terms, the type of information involved, the protective steps taken, a phone number for questions, vigilance advice, and the approximate date of the breach . Direct written, electronic, or telephonic notice is the default; substitute notice — website posting plus statewide and regional media — is available only when the lowest-cost direct method would exceed $10,000 or contact information is lacking . Notice to more than 1,000 consumers at one time also requires notifying the nationwide consumer reporting agencies .
Three escape valves and one hard stop. A breach need not be reported to consumers if the collector establishes that misuse of the information is not reasonably possible — but only if it files that determination, with a detailed explanation, with the Attorney General or the Department of Financial Regulation , and the duty revives if facts later indicate misuse . A HIPAA-regulated collector is deemed compliant for a breach limited to health records if it notifies under the federal breach-notification rule . Certain federally regulated financial institutions follow their interagency guidance instead. The hard stop: any waiver of the breach statute is void and unenforceable as against public policy , so the duty cannot be contracted around.
Sources for this answer
Primary law
H.1 9 V.S.A. § 2435Consumer breach notice must be made in the most expedient time possible and without unreasonable delay, and no later than 45 days after discovery or notification of the breach.
Notice of the security breach shall be made in the most expedient time possible and without unreasonable delay, but not later than 45 days after the discovery or notification, consistent with the legitimate needs of the law enforcement agency, as provided in subdivisions (3) and (4) of this subsection, or with any measures necessary to determine the scope of the security breach and restore the reasonable integrity, security, and confidentiality of the data system.
See 9 V.S.A. § 2435(b)(1).
Primary law
H.2 9 V.S.A. § 2435The data collector must give the Attorney General or the Department of Financial Regulation the breach and discovery dates and a preliminary description within 14 business days of discovery or consumer notice, whichever is sooner.
The data collector shall notify the Attorney General or the Department, as applicable, of the date of the security breach and the date of discovery of the breach and shall provide a preliminary description of the breach within 14 business days, consistent with the legitimate needs of the law enforcement agency as provided in this subdivision (3) and subdivision (4) of this subsection (b), of the data collector’s discovery of the security breach or when the data collector provides notice to consumers pursuant to this section, whichever is sooner.
See 9 V.S.A. § 2435(b)(3)(B)(i).
Primary law
H.3 9 V.S.A. § 2430A security breach is the unauthorized acquisition, or reasonable belief of unauthorized acquisition, of electronic data compromising the security, confidentiality, or integrity of personally identifiable information or login credentials.
“Security breach” means unauthorized acquisition of electronic data, or a reasonable belief of an unauthorized acquisition of electronic data, that compromises the security, confidentiality, or integrity of a consumer’s personally identifiable information or login credentials maintained by a data collector.
See 9 V.S.A. § 2430(13)(A).
Primary law
H.4 9 V.S.A. § 2430Personally identifiable information means a consumer's first name or initial and last name combined with unencrypted, unredacted data elements such as a Social Security number.
“Personally identifiable information” means a consumer’s first name or first initial and last name in combination with one or more of the following digital data elements, when the data elements are not encrypted, redacted, or protected by another method that renders them unreadable or unusable by unauthorized persons: (i) a Social Security number;
See 9 V.S.A. § 2430(10)(A).
Primary law
H.5 9 V.S.A. § 2430Login credentials means a consumer's username or email address combined with a password or security-question answer that together permit access to an online account.
“Login credentials” means a consumer’s user name or e-mail address, in combination with a password or an answer to a security question, that together permit access to an online account.
See 9 V.S.A. § 2430(9).
Primary law
H.6 9 V.S.A. § 2435When a breach is limited to login credentials for an email account, the data collector must not deliver the breach notice through that email account.
If a security breach is limited to an unauthorized acquisition of login credentials for an email account: (A) the data collector shall not provide notice of the security breach through the email account;
See 9 V.S.A. § 2435(d)(4).
Primary law
H.7 9 V.S.A. § 2435The consumer notice must be clear and conspicuous and describe the incident, the information involved, the protective steps taken, a contact number, vigilance advice, and the approximate breach date.
