---
jurisdiction: "Vermont"
slug: vermont
countryCode: US
snapshotAsOf: "2026-08-17"
lastReviewed: "2026-06-12"
canonicalUrl: https://openagreements.org/practice-guides/privacy/us/vermont
license: CC BY 4.0
stale: false
---

> [!IMPORTANT]
> **Informational only — not legal advice.** This is a snapshot of an OpenAgreements practice guide,
> provided for general information. It is not legal advice, does not create an attorney-client
> relationship, and is not a substitute for a licensed attorney in the relevant jurisdiction.
> Laws change; verify against the canonical version before relying on it.
>
> **Canonical:** https://openagreements.org/practice-guides/privacy/us/vermont · **Snapshot as of:** 2026-08-17 · License: CC BY 4.0 · © openagreements.org

# Vermont Consumer Privacy Law[^about]

Vermont regulates privacy today through breach-notice, data-broker, and consumer-protection statutes; a comprehensive act (S.71) awaits the Governor and an age-appropriate design code takes effect January 1, 2027.


## At a glance

| Question | Vermont |
| --- | --- |
| **Law coverage** | Specific data types only |
| **Summary** | Vermont today is a sectoral-statute state — the Security Breach Notice Act, the data-broker registration law, and the Consumer Protection Act are the operative framework — but that could change within days: S.71, the Vermont Data Privacy and Online Surveillance Act, passed both chambers and was delivered to the Governor on June 10, 2026, with a constitutional deadline to act on or about June 16, 2026, and the enacted Age-Appropriate Design Code takes effect January 1, 2027. |
| **Main law** | Security Breach Notice Act, 9 V.S.A. § 2435, plus the data-broker law, 9 V.S.A. §§ 2446–2447 — Vermont has no comprehensive consumer-privacy act in force; S.71 (comprehensive) is awaiting action by the Governor, and the Age-Appropriate Design Code, 9 V.S.A. §§ 2449a–2449i, takes effect January 1, 2027 |
| **Privacy policy required?** | No Vermont statute requires a general consumer privacy policy today or fixes its contents; notice duties arise only in scoped settings — breach notices, data-broker registry disclosures, and (from January 1, 2027) the design code's transparency duties — with FTC Act § 5 and the Consumer Protection Act policing whatever a business publishes |
| **Who does it cover?** | Breach duties reach any data collector that handles computerized personal information of Vermont residents, with no size threshold; data-broker duties reach businesses that knowingly collect and sell or license data about consumers with whom they have no direct relationship |
| **Can consumers sue?** | Limited path |
| **Privacy policy rule** | Policy required only for specific data |
| **Consent for sensitive data?** | No special rule |
| **Browser opt-out signals?** | Not required |
| **Lawsuit detail** | Not under the privacy statutes themselves, which route enforcement to the Attorney General; but the Consumer Protection Act, 9 V.S.A. § 2461(b), lets a consumer who contracts in reliance on, or sustains damages from, a prohibited practice sue for damages, attorney's fees, and exemplary damages up to three times the consideration |
| **Who enforces it?** | Vermont Attorney General (Department of Financial Regulation for its licensees) |

## Which privacy laws apply to your business in Vermont? {#which-privacy-laws-apply}

**Short answer.** No comprehensive consumer-privacy statute is in force in Vermont today. The operative state framework is sectoral: the Security Breach Notice Act [^q1-breach-act-title] governs breach response, a data-broker law requires registration and an information security program from businesses that knowingly collect and sell or license consumer data they did not get from the consumer directly [^q1-data-broker-def], a student-data subchapter governs operators of online services used primarily for PreK-12 school purposes [^q1-student-operator], and the Consumer Protection Act's ban on unfair or deceptive acts in commerce is the enforcement backbone for all of it [^q1-cpa-udap].

Two queued changes make Vermont unusual right now. First, a comprehensive bill — S.71, the Vermont Data Privacy and Online Surveillance Act — has passed both chambers and, as of June 12, 2026, sits on the Governor's desk awaiting signature, veto, or inaction; it is covered in detail in the next section because none of its duties are law yet. Second, the Vermont Age-Appropriate Design Code Act (Act 63 of 2025) is already enacted and codified at 9 V.S.A. §§ 2449a–2449i, but by its own terms the act does not take effect until January 1, 2027 [^q1-aadc-effective], so its duties for minors' online services belong on a compliance roadmap rather than in a current-obligations checklist.

Until either of those layers arrives, Vermont residents have no general state-law rights to access, delete, correct, or port their personal data, no right to opt out of sale or targeted advertising, and businesses face no state notice-at-collection, consent, data-protection-assessment, or processor-contract duties. The rest of a Vermont-facing privacy program rides the federal overlay: Section 5 of the FTC Act reaches deceptive or unfair privacy practices nationwide [^q1-fed-ftc5], the Gramm-Leach-Bliley Act governs financial institutions, HIPAA governs covered health entities and their business associates, and COPPA governs services directed to children under 13. A program built to that overlay plus the Vermont statutes described below upgrades rather than restarts if S.71 becomes law.

## Is Vermont about to get a comprehensive consumer privacy law? {#pending-comprehensive-law}

**Short answer.** Possibly within days — but nothing has changed yet. S.71, the Vermont Data Privacy and Online Surveillance Act, has passed both chambers and would add a new chapter 61A to Title 9 of the Vermont Statutes. If enacted, it would apply to businesses that conduct business in Vermont or target products or services to Vermont residents and that, in the preceding calendar year, controlled or processed the personal data of at least 25,000 consumers, or at least 12,500 consumers while deriving more than 25 percent of gross revenue from selling personal data [^q2-s71-scope]. As of June 12, 2026, the bill is not law: the official legislative record shows it delivered to the Governor on June 10, 2026, which puts the constitutional deadline to act — five days, Sundays excepted — on or about June 16, 2026. Signature, veto, and inaction are all live outcomes.

The docket context matters because Vermont has been here before: the Governor vetoed the predecessor comprehensive bill, H.121, in June 2024, and this bill reaches the same desk two years later. Some secondary reports describing an early-June 2026 veto of S.71 are inconsistent with the official legislative record, which shows the bill delivered to the Governor on June 10, 2026 with no action recorded as of this writing — so treat any veto claim dated before the delivery date as unreliable and check the official bill-status page before acting on it.

