---------------------------
Title: Vermont VDPOSA Privacy Compliance Checklist
URL: https://usercentrics.com/us/resources/vdposa-checklist/
---------------------------

# Vermont VDPOSA Privacy Compliance Checklist

### At a Glance

- Applies to businesses processing personal data of 35,000+ Vermont consumers, or sensitive data or data sales involving 3,000+ consumers. No revenue threshold.
- Consumer health data protections apply to any business, regardless of scale or thresholds.
- Requires honoring browser- or platform-level opt-out preference signals like GPC.
- Privacy notices must disclose whether personal data is used to train large language models, the second such state law requirement after Connecticut’s.
- Requires both data protection assessments and separate profiling impact assessments for higher-risk processing.
- Enforced solely by the Vermont Attorney General; civil penalties up to USD 10,000 per violation, with a 60-day cure period available only through June 30, 2029.

The Vermont Data Privacy and Online Surveillance Act (VDPOSA) closely follows [Connecticut's CTDPA](https://usercentrics.com/us/knowledge-hub/connecticut-data-privacy-act-ctdpa/), with familiar rights, an opt-out model for most processing, and affirmative consent for sensitive data.

Where it stands apart is with some of the lowest applicability thresholds enacted to date, a mandatory opt-out signal requirement, an AI training disclosure obligation, and consumer health data protections that apply regardless of business size.

**Note:** This is a separate law from Vermont's Age-Appropriate Design Code, which took effect a year earlier with a different scope.

- **2.4M** — websites and apps in 195 countries
- **8.8B** — monthly consents
- **99%+** — customer retention rate
- **4.3/5** — rating on G2

Partners: Canon, Lufthansa Technik, Mitsubishi Electric, Pinterest, PIRELLI TYRE S.p.A., Porsche Financial Services GmbH, Save the Children, Siemens, z – Hello Fresh, z – Ubisoft, zynga

## The Checklist

### 1: Determine If Your Company Must Comply

**The VDPOSA applies if you conducted business in Vermont, or targeted Vermont residents, and met any of the following in the preceding calendar year.**

- Controlled or processed the personal data of 35,000 or more consumers (excluding payment-transaction-only data), or
- Controlled or processed sensitive data of 3,000 or more consumers, or
- Offered for sale the personal data of 3,000 or more consumers

There is no revenue threshold. Consumer health data provisions apply regardless of scale, with no threshold at all.

### 2: Update Your Privacy Notice

**Your notice needs to disclose data categories, processing purposes, third-party sale categories, targeted advertising disclosures, whether data is used to train large language models, a contact mechanism, and the date of last update.**

### 3: Inform Consumers of Their Rights

**Vermont consumers can request access, correction, deletion, portability, opt-out, and a list of third parties their data was sold to.**

They can also challenge legally significant decisions based on profiling and, for housing decisions specifically, request correction and re-evaluation.

### 4: Disclose Whether You Use Personal Data to Train LLMs

**State clearly in your privacy notice whether your business collects, uses, or sells personal data to train large language models.**

Vermont is only the second state to require this disclosure.

### 5: Honor Opt-Out Preference Signals

**Recognize browser- or platform-level opt-out signals for targeted advertising and data sales.**

The signal, such as [GPC](https://usercentrics.com/us/global-privacy-control/), must reflect an affirmative choice with no default enabled, be consumer-friendly, align with other applicable mechanisms where possible, and let you verify Vermont residency.

## Managing privacy compliance across U.S. states?

Usercentrics CMP supports opt-out signals and workflows, consent documentation, and geotargeted configurations across U.S. state privacy laws. Try it free for 14 days.

### 6: Obtain Affirmative Consent for Sensitive Personal Data

**Get affirmative, opt-in consent before processing sensitive personal data**.

Vermont's definition is broad, covering everything from racial or ethnic origin and health data to neural data, financial account credentials, and government-issued ID numbers.

### 7: Apply Enhanced Protections to Consumer Health Data

**These provisions apply regardless of size or thresholds.**

Get consent before selling consumer health data, hold employees who access it to a duty of confidentiality, and don't deploy a geofence within 1,850 feet of a health care, mental health, or reproductive or sexual health facility.

### 8: Restrict Targeted Advertising and Data Sale Involving Minors (13–17)

**Where you have actual knowledge, or willfully disregard, that a consumer is between 13 and 17, restrict targeted advertising and data sale accordingly.**

Vermont's separate Age-Appropriate Design Code also applies to this age group. [COPPA](https://usercentrics.com/us/knowledge-hub/coppa-compliance/) governs consumers under 13.

### 9: Build a Consent Revocation Mechanism

**Revocation must be as easy as the method used to grant consent.**

Stop the relevant processing within 15 days of a revocation request. This is a shorter window than the 45-day standard in many other states.

### 10: Notify Consumers of Material Privacy Notice Changes

**Where a change would result in materially different processing of previously collected data, notify consumers and give them the chance to withdraw consent before that processing occurs.**

### 11: Build Consumer Rights Request Workflows

**Respond to requests within 45 days (one 45-day extension available, with notice), and resolve appeals within 60 days.**

If an appeal is denied, direct the consumer to the Vermont Attorney General.

### 12: Conduct Data Protection Assessments and Profiling Impact Assessments

**Data protection assessments are required for targeted advertising, data sales, higher-risk profiling, and sensitive data processing.**

Profiling impact assessments are a separate, additional requirement covering purpose, risk analysis, mitigation, data categories, and post-deployment monitoring.