The notice to a consumer required in subdivision (1) of this subsection shall be clear and conspicuous. A notice to a consumer of a security breach involving personally identifiable information shall include a description of each of the following, if known to the data collector: (A) the incident in general terms; (B) the type of personally identifiable information that was subject to the security breach; (C) the general acts of the data collector to protect the personally identifiable information from further security breach; (D) a telephone number, toll-free if available, that the consumer may call for further information and assistance; (E) advice that directs the consumer to remain vigilant by reviewing account statements and monitoring free credit reports; and (F) the approximate date of the security breach.
See 9 V.S.A. § 2435(b)(5).
Primary law
H.8 9 V.S.A. § 2435Substitute notice is available only when the lowest-cost direct method would exceed $10,000 or the data collector lacks sufficient contact information.
Substitute notice, if: (I) the data collector demonstrates that the lowest cost of providing notice to affected consumers pursuant to subdivision (6)(A) of this subsection among written, e-mail, or telephonic notice would exceed $10,000.00; or (II) the data collector does not have sufficient contact information.
See 9 V.S.A. § 2435(b)(6)(B)(i).
Primary law
H.9 9 V.S.A. § 2435Notice to more than 1,000 consumers at one time also requires notifying the nationwide consumer reporting agencies of the timing, distribution, and content of the notice.
In the event a data collector provides notice to more than 1,000 consumers at one time pursuant to this section, the data collector shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. § 1681a(p), of the timing, distribution, and content of the notice.
See 9 V.S.A. § 2435(c).
Primary law
H.10 9 V.S.A. § 2435Consumer notice is excused only if the data collector establishes that misuse is not reasonably possible and files that determination with the Attorney General or the Department of Financial Regulation.
Notice of a security breach pursuant to subsection (b) of this section is not required if the data collector establishes that misuse of personally identifiable information or login credentials is not reasonably possible and the data collector provides notice of the determination that the misuse of the personally identifiable information or login credentials is not reasonably possible pursuant to the requirements of this subsection.
See 9 V.S.A. § 2435(d)(1).
Primary law
H.11 9 V.S.A. § 2435A data collector invoking the no-reasonable-misuse exception must file its determination, with a detailed explanation, with the Vermont Attorney General or the Department of Financial Regulation.
If the data collector establishes that misuse of the personally identifiable information or login credentials is not reasonably possible, the data collector shall provide notice of its determination that misuse of the personally identifiable information or login credentials is not reasonably possible and a detailed explanation for said determination to the Vermont Attorney General or to the Department of Financial Regulation in the event that the data collector is a person or entity licensed or registered with the Department under Title 8 or this title.
See 9 V.S.A. § 2435(d)(1).
Primary law
H.12 9 V.S.A. § 2435If a data collector that withheld notice under the no-reasonable-misuse exception later obtains facts indicating misuse has occurred or is occurring, it must provide the breach notice.
If a data collector established that misuse of personally identifiable information or login credentials was not reasonably possible under subdivision (1) of this subsection, and subsequently obtains facts indicating that misuse of the personally identifiable information or login credentials has occurred or is occurring, the data collector shall provide notice of the security breach pursuant to subsection (b) of this section.
See 9 V.S.A. § 2435(d)(2).
Primary law
H.13 9 V.S.A. § 2435A HIPAA-regulated data collector is deemed compliant with the Vermont breach statute for a health-record-only breach if it notifies affected consumers under the federal breach-notification rule.
A data collector that is subject to the privacy, security, and breach notification rules adopted in 45 C.F.R. Part 164 pursuant to the federal Health Insurance Portability and Accountability Act, P.L. 104-191 (1996) is deemed to be in compliance with this subchapter if: (1) the data collector experiences a security breach that is limited to personally identifiable information specified in 2430(10)(A)(vii); and (2) the data collector provides notice to affected consumers pursuant to the requirements of the breach notification rule in 45 C.F.R. Part 164, Subpart D.
See 9 V.S.A. § 2435(e).
Primary law
H.14 9 V.S.A. § 2435Any waiver of the Security Breach Notice Act is contrary to public policy and void, so the notification duty cannot be contracted around.