What the bill would do, stated in the subjunctive because none of it is in force: consumers would gain rights to confirm and access their personal data and to know whether their personal data is or will be used in any artificial intelligence system and for what purpose [^q2-s71-rights], plus rights to correct, delete, and port data and to opt out of targeted advertising, the sale of personal data, and significant-decision profiling [^q2-s71-optout]. The bill would also ban using a geofence within 1,850 feet of any health care facility — including mental health and reproductive or sexual health facilities — to identify, track, collect data from, or send notifications to consumers about their health data, a prohibition that would apply without regard to the processing thresholds [^q2-s71-geofence]. Violations would be unfair and deceptive acts under the Consumer Protection Act, with the Attorney General holding exclusive enforcement authority outside one narrow carve-out for suits against data brokers and large data holders [^q2-s71-enforcement]. The applicability thresholds would step down on a schedule: the operative provisions would take effect July 1, 2026, a middle threshold (12,500 consumers, or 6,250 plus 20 percent data-sale revenue) on July 1, 2027, and a low threshold (6,250, or 3,125 plus 20 percent) on July 1, 2028 [^q2-s71-effective].

> [!NOTE]
> **Practice note.**
>
> Do not build compliance obligations around S.71 unless and until it becomes law — but do scope the work now, because the runway would be extraordinarily short. If the bill is signed or becomes law without signature, its operative section would take effect July 1, 2026, roughly two weeks after the Governor's decision deadline [^q2-s71-effective]. A business near the 25,000-consumer threshold should already know which systems hold Vermont personal data and how it would honor access, deletion, and opt-out requests.

## What new rules for kids' online privacy take effect in Vermont on January 1, 2027? {#kids-online-design-code}

**Short answer.** The Vermont Age-Appropriate Design Code Act — Act 63 of 2025, codified at 9 V.S.A. §§ 2449a–2449i — is enacted law, but its duties do not apply until January 1, 2027 [^q3-act-effective]. From that date, a *covered business* — an entity that conducts business in Vermont, earns a majority of its annual revenue from online services, offers products reasonably likely to be accessed by a minor, and controls the processing of consumers' personal data [^q3-covered-business] — will owe every covered minor a statutory *minimum duty of care*: its data use and design choices must not result in reasonably foreseeable emotional distress, reasonably foreseeable compulsive use, or discrimination [^q3-duty-of-care].

The act's operational core is defaults and prohibitions rather than consent flows. "A covered business shall configure all default privacy settings provided to a covered minor through the online service, product, or feature to the highest level of privacy"[^q3-defaults] — including not displaying a minor's social-media account, posts, or connections to known adult users, disabling search-engine indexing of the minor's profile, and not sending push notifications by default [^q3-defaults]. On the prohibition side, a covered business may not collect, sell, share, or retain a covered minor's personal data beyond what is necessary for the service the minor is actively and knowingly using [^q3-prohibited], and it may not send push notifications to a covered minor between midnight and 6:00 a.m. [^q3-push-curfew]. The act also requires age-assurance processes to be privacy-protective — collecting only the data strictly necessary for the age determination, deleting it once the user's status is known, and using it for no other purpose [^q3-age-assurance] — and gives minors a 15-day account-deletion right on social platforms [^q3-deletion-tool], and a transparency section requires prominent disclosure of algorithmic recommendation systems and their inputs — a duty discussed with the privacy-policy material below.

Two structural points matter for planning. First, the Attorney General must adopt implementing rules — including rules prohibiting design practices that lead to compulsive use and rules establishing age-assurance methods — on or before January 1, 2027, the same day the act takes effect [^q3-rulemaking], so the precise contours of *covered minor* status will firm up only as that rulemaking concludes. Second, enforcement rides the same Consumer Protection Act hook as the rest of Vermont privacy law: a violation of the subchapter or its rules is an unfair and deceptive act in commerce [^q3-enforcement]. COPPA continues to apply on its own terms to operators collecting personal information from children under 13 [^q3-fed-coppa]; the Vermont code layers under-18 design duties on top of that federal floor.

> [!NOTE]
> **Practice note.**
>
> The codified design-code sections already appear in chapter 62 of Title 9 with bracketed effective-date annotations, so statutory research can make the duties look current. They are not: the act takes effect January 1, 2027, and only the Attorney General's rulemaking authority is operative today [^q3-act-effective]. Treat 2026 as the build year — audit whether your service is reasonably likely to be accessed by Vermont minors and what your default settings would need to become — rather than the compliance year.

## Does Vermont require your business to post a privacy policy? {#privacy-policy-contents}

**Short answer.** No. Vermont has no general privacy-policy mandate — no statute requires an ordinary consumer-facing business to post a privacy policy or fixes what one must say. The duties that exist are scoped: whatever you do publish must be true, because Vermont's Consumer Protection Act tracks FTC Act § 5 deception doctrine by legislative design [^q4-cpa-ftc-guide], and a policy that misstates how you collect, use, share, or secure data is the classic deceptive practice under the federal rule [^q4-fed-ftc5].

Notice obligations in Vermont arise setting by setting rather than from a general mandate. A registered data broker must disclose its opt-out practices and data-collection activities in its annual registry filing, covered in the next section. A breach triggers a prescribed consumer notice, covered below. From January 1, 2027, a covered business under the design code must prominently and clearly provide its privacy information, terms of service, policies, and community standards on its website or application, along with the purpose of each algorithmic recommendation system it uses [^q4-aadc-transparency]. And the sectoral federal regimes supply their own notice content where they apply: a financial institution may not share nonpublic personal information with nonaffiliated third parties unless it has given the consumer a GLBA-compliant privacy notice [^q4-glba-notice], and a HIPAA covered entity must give individuals adequate notice of the uses and disclosures of their protected health information and of their rights and the entity's duties [^q4-hipaa-notice].

If S.71 becomes law, this picture would change fundamentally: the bill would require every covered controller to provide a reasonably accessible, clear, and meaningful privacy notice listing the categories of personal data processed — including sensitive-data categories — with a clear description of what each category includes [^q4-s71-notice], along with processing purposes, third-party sharing, and retention periods [^q4-s71-notice-elements] and a description of any targeted-advertising, sale, or profiling processing together with the procedure for opting out of it [^q4-s71-notice-optout]. For now, the practical drafting rule in Vermont is the federal one: build the policy from the regimes that actually apply to you, describe your real practices, and honor what you publish, because consistency between statement and conduct is the enforceable obligation.

## Do you have to register as a data broker in Vermont? {#data-broker-registration}

**Short answer.** Yes, if you meet the definition: a *data broker* is a business, or unit of a business, that knowingly collects and sells or licenses to third parties the brokered personal information of consumers with whom the business has no direct relationship [^q5-db-definition]. A business that qualifies must register with the Vermont Secretary of State annually, on or before January 31 following any year in which it met the definition, pay a $100 registration fee, and file disclosures about its practices [^q5-db-registration]. Failing to register carries a civil penalty of $50 per day, capped at $10,000 per year, plus the unpaid fees [^q5-db-penalty].

