Vermont
Vermont’s data privacy landscape remains in active development, with the state currently lacking a comprehensive privacy law while multiple bills advance through the legislature. The state has experienced significant legislative activity around data privacy protections, including a high-profile gubernatorial veto in 2024 and ongoing efforts to balance consumer protection with business concerns. While Vermont residents currently have limited privacy protections under existing consumer protection laws, proposed legislation would establish some of the strongest privacy rights in the nation, including provisions that go beyond what most other states have enacted.
Privacy Law Status
Comprehensive Privacy Law
Vermont currently does not have a comprehensive data privacy law in effect. The state attempted to pass the Vermont Data Privacy Act (H.121) in 2024, which was approved by the legislature but vetoed by Governor Phil Scott on June 13, 2024[1]. The legislature’s attempt to override the veto failed in the Senate by a narrow margin of 14-15 votes, falling short of the required 20 votes needed[2].
Vermont did successfully enact the Age-Appropriate Design Code (S.69) in 2025, which specifically protects minors under age 18 when using online services. This “Kids Code” takes effect on January 1, 2027, and establishes design standards and data protection requirements for online platforms accessed by children[3].
Legislative Activity
Three comprehensive data privacy bills are currently active in Vermont’s 2025 legislative session. House Bill 208 and Senate Bill 71 both address consumer data privacy and online surveillance, while Senate Bill 93 focuses on general consumer data privacy protections[4][5][6]. These bills are currently in committee review and have not yet reached floor votes.
The proposed legislation draws heavily from Connecticut’s privacy framework but includes more stringent provisions, such as data minimization requirements and broader definitions of sensitive data. A key point of controversy has been the inclusion of a private right of action that would allow consumers to sue companies for certain violations, which business groups have opposed but consumer advocates support[7][8].
Implementation Timeline
The vetoed 2024 legislation would have implemented a tiered approach beginning July 1, 2025, with different thresholds applying to businesses of varying sizes over several years. The proposed timeline would have gradually expanded coverage from large companies processing 25,000+ consumer records to smaller businesses processing 6,250+ records by 2027[9][10].
Current legislative proposals in 2025 have not yet established definitive implementation dates, as the bills remain in committee. The only privacy-related law with a confirmed timeline is the Kids Code, which becomes effective January 1, 2027[3].
Your Rights as a Vermont Resident
Under current Vermont law, residents have limited data privacy protections compared to comprehensive privacy states. However, pending legislation would establish extensive privacy rights if enacted.
- Right to know what data is collected: Proposed laws would require businesses to provide clear information about what personal data they collect, how it’s used, and with whom it’s shared
- Right to delete personal information: You would have the ability to request deletion of your personal data from company databases, with certain exceptions for legitimate business needs
- Right to opt out of data sales: Companies would be prohibited from selling your personal data without explicit consent, with complete bans on selling sensitive data categories
- Right to correct inaccurate data: Businesses would be required to fix incorrect personal information when you request corrections
- Right to non-discrimination: Companies could not penalize you with different prices, services, or treatment for exercising your privacy rights
Currently, these rights exist only in proposed legislation and are not legally enforceable until a comprehensive privacy law is enacted.
Business Requirements
While no comprehensive privacy law is currently in effect, pending legislation would establish significant compliance obligations for businesses operating in Vermont.
- Coverage thresholds: Proposed laws would apply to businesses processing data of 6,250 or more Vermont residents, or smaller businesses that derive significant revenue from data sales
- Transparency obligations: Companies would need to provide clear privacy notices explaining their data collection, use, and sharing practices in plain language
- Consumer request procedures: Businesses would have 45 days to respond to consumer requests for access, deletion, or correction of personal data
- Risk assessments: Companies engaging in high-risk data processing activities would need to conduct and document formal privacy impact assessments
- Security requirements: Organizations would need to implement reasonable data security measures and provide breach notifications to affected individuals
Practical Impact
- Daily life protections: If enacted, Vermont’s privacy laws would limit how companies can track your online activities, use your location data, and share your information with third parties without consent
- Enforcement options: The proposed laws would give the Vermont Attorney General enforcement authority, and potentially allow consumers to sue large data brokers and companies with over 100,000 consumer records for certain violations
- Current limitations: Without comprehensive privacy legislation, Vermont residents must rely on existing consumer protection laws and federal regulations, which provide limited recourse against data misuse
- Sector-specific gaps: Even proposed legislation includes exemptions for certain activities like employment records, journalistic activities, and some government functions
Comparison Context
- Leading privacy states: Vermont’s proposed legislation would be more comprehensive than laws in California, Virginia, and Connecticut, particularly regarding data minimization requirements and restrictions on sensitive data processing
- Unique provisions: Unlike most state privacy laws, Vermont’s proposals include stronger protections for health-related data and broader definitions of what constitutes sensitive personal information
- Private enforcement: Vermont would be among the first states to include a private right of action in comprehensive privacy legislation, allowing consumers to sue companies directly for violations
- Business impact differences: The proposed lower thresholds for business coverage would affect more companies than similar laws in other states, potentially including some smaller Vermont businesses
Action Steps for Residents
- Stay informed: Monitor legislative progress on pending privacy bills through the Vermont Legislature website and contact your representatives to express support or concerns
- Current protections: Use existing tools like browser privacy settings, limit social media sharing, and review privacy policies of services you use regularly
- Advocacy opportunities: Participate in public comment periods when privacy legislation is being considered and contact the Vermont Attorney General’s office to report privacy-related concerns
- Prepare for future rights: Familiarize yourself with privacy rights available in other states to understand what protections you may gain if Vermont passes comprehensive legislation
Official Resources and Contact Information### Vermont Legislature
The Vermont General Assembly is the primary body considering data privacy legislation. You can track bill progress, find your legislators, and access committee schedules through the official legislative website.
Vermont Legislature:
Website: https://legislature.vermont.gov/
Phone: 802-828-2228 or toll-free 1-800-322-5616
Address: 115 State Street, Drawer 33, Montpelier, VT 05602
Governor’s Office
Governor Phil Scott has significant influence over privacy legislation through veto authority and policy positions.
Governor Phil Scott:
Phone: 802-828-3333
Fax: 802-828-3339
TTY: 800-649-6825
Address: 109 State Street, Pavilion, Montpelier, VT 05609
Vermont Attorney General
The Attorney General’s office handles consumer protection issues and would likely enforce privacy laws if enacted. They also advocate for privacy legislation in the legislature.
Attorney General Charity Clark:
Main Office: 802-828-3171
Consumer Assistance Program: 802-656-3183 or toll-free 800-649-2424
TTY: 802-828-3665
Address: 109 State Street, Montpelier, VT 05609-1001
Legislative District Information
Find your specific state representative and senator to contact them about privacy legislation:
Find Your Legislators:
Website: https://legislature.vermont.gov/people/search/2026
Public Comment and Engagement
Vermont legislative committees accept public testimony and written comments on pending bills. Committee schedules and hearing information are available on the legislature website.
Committee Information:
House Commerce and Economic Development Committee (currently reviewing H.208)
Senate Economic Development, Housing and General Affairs Committee (currently reviewing S.93)
Senate Institutions Committee (previously reviewed S.71)
Sources and Citations
Last Updated August 2025. Written with contributions from both human authors and Perplexity AI. If you find incorrect or outdated information let us know at support@optery.com.