What are the Vermont VDPOSA compliance deadlines?

Jan 1, 2028: Vermont Data Privacy and Online Surveillance Act takes effect. Jun 30, 2029: Mandatory 60-day cure period expires.

When does Vermont VDPOSA take effect?

Vermont VDPOSA takes effect on Jan 1, 2028. The next milestone is Jan 1, 2028: Vermont Data Privacy and Online Surveillance Act takes effect.

Who does Vermont VDPOSA apply to?

Persons conducting business in Vermont or targeting Vermont residents that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers (excluding payment-only data), controlled or processed sensitive data of at least 3,000 consumers, or offered for sale personal data of at least 3,000 consumers. Consumer health data provisions apply regardless of thresholds.

What are the penalties under Vermont VDPOSA?

Violations are unfair and deceptive acts under the Vermont Consumer Protection Act (9 V.S.A. ch. 63): civil penalty up to $10,000 per unfair or deceptive act (9 V.S.A. 2458(b)(1)). Mandatory 60-day cure notice, where a cure is possible, from Jan 1, 2028 through June 30, 2029 (Act 145 sec. 3). No private right of action.

Vermont VDPOSA

Enacted Vermont · In force Jan 1, 2028 · next deadline Jan 1, 2028 (in 14 months)

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Takes effectJan 1, 2028 · in 14 months · Source

Vermont Data Privacy and Online Surveillance Act takes effectAll obligations under Act 145 apply (sec. 4).

EnforcementJun 30, 2029 · in 2.7 years · Source

Mandatory 60-day cure period expiresThe AG's duty to issue a cure notice before enforcement ends June 30, 2029 (Act 145 sec. 3).

Summaries for reference, not legal advice. Check the official text.

What it does

New comprehensive privacy law with low applicability thresholds, broad consumer health data provisions that apply to all businesses, an expanded sensitive data definition, profiling and automated-decision transparency, and a disclosure requirement for using personal data to train AI models. Consumers get the usual access, correction, deletion, portability and opt-out rights.

Who it applies to: Persons conducting business in Vermont or targeting Vermont residents that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers (excluding payment-only data), controlled or processed sensitive data of at least 3,000 consumers, or offered for sale personal data of at least 3,000 consumers. Consumer health data provisions apply regardless of thresholds.
Penalties: Violations are unfair and deceptive acts under the Vermont Consumer Protection Act (9 V.S.A. ch. 63): civil penalty up to $10,000 per unfair or deceptive act (9 V.S.A. 2458(b)(1)). Mandatory 60-day cure notice, where a cure is possible, from Jan 1, 2028 through June 30, 2029 (Act 145 sec. 3). No private right of action.
Enforced by: Vermont Attorney General (exclusive)
Official name: Vermont Data Privacy and Online Surveillance Act (S.71, Act 145 of 2026)
Citation: S.71, Act No. 145 (2026)
Topics: Privacy, Health data, AI

Verified 2026-09-22 legislature.vermont.gov legislature.vermont.gov mayerbrown.com hunton.com

Research notes

The act has no penalty amount of its own; the $10,000 figure comes from the Vermont Consumer Protection Act's general civil penalty for unfair or deceptive acts. The AG must report annually by Dec 1 on notices of violation. Sources disagree on whether Vermont is the 23rd or 24th state with a comprehensive privacy law.

EnactedAlabama

Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months

In forceArkansas

Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026

AmendedCalifornia

CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months

In forceCalifornia

California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026

In forceCalifornia

California ADS employment regulationsClarifies that using an automated-decision system in hiring or other employment decisions can violate the Fair Employment and Housing Act if it discriminates on protected traits. Employers must keep automated-decision data and employment records for at least four years. AI assessments that elicit disability information can be unlawful medical inquiries.In effect since Oct 1, 2025

EnactedCalifornia

California AI Auditor RegistryCreates a state registry for AI auditors run by the Government Operations Agency. From 2029 only registered auditors may offer, sell or conduct covered AI audits, and they must show their registration number in advertising. Registered auditors must file information and follow conduct rules.Next: Jan 1, 2027 Act takes effect · in 2 months

AmendedCalifornia

California AI Transparency Act (SB 942)Covered generative AI providers must offer a free AI-content detection tool, give users the option of a visible (manifest) disclosure on AI-generated image, video or audio, and embed a latent, machine-readable provenance disclosure. Licensees must keep those disclosures intact, and providers must revoke a license within 96 hours of learning a licensee disabled them. AB 853 delayed the operative date to August 2, 2026 and extends duties to large online platforms and GenAI hosting platforms from 2027 and to capture-device makers from 2028.Next: Jan 1, 2027 Large online platform and hosting platform duties · in 2 months

In forceCalifornia

California AI autonomous-harm defense banA defendant that developed, modified or used AI cannot argue in a civil case that the AI acted autonomously and so caused the harm on its own. Other defenses such as causation and comparative fault remain.In effect since Jan 1, 2026

Questions about Vermont VDPOSA

What are the Vermont VDPOSA compliance deadlines?: Jan 1, 2028: Vermont Data Privacy and Online Surveillance Act takes effect. Jun 30, 2029: Mandatory 60-day cure period expires.
When does Vermont VDPOSA take effect?: Vermont VDPOSA takes effect on Jan 1, 2028. The next milestone is Jan 1, 2028: Vermont Data Privacy and Online Surveillance Act takes effect.
Who does Vermont VDPOSA apply to?: Persons conducting business in Vermont or targeting Vermont residents that in the preceding calendar year controlled or processed personal data of at least 35,000 consumers (excluding payment-only data), controlled or processed sensitive data of at least 3,000 consumers, or offered for sale personal data of at least 3,000 consumers. Consumer health data provisions apply regardless of thresholds.
What are the penalties under Vermont VDPOSA?: Violations are unfair and deceptive acts under the Vermont Consumer Protection Act (9 V.S.A. ch. 63): civil penalty up to $10,000 per unfair or deceptive act (9 V.S.A. 2458(b)(1)). Mandatory 60-day cure notice, where a cure is possible, from Jan 1, 2028 through June 30, 2029 (Act 145 sec. 3). No private right of action.

Deadlines

What it does

Related