Vermont enacted this regime in 2018, and it remains the state's most distinctive privacy obligation. The registry disclosures cover the broker's contact addresses, its opt-out practices (method, scope, and whether third-party agents may opt out on a consumer's behalf), whether it credentials purchasers, the number of data-broker security breaches it experienced in the prior year, and its practices regarding minors' data [^q5-db-registration]. The *direct relationship* concept does the main scoping work: a business collecting and selling data about its own customers, users, employees, or investors is generally not a data broker as to those people, and the statute carves out activities like operating third-party e-commerce platforms and providing publicly available professional information.

Registration is only half the regime. Every data broker must also develop, implement, and maintain a comprehensive written information security program with administrative, technical, and physical safeguards appropriate to its size, resources, data volume, and the sensitivity of the information [^q5-db-security] — with statutorily enumerated minimum features running from employee training and access controls to encryption of personally identifiable information transmitted over public networks or stored on portable devices. Separately, the law bans everyone (not just brokers) from acquiring brokered personal information through fraudulent means or acquiring or using it to stalk or harass, commit fraud, or engage in unlawful employment or housing discrimination [^q5-db-misuse]. Violations of the security-program duty and the misuse bans are per se unfair and deceptive acts under the Consumer Protection Act [^q5-db-udap-hook], which puts the Attorney General's full enforcement toolkit behind them.

## What must your contracts with vendors say? {#vendor-contracts}

**Short answer.** Vermont has no omnibus data-processing-agreement requirement — no statute in force prescribes controller-to-processor contract terms, audit rights, deletion clauses, or subprocessor flow-downs for ordinary businesses. The one Vermont statute that mandates vendor contract terms is the data-broker security law: a data broker's information security program must include supervising service providers by taking reasonable steps to select providers capable of maintaining appropriate security and requiring them by contract to implement and maintain security measures for personally identifiable information [^q6-db-service-providers].

Outside the data-broker context, the binding vendor rules come from the breach statute and the federal overlay. A data collector that maintains or possesses personal information it does not own — a vendor or service provider holding your data — must notify the owner or licensee of any security breach immediately following discovery [^q6-breach-vendor-notice], so a Vermont-aware services agreement should pin that statutory duty down with a contractual notice window, cooperation duties, and cost allocation. Where a sectoral regime applies, it supplies the contract terms: the GLBA Safeguards Rule requires financial institutions to oversee service providers by contract and to require them to maintain appropriate safeguards [^q6-glba-safeguards], and HIPAA requires a written business-associate agreement with mandatory data-protection, breach-reporting, and subcontractor terms before protected health information changes hands [^q6-hipaa-baa].

If S.71 becomes law, the bill would mandate a full data-processing agreement: processing by a processor would have to be governed by a binding contract setting clear processing instructions, the nature and purpose of processing, data types, limitations, and duration, plus confidentiality duties, deletion-or-return obligations, audit cooperation, and subcontractor flow-downs [^q6-s71-processor]. Carrying those terms in vendor templates now is low-cost insurance: it satisfies the sectoral regimes that already apply, and nothing would need renegotiating if the comprehensive bill takes effect.

## What rights do Vermont consumers have over their personal data? {#consumer-rights}

**Short answer.** Under current law, Vermont consumers have no general rights to access, delete, correct, or port their personal data, no right to opt out of its sale or use in targeted advertising, and no statute requires businesses to honor universal opt-out preference signals. What Vermonters have instead is a set of scoped protections: no one may acquire brokered personal information through fraudulent means or use it for stalking, fraud, or unlawful discrimination [^q7-misuse-ban], businesses must safely destroy customer records containing personal information they no longer retain [^q7-destruction], and the data-broker registry gives consumers visibility — each registered broker must disclose whether and how it permits consumers to opt out of its collection, databases, or sales [^q7-db-optout-disclosure].

The registry disclosure is worth reading precisely: the statute requires a broker to *describe* its opt-out method, scope, and third-party-agent policy if it offers one, and to state which activities a consumer may not opt out of — it does not force every broker to offer an opt-out. That transparency-over-rights design is the clearest marker of where Vermont law stands today: the statute compels disclosure about opt-outs, not the opt-out itself.

S.71 would close the gap if it becomes law. The bill would create the standard suite — confirmation, access, correction, deletion (including derived data), and portability — plus a right to know whether personal data is or will be used in any artificial intelligence system and for what purpose [^q7-s71-rights], and opt-out rights covering targeted advertising, data sales, and significant-decision profiling [^q7-s71-optout]. It would also require controllers to let consumers exercise the advertising and sale opt-outs through an opt-out preference signal sent by a platform, technology, or mechanism [^q7-s71-signal] — the universal-opt-out architecture that current Vermont law lacks. Until the bill's fate is resolved, businesses fielding data-rights requests from Vermont residents are doing so voluntarily or under another state's law, not under a Vermont mandate.

## When must you notify people of a data breach in Vermont? {#breach-notification}

**Short answer.** A data collector that owns or licenses computerized personally identifiable information or login credentials must notify affected consumers after discovering or being notified of a security breach — "Notice of the security breach shall be made in the most expedient time possible and without unreasonable delay, but not later than 45 days after the discovery or notification, consistent with the legitimate needs of the law enforcement agency, as provided in subdivisions (3) and (4) of this subsection, or with any measures necessary to determine the scope of the security breach and restore the reasonable integrity, security, and confidentiality of the data system"[^q8-breach-duty] [^q8-breach-duty]. A separate, faster clock runs to the regulator: a preliminary description of the breach must reach the Attorney General — or the Department of Financial Regulation for its licensees — within 14 business days of discovery or of consumer notice, whichever is sooner [^q8-ag-notice].

A *security breach* is the unauthorized acquisition, or reasonable belief of unauthorized acquisition, of electronic data that compromises the security, confidentiality, or integrity of personally identifiable information or login credentials [^q8-breach-def]. *Personally identifiable information* means a consumer's first name or initial and last name combined with unencrypted, unredacted data elements such as a Social Security number, a government identification number, or a financial account number usable without further information [^q8-pii-def] — the definition also reaches biometric data, genetic information, and health records. Vermont treats *login credentials* — a username or email plus a password or security-question answer [^q8-login-credentials] — as a standalone trigger, with channel rules to match: when a breach involves credentials for an email account, notice must not be sent through that email account [^q8-email-channel].

The notice itself has fixed contents: a clear and conspicuous description of the incident in general terms, the type of information involved, the protective steps taken, a phone number for questions, vigilance advice, and the approximate date of the breach [^q8-contents]. Direct written, electronic, or telephonic notice is the default; substitute notice — website posting plus statewide and regional media — is available only when the lowest-cost direct method would exceed $10,000 or contact information is lacking [^q8-substitute]. Notice to more than 1,000 consumers at one time also requires notifying the nationwide consumer reporting agencies [^q8-cra].