Any waiver of the provisions of this subchapter is contrary to public policy and is void and unenforceable.
See 9 V.S.A. § 2435(f).
Can a consumer sue your business in Vermont over privacy?
Not under the privacy statutes directly — but Vermont's Consumer Protection Act keeps a real private door open. The breach statute routes enforcement to public authorities: the Attorney General and State's Attorneys hold sole and full authority to investigate and prosecute breach-statute violations , with the Department of Financial Regulation playing that role for its licensees . The data-broker statutes work the same way, declaring violations to be unfair and deceptive acts under the Consumer Protection Act . But the Act's general private remedy is consumer-facing: any consumer who contracts for goods or services in reliance on a practice prohibited by § 2453, or who sustains damages or injury from one, may sue for equitable relief, damages or the consideration paid, reasonable attorney's fees, and exemplary damages up to three times the consideration .
How those two design choices interact is the open question. Because the privacy statutes make violations per se unfair and deceptive acts, a consumer plaintiff will argue that a data broker's security failure or a deceptive privacy practice slots into the § 2461(b) action; the textual hurdles are the provision's framing around consumers who contract in reliance on a prohibited practice or sustain damages from one — a fit that is natural for a deceptive privacy policy a customer relied on, and harder for a registry violation by a data broker the consumer never dealt with. No Vermont appellate decision appears to have resolved how far § 2461(b) reaches into the privacy statutes, so the practical planning assumption is Attorney General enforcement as the primary exposure with § 2461(b) suits as live secondary risk wherever a consumer transaction and a misrepresentation can be pleaded. The Act also gives the State teeth beyond injunctions: violating the terms of a Consumer Protection Act injunction costs up to $10,000 per violation , and the Attorney General's toolkit includes civil investigations, assurances of discontinuance, and civil actions.
S.71 would make the private-action question explicit rather than interpretive: it would channel all private enforcement into a single narrow lane , letting a consumer harmed by a data broker's or large data holder's violation of specified duties sue in Superior Court for the greater of $5,000 or actual damages — after pre-suit notice to the Attorney General and a frivolousness screen — while barring private actions for everything else in the chapter . The broad private right of action in the 2024 predecessor bill was a stated reason for that bill's veto; the narrowed design is one of the changes this bill made on its way to the Governor's desk.
Sources for this answer
Primary law
I.1 9 V.S.A. § 2435The Attorney General and State's Attorneys have sole and full authority to investigate and enforce breach-statute violations against entities not regulated by the Department of Financial Regulation.
With respect to all data collectors and other entities subject to this subchapter, other than a person or entity licensed or registered with the Department of Financial Regulation under Title 8 or this title, the Attorney General and State’s Attorney shall have sole and full authority to investigate potential violations of this subchapter and to enforce, prosecute, obtain, and impose remedies for a violation of this subchapter or any rules or regulations made pursuant to this chapter as the Attorney General and State’s Attorney have under chapter 63 of this title.
See 9 V.S.A. § 2435(h)(1).
Primary law
I.2 9 V.S.A. § 2435For data collectors licensed or registered with the Department of Financial Regulation, the Department — not the Attorney General — investigates and enforces breach-statute violations.
With respect to a data collector that is a person or entity licensed or registered with the Department of Financial Regulation under Title 8 or this title, the Department of Financial Regulation shall have the full authority to investigate potential violations of this subchapter and to prosecute, obtain, and impose remedies for a violation of this subchapter or any rules or regulations adopted pursuant to this subchapter, as the Department has under Title 8 or this title or any other applicable law or regulation.
See 9 V.S.A. § 2435(h)(2).
Primary law
I.3 9 V.S.A. § 2447A violation of the data-broker security statute is a per se unfair and deceptive act in commerce under § 2453, routing enforcement through the Consumer Protection Act.
A person who violates a provision of this section commits an unfair and deceptive act in commerce in violation of section 2453 of this title. (2) The Attorney General has the same authority to adopt rules to implement the provisions of this chapter and to conduct civil investigations, enter into assurances of discontinuance, and bring civil actions as provided under chapter 63, subchapter 1 of this title.
