At a Glance
- Applies to businesses processing personal data of 35,000+ Vermont consumers, or sensitive data or data sales involving 3,000+ consumers. No revenue threshold.
- Consumer health data protections apply to any business, regardless of scale or thresholds.
- Requires honoring browser- or platform-level opt-out preference signals like GPC.
- Privacy notices must disclose whether personal data is used to train large language models, the second such state law requirement after Connecticut’s.
- Requires both data protection assessments and separate profiling impact assessments for higher-risk processing.
- Enforced solely by the Vermont Attorney General; civil penalties up to USD 10,000 per violation, with a 60-day cure period available only through June 30, 2029.
The Vermont Data Privacy and Online Surveillance Act (VDPOSA) closely follows Connecticut’s CTDPA, with familiar rights, an opt-out model for most processing, and affirmative consent for sensitive data.
Where it stands apart is with some of the lowest applicability thresholds enacted to date, a mandatory opt-out signal requirement, an AI training disclosure obligation, and consumer health data protections that apply regardless of business size.
Note: This is a separate law from Vermont’s Age-Appropriate Design Code, which took effect a year earlier with a different scope.
The Checklist
1: Determine If Your Company Must Comply
The VDPOSA applies if you conducted business in Vermont, or targeted Vermont residents, and met any of the following in the preceding calendar year.
- Controlled or processed the personal data of 35,000 or more consumers (excluding payment-transaction-only data), or
- Controlled or processed sensitive data of 3,000 or more consumers, or
- Offered for sale the personal data of 3,000 or more consumers
There is no revenue threshold. Consumer health data provisions apply regardless of scale, with no threshold at all.
2: Update Your Privacy Notice
Your notice needs to disclose data categories, processing purposes, third-party sale categories, targeted advertising disclosures, whether data is used to train large language models, a contact mechanism, and the date of last update.
3: Inform Consumers of Their Rights
Vermont consumers can request access, correction, deletion, portability, opt-out, and a list of third parties their data was sold to.
They can also challenge legally significant decisions based on profiling and, for housing decisions specifically, request correction and re-evaluation.
4: Disclose Whether You Use Personal Data to Train LLMs
State clearly in your privacy notice whether your business collects, uses, or sells personal data to train large language models.
Vermont is only the second state to require this disclosure.
5: Honor Opt-Out Preference Signals
Recognize browser- or platform-level opt-out signals for targeted advertising and data sales.
The signal, such as GPC, must reflect an affirmative choice with no default enabled, be consumer-friendly, align with other applicable mechanisms where possible, and let you verify Vermont residency.
6: Obtain Affirmative Consent for Sensitive Personal Data
Get affirmative, opt-in consent before processing sensitive personal data.
Vermont’s definition is broad, covering everything from racial or ethnic origin and health data to neural data, financial account credentials, and government-issued ID numbers.
7: Apply Enhanced Protections to Consumer Health Data
These provisions apply regardless of size or thresholds.
Get consent before selling consumer health data, hold employees who access it to a duty of confidentiality, and don’t deploy a geofence within 1,850 feet of a health care, mental health, or reproductive or sexual health facility.
8: Restrict Targeted Advertising and Data Sale Involving Minors (13–17)
Where you have actual knowledge, or willfully disregard, that a consumer is between 13 and 17, restrict targeted advertising and data sale accordingly.
Vermont’s separate Age-Appropriate Design Code also applies to this age group. COPPA governs consumers under 13.
9: Build a Consent Revocation Mechanism
Revocation must be as easy as the method used to grant consent.
Stop the relevant processing within 15 days of a revocation request. This is a shorter window than the 45-day standard in many other states.
10: Notify Consumers of Material Privacy Notice Changes
Where a change would result in materially different processing of previously collected data, notify consumers and give them the chance to withdraw consent before that processing occurs.
11: Build Consumer Rights Request Workflows
Respond to requests within 45 days (one 45-day extension available, with notice), and resolve appeals within 60 days.
If an appeal is denied, direct the consumer to the Vermont Attorney General.
12: Conduct Data Protection Assessments and Profiling Impact Assessments
Data protection assessments are required for targeted advertising, data sales, higher-risk profiling, and sensitive data processing.
Profiling impact assessments are a separate, additional requirement covering purpose, risk analysis, mitigation, data categories, and post-deployment monitoring.
13: Audit Consent Interfaces for Dark Patterns
Review consent banners and opt-out flows for manipulative design.
The VDPOSA explicitly invalidates consent obtained through dark patterns.
Get the full picture in the Vermont Data Privacy and Online Surveillance Act overview.