Three escape valves and one hard stop. A breach need not be reported to consumers if the collector establishes that misuse of the information is not reasonably possible [^q8-risk-harm] — but only if it files that determination, with a detailed explanation, with the Attorney General or the Department of Financial Regulation [^q8-detailed-explanation], and the duty revives if facts later indicate misuse [^q8-revived-duty]. A HIPAA-regulated collector is deemed compliant for a breach limited to health records if it notifies under the federal breach-notification rule [^q8-hipaa-deemed]. Certain federally regulated financial institutions follow their interagency guidance instead. The hard stop: any waiver of the breach statute is void and unenforceable as against public policy [^q8-waiver], so the duty cannot be contracted around.

## Can a consumer sue your business in Vermont over privacy? {#consumer-lawsuit}

**Short answer.** Not under the privacy statutes directly — but Vermont's Consumer Protection Act keeps a real private door open. The breach statute routes enforcement to public authorities: the Attorney General and State's Attorneys hold sole and full authority to investigate and prosecute breach-statute violations [^q9-breach-ag-only], with the Department of Financial Regulation playing that role for its licensees [^q9-dfr]. The data-broker statutes work the same way, declaring violations to be unfair and deceptive acts under the Consumer Protection Act [^q9-udap-hook]. But the Act's general private remedy is consumer-facing: any consumer who contracts for goods or services in reliance on a practice prohibited by § 2453, or who sustains damages or injury from one, may sue for equitable relief, damages or the consideration paid, reasonable attorney's fees, and exemplary damages up to three times the consideration [^q9-cpa-pra].

How those two design choices interact is the open question. Because the privacy statutes make violations per se unfair and deceptive acts, a consumer plaintiff will argue that a data broker's security failure or a deceptive privacy practice slots into the § 2461(b) action; the textual hurdles are the provision's framing around consumers who *contract* in reliance on a prohibited practice or *sustain damages* from one — a fit that is natural for a deceptive privacy policy a customer relied on, and harder for a registry violation by a data broker the consumer never dealt with. No Vermont appellate decision appears to have resolved how far § 2461(b) reaches into the privacy statutes, so the practical planning assumption is Attorney General enforcement as the primary exposure with § 2461(b) suits as live secondary risk wherever a consumer transaction and a misrepresentation can be pleaded. The Act also gives the State teeth beyond injunctions: violating the terms of a Consumer Protection Act injunction costs up to $10,000 per violation [^q9-injunction-penalty], and the Attorney General's toolkit includes civil investigations, assurances of discontinuance, and civil actions.

S.71 would make the private-action question explicit rather than interpretive: it would channel all private enforcement into a single narrow lane [^q9-s71-pra-exclusive], letting a consumer harmed by a *data broker's* or *large data holder's* violation of specified duties sue in Superior Court for the greater of $5,000 or actual damages [^q9-s71-pra] — after pre-suit notice to the Attorney General and a frivolousness screen [^q9-s71-presuit] — while barring private actions for everything else in the chapter [^q9-s71-pra-limits]. The broad private right of action in the 2024 predecessor bill was a stated reason for that bill's veto; the narrowed design is one of the changes this bill made on its way to the Governor's desk.

[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org). Last reviewed 2026-06-12. License: CC BY 4.0. Steven Obiajulu, J.D. is admitted in New York, not Vermont. This article synthesizes Vermont primary law and is not legal advice from a Vermont-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship. CC BY 4.0. Cite as Steven Obiajulu, *Vermont Consumer Privacy Law*, OpenAgreements (last updated June 12, 2026), https://openagreements.org/practice-guides/privacy/us/vermont.

[^q1-breach-act-title]: **9 V.S.A. § 2435** — "This section shall be known as the Security Breach Notice Act." *9 V.S.A. § 2435(a).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q1-data-broker-def]: **9 V.S.A. § 2430** — "‘Data broker’ means a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship." *9 V.S.A. § 2430(4)(A).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q1-student-operator]: **9 V.S.A. § 2443** — "‘Operator’ means, to the extent that an entity is operating in this capacity, the operator of an Internet website, online service, online application, or mobile application with actual knowledge that the site, service, or application is used primarily for PreK-12 school purposes and was designed and marketed for PreK-12 school purposes." *9 V.S.A. § 2443(2).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q1-cpa-udap]: **9 V.S.A. § 2453** — "Unfair methods of competition in commerce and unfair or deceptive acts or practices in commerce are hereby declared unlawful." *9 V.S.A. § 2453(a).* <https://legislature.vermont.gov/statutes/fullchapter/09/063>

[^q1-aadc-effective]: **Act 63 (2025) — Vermont Age-Appropriate Design Code Act** — "This act shall take effect on January 1, 2027, except that this section (effective dates) and, in Sec. 1, 9 V.S.A. § 2449f(b) and 9 V.S.A. § 2449g(b) (rulemaking authority) shall take effect on July 1, 2025." *2025, No. 63 (Act 63), Sec. 2.* <https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT063/ACT063%20As%20Enacted.pdf>

[^q1-fed-ftc5]: **FTC Act § 5** — "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." *15 U.S.C. § 45(a)(1).* <https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.>

[^q2-s71-scope]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "Except as provided in subsection (b) of this section, this chapter applies to a person who conducts business in this State or a person who produces products or services that are targeted to residents of this State and that during the preceding calendar year: (1) controlled or processed the personal data of not fewer than 25,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) controlled or processed the personal data of not fewer than 12,500 consumers and derived more than 25 percent of the person’s gross revenue from the sale of personal data." *S.71 (Vt. 2026), proposed 9 V.S.A. § 2416(a) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q2-s71-rights]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "A consumer shall have the right to: (1) confirm whether a controller is processing the consumer’s personal data and, if a controller is processing the consumer’s personal data, access the personal data; (2) know whether a consumer’s personal data is or will be used in any artificial intelligence system and for what purpose;" *S.71 (Vt. 2026), proposed 9 V.S.A. § 2418(a)(1)–(2) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q2-s71-optout]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "opt out of the processing of personal data for purposes of: (A) targeted advertising; (B) the sale of personal data; or (C) profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning the consumer." *S.71 (Vt. 2026), proposed 9 V.S.A. § 2418(a)(7) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q2-s71-geofence]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "use a geofence to establish a virtual boundary that is within 1,850 feet of any health care facility, including any mental health facility or reproductive or sexual health facility, for the purpose of identifying, tracking, collecting data from, or sending any notification to a consumer regarding the consumer’s consumer health data." *S.71 (Vt. 2026), proposed 9 V.S.A. § 2425(3) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q2-s71-enforcement]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "A person who violates this chapter or rules adopted pursuant to this chapter commits an unfair and deceptive act in commerce in violation of section 2453 of this title, and the Attorney General shall have exclusive authority to enforce such violations except as provided in subsection (d) of this section." *S.71 (Vt. 2026), proposed 9 V.S.A. § 2424(a) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q2-s71-effective]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "(b) Sec. 1 (Vermont Data Privacy and Online Surveillance Act) shall take effect on July 1, 2026. (c) Sec. 3 (Vermont Data Privacy Online Surveillance Act middle applicability threshold) shall take effect on July 1, 2027. (d) Sec. 4 (Vermont Data Privacy Online Surveillance Act low applicability threshold) shall take effect on July 1, 2028." *S.71 (Vt. 2026), Sec. 5 (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q3-act-effective]: **Act 63 (2025) — Vermont Age-Appropriate Design Code Act** — "This act shall take effect on January 1, 2027, except that this section (effective dates) and, in Sec. 1, 9 V.S.A. § 2449f(b) and 9 V.S.A. § 2449g(b) (rulemaking authority) shall take effect on July 1, 2025." *2025, No. 63 (Act 63), Sec. 2.* <https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT063/ACT063%20As%20Enacted.pdf>