### 13: Audit Consent Interfaces for Dark Patterns

**Review consent banners and opt-out flows for manipulative design.**

The VDPOSA explicitly invalidates consent obtained through [dark patterns](https://usercentrics.com/knowledge-hub/dark-patterns-and-how-they-affect-consent/).

Get the full picture in the [Vermont Data Privacy and Online Surveillance Act](https://usercentrics.com/us/knowledge-hub/vermont-data-privacy-online-surveillance-act-vdposa/) overview.

## Download your free PDF version of this checklist.

---

## Footer

### Products
- [Usercentrics Web CMP](https://usercentrics.com/us/website-consent-management/)
- [Usercentrics App CMP](https://usercentrics.com/us/in-app-sdk/)
- [Usercentrics CTV CMP](https://usercentrics.com/us/usercentrics-ctv-cmp/)
- [Usercentrics Privacy Policy Generator](https://usercentrics.com/us/privacy-policy-generator/)
- [Server-side Tagging Solution](https://usercentrics.com/us/server-side-tracking-solution/)
- [Usercentrics Preference Manager](https://usercentrics.com/us/preference-management/)
- [Audience Unlocker](https://usercentrics.com/us/audience-unlocker/)
- [Integrations](https://usercentrics.com/us/integrations/)
- [Web compliance scan](https://usercentrics.com/us/privacy-compliance-scanner/)
- [App compliance scan](https://usercentrics.com/us/app-data-privacy-audit/)
- [ROAS calculator](https://usercentrics.com/roas-calculator/)

### Solutions
- [Data Privacy Regulatory Compliance](https://usercentrics.com/us/data-privacy-regulatory-compliance/)
- [Marketing Performance Optimization](https://usercentrics.com/us/marketing-performance-optimization/)
- [Migration](https://usercentrics.com/us/migration/)
- [Media & Publishing](https://usercentrics.com/us/media-publishing/)
- [Retail & Ecommerce](https://usercentrics.com/us/retail-ecommerce/)
- [Banking, Finance & Insurance](https://usercentrics.com/us/banking-finance-insurance/)
- [Healthcare & Pharmaceuticals](https://usercentrics.com/us/healthcare-pharmaceuticals/)
- [Gaming](https://usercentrics.com/us/gaming/)
- [Education](https://usercentrics.com/us/education/)
- [Automotive](https://usercentrics.com/us/automotive/)
- [Travel & Hospitality](https://usercentrics.com/us/travel/)

### Regulations
- [CCPA (California)](https://usercentrics.com/us/ccpa/)
- [GDPR (EU)](https://usercentrics.com/us/gdpr/)
- [CPRA (California)](https://usercentrics.com/us/cpra)
- [CPA (Colorado)](https://usercentrics.com/us/cpa/)
- [DMA (EU)](https://usercentrics.com/us/digital-markets-act-dma/)
- [FADP (Switzerland)](https://usercentrics.com/us/fadp/)
- [PIPEDA (Canada)](https://usercentrics.com/us/pipeda/)
- [TCF v2.3 (IAB)](https://usercentrics.com/us/cmp-for-publishers/)
- [Google Consent Mode (EU)](https://usercentrics.com/us/usercentrics-cmp-and-google-consent-mode-v2/)
- [Microsoft UET Consent Mode (EU)](https://usercentrics.com/us/usercentrics-cmp-and-microsoft-consent-mode/)
- [View all regulations](https://usercentrics.com/us/regulations-and-frameworks/)

### Resources
- [Blog](https://usercentrics.com/us/knowledge-hub/)
- [Whitepapers](https://usercentrics.com/us/whitepapers/)
- [Checklists](https://usercentrics.com/us/checklists/)
- [Courses](https://courses.usercentrics.com)
- [Customer stories](https://usercentrics.com/us/customer-stories/)
- [Privacy-Led Marketing](https://usercentrics.com/us/privacy-led-marketing/)
- [Events](https://usercentrics.com/us/webinar/)
- [CONSENTED podcast](https://usercentrics.com/us/consented/)
- [Guides](https://usercentrics.com/us/guides/)
- [Release notes](https://releases.usercentrics.com/en)
- [Developer documentation](https://usercentrics.com/docs/)
- [RFI template](https://usercentrics.com/us/resources/usercentrics-rfi-template/)
- [Customer directory](https://usercentrics.com/us/usercentrics-customer-directory/)

### Company
- [About us](https://usercentrics.com/us/about-us/)
- [Press](https://usercentrics.com/us/press/)
- [Our offices](https://usercentrics.com/us/contact/)
- [Trust center](https://trust.usercentrics.com/)
- [Careers](https://usercentrics.com/us/career/)
- [Open positions](https://apply.workable.com/usercentrics/)
- [Diversity and inclusion](https://usercentrics.com/us/dei/)

### Support
- [General support](https://support.usercentrics.com/hc/en-us)
- [Contact sales](https://usercentrics.com/us/book-a-consultation/)
- [Technical support](https://support.usercentrics.com/hc/en-us/requests/new)
- [Billing and account](https://support.usercentrics.com/hc/en-us/categories/12253804608156-Account-and-billing)
- [Suggest a feature](https://support.usercentrics.com/hc/en-us/requests/new?ticket_form_id=10610312381340)
- [Partner login](https://partnerportal.usercentrics.com/)
- [Partner program](https://usercentrics.com/us/partner-program-overview/)
- [Affiliate program](https://usercentrics.com/us/affiliates/)