See 9 V.S.A. § 2447(d).
Primary law
I.4 9 V.S.A. § 2461A consumer who contracts in reliance on, or sustains damages from, a practice prohibited by § 2453 may sue for equitable relief, damages or the consideration given, attorney's fees, and exemplary damages up to three times the consideration.
Any consumer who contracts for goods or services in reliance upon false or fraudulent representations or practices prohibited by section 2453 of this title, or who sustains damages or injury as a result of any false or fraudulent representations or practices prohibited by section 2453 of this title, or prohibited by any rule or regulation made pursuant to section 2453 of this title, may sue for appropriate equitable relief and may sue and recover from the seller, solicitor, or other violator the amount of his or her damages, or the consideration or the value of the consideration given by the consumer, reasonable attorney’s fees, and exemplary damages not exceeding three times the value of the consideration given by the consumer.
See 9 V.S.A. § 2461(b).
Primary law
I.5 9 V.S.A. § 2461Violating the terms of a Consumer Protection Act injunction carries a civil penalty of up to $10,000 per violation, payable to the State.
Any person who violates the terms of an injunction issued under section 2458 of this title shall forfeit and pay to the State a civil penalty of not more than $10,000.00 for each violation.
See 9 V.S.A. § 2461(a).
Primary law
I.7 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71 would allow a consumer harmed by a data broker's or large data holder's violation of specified duties to sue in Superior Court for the greater of $5,000 or actual damages.
Subject to the requirements of subdivisions (3) and (4) of this subsection (d), a consumer who is harmed by a data broker’s or large data holder’s violation of subsection 2419(c) of this title or section 2425 of this title may bring an action under subsection 2461(b) of this title in Superior Court for: (i) the greater of $5,000.00 or actual damages;
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2424(d)(2)(A) (passed both chambers; not enacted).
Primary law
I.6 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFUnder S.71, the private right of action for violations of the chapter would be exclusively as provided in the enforcement section's private-action subsection.
The private right of action available to a consumer for violations of this chapter or rules adopted pursuant to this chapter shall be exclusively as provided under this subsection.
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2424(d)(1) (passed both chambers; not enacted).
Primary law
I.8 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71 would require pre-suit notice to the Attorney General and a demand letter at least 65 days before filing, and would let the Attorney General screen out frivolous claims, barring the consumer's suit on a frivolousness determination.
At least 65 days prior to the filing of any action pursuant to subdivision (2)(A) of this subsection, the consumer shall: (A) only once notify the Attorney General of the alleged harm in a form and manner prescribed by the Attorney General, which, at minimum, shall require the name of the consumer and a reasonable description of the alleged violation and the harm suffered; and (B) mail to the alleged violator a written demand letter that identifies the consumer and reasonably describes the alleged violation and the harm suffered, unless the alleged violator does not maintain a place of business in Vermont or does not keep assets in Vermont. (4) Within 65 days after receiving the notice required by subdivision (3)(A) of this subsection, the Attorney General shall review the alleged harm to determine whether the claim is frivolous or nonfrivolous. (A) If the Attorney General determines that the claim is frivolous, the Attorney General shall notify the consumer in writing, and the consumer is prohibited from proceeding with an action under subsection 2461(b) of this title for the alleged harm.
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2424(d)(3)–(4) (passed both chambers; not enacted).
Primary law
I.9 S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)PDFS.71 would bar private actions for any violation of the chapter other than the specifically permitted data-broker and large-data-holder claims, and against registered controllers earning under $25 million in the prior year.
No action may be taken under subsection 2461(b) of this title: (i) for a violation of any provision of this chapter or rules adopted pursuant to this chapter other than what is specifically permitted in subdivision (A) of this subdivision (2); or (ii) against a controller that is registered in the State and that earned less than $25 million in revenue in the previous calendar year.
See S.71 (Vt. 2026), proposed 9 V.S.A. § 2424(d)(2)(B) (passed both chambers; not enacted).