[^q3-covered-business]: **9 V.S.A. § 2449a** — "‘Covered business’ means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (A) that conducts business in this State; (B) that generates a majority of its annual revenue from online services; (C) whose online products, services, or features are reasonably likely to be accessed by a minor; (D) that collects consumers’ personal data or has consumers’ personal data collected on its behalf by a processor; and (E) that alone or jointly with others determines the purposes and means of the processing of consumers’ personal data." *9 V.S.A. § 2449a(10) (effective Jan. 1, 2027).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q3-duty-of-care]: **9 V.S.A. § 2449c** — "A covered business that processes a covered minor’s data in any capacity owes a minimum duty of care to the covered minor. (b) As used in this subchapter, ‘a minimum duty of care’ means the use of the personal data of a covered minor and the design of an online service, product, or feature will not result in: (1) reasonably foreseeable emotional distress as defined in 13 V.S.A. § 1061(2) to a covered minor; (2) reasonably foreseeable compulsive use of the online service, product, or feature by a covered minor; or (3) discrimination against a covered minor based upon race, ethnicity, sex, disability, sexual orientation, gender identity, gender expression, religion, or national origin." *9 V.S.A. § 2449c(a)–(b) (effective Jan. 1, 2027).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q3-defaults]: **9 V.S.A. § 2449d** — "A covered business shall configure all default privacy settings provided to a covered minor through the online service, product, or feature to the highest level of privacy, including the following default settings:" *9 V.S.A. § 2449d(a)(1) (effective Jan. 1, 2027).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q3-prohibited]: **9 V.S.A. § 2449f** — "A covered business shall not: (1) collect, sell, share, or retain any personal data of a covered minor that is not necessary to provide an online service, product, or feature with which the covered minor is actively and knowingly engaged;" *9 V.S.A. § 2449f(a)(1) (effective Jan. 1, 2027).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q3-push-curfew]: **9 V.S.A. § 2449f** — "send push notifications to a covered minor between 12:00 midnight and 6:00 a.m." *9 V.S.A. § 2449f(a)(5) (effective Jan. 1, 2027).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q3-age-assurance]: **9 V.S.A. § 2449g** — "During the process of conducting age assurance, covered businesses and processors shall: (1) only collect personal data of a user that is strictly necessary for age assurance; (2) immediately upon determining whether a user is a covered minor, delete any personal data collected of that user for age assurance, except the determination of the user’s age range; (3) not use any personal data of a user collected for age assurance for any other purpose;" *9 V.S.A. § 2449g(a)(1)–(3) (effective Jan. 1, 2027).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q3-deletion-tool]: **9 V.S.A. § 2449d** — "A covered business shall: (1) provide a prominent, accessible, and responsive tool to allow a covered minor to request the covered minor’s account on a social media platform be unpublished or deleted; and (2) honor that request not later than 15 days after a covered business receives the request." *9 V.S.A. § 2449d(b) (effective Jan. 1, 2027).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q3-rulemaking]: **9 V.S.A. § 2449f** — "The Attorney General shall, on or before January 1, 2027, adopt rules pursuant to this subchapter that prohibit data processing or design practices of a covered business that, in the opinion of the Attorney General, lead to compulsive use or subvert or impair user autonomy, decision making, or choice during the use of an online service, product, or feature of the covered business." *9 V.S.A. § 2449f(b).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q3-enforcement]: **9 V.S.A. § 2449h** — "A covered business or processor that violates this subchapter or rules adopted pursuant to this subchapter commits an unfair and deceptive act in commerce in violation of section 2453 of this title." *9 V.S.A. § 2449h(a) (effective Jan. 1, 2027).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q3-fed-coppa]: **COPPA** — "It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b)." *15 U.S.C. § 6502(a)(1).* <https://www.law.cornell.edu/uscode/text/15/6502#:~:text=It%20is%20unlawful%20for%20an,regulations%20prescribed%20under%20subsection%20(b).>

[^q4-cpa-ftc-guide]: **9 V.S.A. § 2453** — "It is the intent of the Legislature that in construing subsection (a) of this section, the courts of this State will be guided by the construction of similar terms contained in Section 5(a)(1) of the Federal Trade Commission Act as from time to time amended by the Federal Trade Commission and the courts of the United States." *9 V.S.A. § 2453(b).* <https://legislature.vermont.gov/statutes/fullchapter/09/063>

[^q4-fed-ftc5]: **FTC Act § 5** — "Unfair methods of competition in or affecting commerce, and unfair or deceptive acts or practices in or affecting commerce, are hereby declared unlawful." *15 U.S.C. § 45(a)(1).* <https://www.law.cornell.edu/uscode/text/15/45#:~:text=Unfair%20methods%20of%20competition%20in,commerce%2C%20are%20hereby%20declared%20unlawful.>

[^q4-aadc-transparency]: **9 V.S.A. § 2449e** — "A covered business shall prominently and clearly provide on their website or mobile application: (1) the covered business’s privacy information, terms of service, policies, and community standards; (2) the purpose of each algorithmic recommendation system in use by the covered business;" *9 V.S.A. § 2449e(1)–(2) (effective Jan. 1, 2027).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q4-glba-notice]: **GLBA § 502** — "Except as otherwise provided in this subchapter, a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 6803 of this title." *15 U.S.C. § 6802(a).* <https://www.law.cornell.edu/uscode/text/15/6802#:~:text=Except%20as%20otherwise%20provided%20in,section%206803%20of%20this%20title.>

[^q4-hipaa-notice]: **HIPAA Notice of Privacy Practices** — "an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information" *45 C.F.R. § 164.520(a)(1).* <https://www.law.cornell.edu/cfr/text/45/164.520#:~:text=an%20individual%20has%20a%20right,respect%20to%20protected%20health%20information>

