Vermont Data Privacy and Online Surveillance Act (S.71, Act 145 of 2026; 9 V.S.A. chapter 61A): profiling opt-out, right to question a profiling result and profiling impact assessments

Summary

Vermont's comprehensive consumer privacy law, enacted as S.71 (Act 145 of 2026) and adding chapter 61A to Title 9. It applies to persons doing business in Vermont or targeting its residents that, in the preceding calendar year, controlled or processed the personal data of at least 35,000 consumers (excluding data handled only to complete a payment), the sensitive data of at least 3,000 consumers, or that sold personal data under further conditions. Consumers may opt out of profiling in furtherance of any automated decision that produces a legal or similarly significant effect, which the act defines as a decision resulting in the provision or denial of financial or lending services, housing, insurance, education, criminal justice, employment or health care. Where such profiling occurred and if feasible, a consumer may question the result, be told the reason for the decision and review the personal data used; for housing decisions the consumer may also correct inaccurate data and have the decision reevaluated. Controllers must document a data protection assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury, and must conduct a separate impact assessment for any profiling used to make decisions with legal or similarly significant effects, covering purpose, risks and mitigation, data inputs and outputs, performance metrics, transparency and post-deployment monitoring. Controllers may not process personal data in violation of state or federal anti-discrimination law, and evidence of proactive anti-bias testing (or its absence) is relevant to such claims. Privacy notices must state whether personal data is collected, used or sold to train large language models. Data subject to Title V of the Gramm-Leach-Bliley Act is excluded, as are chartered banks and credit unions and affiliates principally engaged in financial activities. A violation is a violation of the Vermont Consumer Protection Act, enforced by the Attorney General; there is no private right of action, and a 60-day cure notice applies from January 1, 2028, to June 30, 2029. The act excludes individuals acting in an employment context from the definition of consumer and exempts data about applicants and employees used within that role.

Key dates

1. June 16, 2026Enacted
2. October 16, 2026Checked against sources
3. October 21, 2026Checked against sources
4. January 1, 2028Takes effect

Developments are added when the record is reviewed. Next review: January 15, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. This subchapter shall be known and may be cited as the “Vermont Data Privacy and Online Surveillance Act.”

   Supports: Name of the act

   Sec. 4. EFFECTIVE DATE This act shall take effect on January 1, 2028. Date Governor signed bill: June 16, 2026

   Supports: Signing date and effective date

   controlled or processed the personal data of not fewer than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction

   Supports: Applicability threshold

   that results in the provision or denial by the controller of any financial or lending service, any housing, any insurance, any education enrollment or opportunity, any criminal justice, any employment opportunity, or any health care service

   Supports: Decisions with legal or similarly significant effects include financial and lending services

   (C) profiling in furtherance of any automated decision that produces any legal or similarly significant effect concerning the consumer

   Supports: Profiling opt-out

   and if feasible: (A) question the result of such profiling; (B) be informed of the reason that such profiling resulted in such decision;

   Supports: Right to question a profiling result and be told the reason

   (D) if the profiling decision concerned housing, taking into account the nature of the personal data and the purposes for which such personal data were processed, be allowed to correct any incorrect personal data

   Supports: Correction and reevaluation limited to housing decisions

   the processing of personal data for the purposes of profiling, if the profiling presents a reasonably foreseeable risk of: (A) unfair or deceptive treatment of, or unlawful disparate impact on, a consumer; (B) financial, physical, or reputational injury to a consumer

   Supports: Data protection assessment for risky profiling

   Each controller that engages in any profiling for the purposes of making a decision that produces any legal or similarly significant effect concerning a consumer shall conduct an impact assessment for the profiling.

   Supports: Impact assessment for significant-decision profiling

   (5) any metrics used to evaluate the performance and known limitations of the profiling; (6) a description of any transparency measures taken concerning the profiling

   Supports: Impact assessment contents

   not process personal data in violation of any: (A) law of this State that prohibits unlawful discrimination against consumers and any evidence, or lack of evidence, concerning proactive antibias testing

   Supports: Anti-discrimination duty and relevance of anti-bias testing

   a statement disclosing whether the controller collects, uses, or sells personal data for the purpose of training large language models

   Supports: Privacy notice disclosure on LLM training

   (13) data subject to Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, and regulations adopted to implement that act; (14) a state- or federally chartered bank or credit union, or an affiliate or subsidiary that is principally engaged in financial activities

   Supports: GLBA data and bank and credit union exemptions

   A violation of this subchapter shall be deemed a violation of the Vermont Consumer Protection Act, pursuant to chapter 63 of this title.

   Supports: Enforcement under the Consumer Protection Act

   This subchapter shall not be construed as providing the basis for, or be subject to, a private right of action for violations of this subchapter or any other law.

   Supports: No private right of action

   During the period beginning January 1, 2028, and ending on June 30, 2029, the Attorney General shall, prior to initiating any action for a violation of the Vermont Data Privacy and Online Surveillance Act, issue a notice of violation

   Supports: Cure period

   “Consumer” does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit organization, or government agency

   Supports: employment context excluded from consumer

   in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, consumer health data controller, or third party, to the extent that the data is collected and used within the context of that role

   Supports: applicant and employee data exempt

   Act 145 of 2026 (S.71), as enacted Vermont General Assembly Primary source

2. Senate Message: Signed by Governor June 16, 2026

   Supports: Enactment status and act number (page title)

   Bill Status S.71 (Act 145) Vermont General Assembly Primary source

3. On June 16, 2026, Vermont Governor Phil Scott signed into law Senate Bill S.71 , the Vermont Data Privacy and Online Surveillance Act

   Supports: Signing by the Governor (corroboration)

   Vermont Becomes 23rd State with Comprehensive Consumer Privacy Law Hunton Andrews Kurth (Privacy & Cybersecurity Law Blog) Reporting or analysis