[^q4-s71-notice]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "A controller shall provide to consumers a reasonably accessible, clear, and meaningful privacy notice that: (A) lists the categories of personal data, including the categories of sensitive data, that the controller processes with a clear description of what data each category includes;" *S.71 (Vt. 2026), proposed 9 V.S.A. § 2419(f)(1)(A) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q4-s71-notice-elements]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "(B) describes the controller’s purposes for processing each category of personal data the controller processes in a way that gives consumers a meaningful understanding of how each category of their personal data will be used; (C) describes how a consumer may exercise the consumer’s rights under this chapter, including how a consumer may appeal a controller’s denial of a consumer’s request under section 2418 of this title; (D) lists all categories of personal data, including the categories of sensitive data, that the controller sells or shares with third parties; (E) describes all categories of third parties with which the controller sells or shares personal data at a level of detail that enables the consumer to understand what type of entity each third party is and, to the extent possible, how each third party may process personal data; (F) describes the length of time the controller intends to retain each category of personal data or, if it is not possible to identify the length of time, the criteria used to determine the length of time the controller intends to retain categories of personal data;" *S.71 (Vt. 2026), proposed 9 V.S.A. § 2419(f)(1)(B)–(F) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q4-s71-notice-optout]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "provides a clear and conspicuous description of any processing of personal data in which the controller engages for the purposes of targeted advertising, sale of personal data to third parties, or profiling the consumer in furtherance of decisions that produce legal or similarly significant effects concerning the consumer, and a procedure by which the consumer may opt out of this type of processing;" *S.71 (Vt. 2026), proposed 9 V.S.A. § 2419(f)(1)(J) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q5-db-definition]: **9 V.S.A. § 2430** — "‘Data broker’ means a business, or unit or units of a business, separately or together, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship." *9 V.S.A. § 2430(4)(A).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q5-db-registration]: **9 V.S.A. § 2446** — "Annually, on or before January 31 following a year in which a person meets the definition of data broker as provided in section 2430 of this title, a data broker shall: (1) register with the Secretary of State; (2) pay a registration fee of $100.00; and (3) provide the following information: (A) the name and primary physical, e-mail, and Internet addresses of the data broker;" *9 V.S.A. § 2446(a).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q5-db-penalty]: **9 V.S.A. § 2446** — "A data broker that fails to register pursuant to subsection (a) of this section is liable to the State for: (1) a civil penalty of $50.00 for each day, not to exceed a total of $10,000.00 for each year, it fails to register pursuant to this section; (2) an amount equal to the fees due under this section during the period it failed to register pursuant to this section; and (3) other penalties imposed by law." *9 V.S.A. § 2446(b).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q5-db-security]: **9 V.S.A. § 2447** — "A data broker shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to: (A) the size, scope, and type of business of the data broker obligated to safeguard the personally identifiable information under such comprehensive information security program; (B) the amount of resources available to the data broker; (C) the amount of stored data; and (D) the need for security and confidentiality of personally identifiable information." *9 V.S.A. § 2447(a)(1).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q5-db-misuse]: **9 V.S.A. § 2431** — "A person shall not acquire brokered personal information through fraudulent means. (2) A person shall not acquire or use brokered personal information for the purpose of: (A) stalking or harassing another person; (B) committing a fraud, including identity theft, financial fraud, or e-mail fraud; or (C) engaging in unlawful discrimination, including employment discrimination and housing discrimination." *9 V.S.A. § 2431(a).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q5-db-udap-hook]: **9 V.S.A. § 2447** — "A person who violates a provision of this section commits an unfair and deceptive act in commerce in violation of section 2453 of this title." *9 V.S.A. § 2447(d)(1).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q6-db-service-providers]: **9 V.S.A. § 2447** — "supervision of service providers, by: (A) taking reasonable steps to select and retain third-party service providers that are capable of maintaining appropriate security measures to protect personally identifiable information consistent with applicable law; and (B) requiring third-party service providers by contract to implement and maintain appropriate security measures for personally identifiable information;" *9 V.S.A. § 2447(b)(6).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q6-breach-vendor-notice]: **9 V.S.A. § 2435** — "Any data collector that maintains or possesses computerized data containing personally identifiable information or login credentials that the data collector does not own or license or any data collector that acts or conducts business in Vermont that maintains or possesses records or data containing personally identifiable information or login credentials that the data collector does not own or license shall notify the owner or licensee of the information of any security breach immediately following discovery of the breach, consistent with the legitimate needs of law enforcement as provided in subdivisions (3) and (4) of this subsection." *9 V.S.A. § 2435(b)(2).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q6-glba-safeguards]: **GLBA Safeguards Rule** — "Requiring your service providers by contract to implement and maintain such safeguards" *16 C.F.R. § 314.4(f)(2).* <https://www.law.cornell.edu/cfr/text/16/314.4#:~:text=Requiring%20your%20service%20providers%20by,implement%20and%20maintain%20such%20safeguards>

[^q6-hipaa-baa]: **HIPAA Business Associate Contracts** — "A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate. The contract may not authorize the business associate to use or further disclose the information in a manner that would violate the requirements of this subpart, if done by the covered entity, except that: (A) The contract may permit the business associate to use and disclose protected health information for the proper management and administration of the business associate, as provided in paragraph (e)(4) of this section; and (B) The contract may permit the business associate to provide data aggregation services relating to the health care operations of the covered entity. (ii) Provide that the business associate will: (A) Not use or further disclose the information other than as permitted or required by the contract or as required by law; (B) Use appropriate safeguards and comply, where applicable, with subpart C of this part with respect to electronic protected health information, to prevent use or disclosure of the information other than as provided for by its contract; (C) Report to the covered entity any use or disclosure of the information not provided for by its contract of which it becomes aware, including breaches of unsecured protected health information as required by § 164.410; (D) In accordance with § 164.502(e)(1)(ii), ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the business associate agree to the same restrictions and conditions that apply to the business associate with respect to such information;" *45 C.F.R. § 164.504(e)(2).* <https://www.law.cornell.edu/cfr/text/45/164.504#:~:text=A%20contract%20between%20the%20covered,with%20respect%20to%20such%20information%3B>

[^q6-s71-processor]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "Processing by a processor must be governed by a contract between the controller and the processor. The contract must: (1) be valid and binding on both parties; (2) set forth clear instructions for processing data, the nature and purpose of the processing, the type of data that is subject to processing, limitations, and the duration of the processing; (3) specify the rights and obligations of both parties with respect to the subject matter of the contract; (4) ensure that each person that processes personal data is subject to a duty of confidentiality with respect to the personal data; (5) require the processor to delete the personal data or return the personal data to the controller at the controller’s direction or at the end of the provision of services, unless a law requires the processor to retain the personal data; (6) require the processor to make available to the controller, at the controller’s request, all information the controller needs to verify that the processor has complied with all obligations the processor has under this chapter; (7) require the processor to enter into a subcontract with a person the processor engages to assist with processing personal data on the controller’s behalf and in the subcontract require the subcontractor to meet the processor’s obligations concerning personal data; (8)(A) allow the controller, the controller’s designee, or a qualified and independent person the processor engages, in accordance with an appropriate and accepted control standard, framework, or procedure, to assess the processor’s policies and technical and organizational measures for complying with the processor’s obligations under this chapter; (B) require the processor to cooperate with the assessment; and (C) at the controller’s request, report the results of the assessment to the controller;" *S.71 (Vt. 2026), proposed 9 V.S.A. § 2420(b)(1)–(8) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q7-misuse-ban]: **9 V.S.A. § 2431** — "A person shall not acquire or use brokered personal information for the purpose of: (A) stalking or harassing another person; (B) committing a fraud, including identity theft, financial fraud, or e-mail fraud; or (C) engaging in unlawful discrimination, including employment discrimination and housing discrimination." *9 V.S.A. § 2431(a)(2).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q7-destruction]: **9 V.S.A. § 2445** — "A business shall take all reasonable steps to destroy or arrange for the destruction of a customer’s records within its custody or control containing personal information that is no longer to be retained by the business by shredding, erasing, or otherwise modifying the personal information in those records to make it unreadable or indecipherable through any means for the purpose of: (1) ensuring the security and confidentiality of customer personal information;" *9 V.S.A. § 2445(b).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q7-db-optout-disclosure]: **9 V.S.A. § 2446** — "if the data broker permits a consumer to opt out of the data broker’s collection of brokered personal information, opt out of its databases, or opt out of certain sales of data: (i) the method for requesting an opt-out; (ii) if the opt-out applies to only certain activities or sales, which ones; and (iii) whether the data broker permits a consumer to authorize a third party to perform the opt-out on the consumer’s behalf;" *9 V.S.A. § 2446(a)(3)(B).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q7-s71-rights]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "A consumer shall have the right to: (1) confirm whether a controller is processing the consumer’s personal data and, if a controller is processing the consumer’s personal data, access the personal data; (2) know whether a consumer’s personal data is or will be used in any artificial intelligence system and for what purpose;" *S.71 (Vt. 2026), proposed 9 V.S.A. § 2418(a)(1)–(2) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q7-s71-optout]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "opt out of the processing of personal data for purposes of: (A) targeted advertising; (B) the sale of personal data; or (C) profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning the consumer." *S.71 (Vt. 2026), proposed 9 V.S.A. § 2418(a)(7) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q7-s71-signal]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "allow a consumer or authorized agent to send a signal to the controller that indicates the consumer’s preference to opt out of the sale of personal data or targeted advertising pursuant to subdivision 2418(a)(7) of this title by means of a platform, technology, or mechanism that:" *S.71 (Vt. 2026), proposed 9 V.S.A. § 2419(g)(3) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q8-breach-duty]: **9 V.S.A. § 2435** — "Notice of the security breach shall be made in the most expedient time possible and without unreasonable delay, but not later than 45 days after the discovery or notification, consistent with the legitimate needs of the law enforcement agency, as provided in subdivisions (3) and (4) of this subsection, or with any measures necessary to determine the scope of the security breach and restore the reasonable integrity, security, and confidentiality of the data system." *9 V.S.A. § 2435(b)(1).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-ag-notice]: **9 V.S.A. § 2435** — "The data collector shall notify the Attorney General or the Department, as applicable, of the date of the security breach and the date of discovery of the breach and shall provide a preliminary description of the breach within 14 business days, consistent with the legitimate needs of the law enforcement agency as provided in this subdivision (3) and subdivision (4) of this subsection (b), of the data collector’s discovery of the security breach or when the data collector provides notice to consumers pursuant to this section, whichever is sooner." *9 V.S.A. § 2435(b)(3)(B)(i).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-breach-def]: **9 V.S.A. § 2430** — "‘Security breach’ means unauthorized acquisition of electronic data, or a reasonable belief of an unauthorized acquisition of electronic data, that compromises the security, confidentiality, or integrity of a consumer’s personally identifiable information or login credentials maintained by a data collector." *9 V.S.A. § 2430(13)(A).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-pii-def]: **9 V.S.A. § 2430** — "‘Personally identifiable information’ means a consumer’s first name or first initial and last name in combination with one or more of the following digital data elements, when the data elements are not encrypted, redacted, or protected by another method that renders them unreadable or unusable by unauthorized persons: (i) a Social Security number;" *9 V.S.A. § 2430(10)(A).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-login-credentials]: **9 V.S.A. § 2430** — "‘Login credentials’ means a consumer’s user name or e-mail address, in combination with a password or an answer to a security question, that together permit access to an online account." *9 V.S.A. § 2430(9).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-email-channel]: **9 V.S.A. § 2435** — "If a security breach is limited to an unauthorized acquisition of login credentials for an email account: (A) the data collector shall not provide notice of the security breach through the email account;" *9 V.S.A. § 2435(d)(4).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-contents]: **9 V.S.A. § 2435** — "The notice to a consumer required in subdivision (1) of this subsection shall be clear and conspicuous. A notice to a consumer of a security breach involving personally identifiable information shall include a description of each of the following, if known to the data collector: (A) the incident in general terms; (B) the type of personally identifiable information that was subject to the security breach; (C) the general acts of the data collector to protect the personally identifiable information from further security breach; (D) a telephone number, toll-free if available, that the consumer may call for further information and assistance; (E) advice that directs the consumer to remain vigilant by reviewing account statements and monitoring free credit reports; and (F) the approximate date of the security breach." *9 V.S.A. § 2435(b)(5).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-substitute]: **9 V.S.A. § 2435** — "Substitute notice, if: (I) the data collector demonstrates that the lowest cost of providing notice to affected consumers pursuant to subdivision (6)(A) of this subsection among written, e-mail, or telephonic notice would exceed $10,000.00; or (II) the data collector does not have sufficient contact information." *9 V.S.A. § 2435(b)(6)(B)(i).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-cra]: **9 V.S.A. § 2435** — "In the event a data collector provides notice to more than 1,000 consumers at one time pursuant to this section, the data collector shall notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nationwide basis, as defined in 15 U.S.C. § 1681a(p), of the timing, distribution, and content of the notice." *9 V.S.A. § 2435(c).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-risk-harm]: **9 V.S.A. § 2435** — "Notice of a security breach pursuant to subsection (b) of this section is not required if the data collector establishes that misuse of personally identifiable information or login credentials is not reasonably possible and the data collector provides notice of the determination that the misuse of the personally identifiable information or login credentials is not reasonably possible pursuant to the requirements of this subsection." *9 V.S.A. § 2435(d)(1).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-detailed-explanation]: **9 V.S.A. § 2435** — "If the data collector establishes that misuse of the personally identifiable information or login credentials is not reasonably possible, the data collector shall provide notice of its determination that misuse of the personally identifiable information or login credentials is not reasonably possible and a detailed explanation for said determination to the Vermont Attorney General or to the Department of Financial Regulation in the event that the data collector is a person or entity licensed or registered with the Department under Title 8 or this title." *9 V.S.A. § 2435(d)(1).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-revived-duty]: **9 V.S.A. § 2435** — "If a data collector established that misuse of personally identifiable information or login credentials was not reasonably possible under subdivision (1) of this subsection, and subsequently obtains facts indicating that misuse of the personally identifiable information or login credentials has occurred or is occurring, the data collector shall provide notice of the security breach pursuant to subsection (b) of this section." *9 V.S.A. § 2435(d)(2).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-hipaa-deemed]: **9 V.S.A. § 2435** — "A data collector that is subject to the privacy, security, and breach notification rules adopted in 45 C.F.R. Part 164 pursuant to the federal Health Insurance Portability and Accountability Act, P.L. 104-191 (1996) is deemed to be in compliance with this subchapter if: (1) the data collector experiences a security breach that is limited to personally identifiable information specified in 2430(10)(A)(vii); and (2) the data collector provides notice to affected consumers pursuant to the requirements of the breach notification rule in 45 C.F.R. Part 164, Subpart D." *9 V.S.A. § 2435(e).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q8-waiver]: **9 V.S.A. § 2435** — "Any waiver of the provisions of this subchapter is contrary to public policy and is void and unenforceable." *9 V.S.A. § 2435(f).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q9-breach-ag-only]: **9 V.S.A. § 2435** — "With respect to all data collectors and other entities subject to this subchapter, other than a person or entity licensed or registered with the Department of Financial Regulation under Title 8 or this title, the Attorney General and State’s Attorney shall have sole and full authority to investigate potential violations of this subchapter and to enforce, prosecute, obtain, and impose remedies for a violation of this subchapter or any rules or regulations made pursuant to this chapter as the Attorney General and State’s Attorney have under chapter 63 of this title." *9 V.S.A. § 2435(h)(1).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q9-dfr]: **9 V.S.A. § 2435** — "With respect to a data collector that is a person or entity licensed or registered with the Department of Financial Regulation under Title 8 or this title, the Department of Financial Regulation shall have the full authority to investigate potential violations of this subchapter and to prosecute, obtain, and impose remedies for a violation of this subchapter or any rules or regulations adopted pursuant to this subchapter, as the Department has under Title 8 or this title or any other applicable law or regulation." *9 V.S.A. § 2435(h)(2).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q9-udap-hook]: **9 V.S.A. § 2447** — "A person who violates a provision of this section commits an unfair and deceptive act in commerce in violation of section 2453 of this title. (2) The Attorney General has the same authority to adopt rules to implement the provisions of this chapter and to conduct civil investigations, enter into assurances of discontinuance, and bring civil actions as provided under chapter 63, subchapter 1 of this title." *9 V.S.A. § 2447(d).* <https://legislature.vermont.gov/statutes/fullchapter/09/062>

[^q9-cpa-pra]: **9 V.S.A. § 2461** — "Any consumer who contracts for goods or services in reliance upon false or fraudulent representations or practices prohibited by section 2453 of this title, or who sustains damages or injury as a result of any false or fraudulent representations or practices prohibited by section 2453 of this title, or prohibited by any rule or regulation made pursuant to section 2453 of this title, may sue for appropriate equitable relief and may sue and recover from the seller, solicitor, or other violator the amount of his or her damages, or the consideration or the value of the consideration given by the consumer, reasonable attorney’s fees, and exemplary damages not exceeding three times the value of the consideration given by the consumer." *9 V.S.A. § 2461(b).* <https://legislature.vermont.gov/statutes/fullchapter/09/063>

[^q9-injunction-penalty]: **9 V.S.A. § 2461** — "Any person who violates the terms of an injunction issued under section 2458 of this title shall forfeit and pay to the State a civil penalty of not more than $10,000.00 for each violation." *9 V.S.A. § 2461(a).* <https://legislature.vermont.gov/statutes/fullchapter/09/063>

[^q9-s71-pra-exclusive]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "The private right of action available to a consumer for violations of this chapter or rules adopted pursuant to this chapter shall be exclusively as provided under this subsection." *S.71 (Vt. 2026), proposed 9 V.S.A. § 2424(d)(1) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q9-s71-pra]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "Subject to the requirements of subdivisions (3) and (4) of this subsection (d), a consumer who is harmed by a data broker’s or large data holder’s violation of subsection 2419(c) of this title or section 2425 of this title may bring an action under subsection 2461(b) of this title in Superior Court for: (i) the greater of $5,000.00 or actual damages;" *S.71 (Vt. 2026), proposed 9 V.S.A. § 2424(d)(2)(A) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q9-s71-presuit]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "At least 65 days prior to the filing of any action pursuant to subdivision (2)(A) of this subsection, the consumer shall: (A) only once notify the Attorney General of the alleged harm in a form and manner prescribed by the Attorney General, which, at minimum, shall require the name of the consumer and a reasonable description of the alleged violation and the harm suffered; and (B) mail to the alleged violator a written demand letter that identifies the consumer and reasonably describes the alleged violation and the harm suffered, unless the alleged violator does not maintain a place of business in Vermont or does not keep assets in Vermont. (4) Within 65 days after receiving the notice required by subdivision (3)(A) of this subsection, the Attorney General shall review the alleged harm to determine whether the claim is frivolous or nonfrivolous. (A) If the Attorney General determines that the claim is frivolous, the Attorney General shall notify the consumer in writing, and the consumer is prohibited from proceeding with an action under subsection 2461(b) of this title for the alleged harm." *S.71 (Vt. 2026), proposed 9 V.S.A. § 2424(d)(3)–(4) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>

[^q9-s71-pra-limits]: **S.71 (2026) — Vermont Data Privacy and Online Surveillance Act (as passed both chambers; not law)** — "No action may be taken under subsection 2461(b) of this title: (i) for a violation of any provision of this chapter or rules adopted pursuant to this chapter other than what is specifically permitted in subdivision (A) of this subdivision (2); or (ii) against a controller that is registered in the State and that earned less than $25 million in revenue in the previous calendar year." *S.71 (Vt. 2026), proposed 9 V.S.A. § 2424(d)(2)(B) (passed both chambers; not enacted).* <https://legislature.vermont.gov/Documents/2026/Docs/BILLS/S-0071/S-0071%20As%20Passed%20by%20Both%20House%20and%20Senate%20Official.pdf>