Privacy law in Vermont

There is no comprehensive consumer privacy law currently in effect in Vermont. H.208, the Vermont Data Privacy and Online Surveillance Act (VDPOSA), was introduced in the 2025 legislative session but has not yet been signed into law. If passed as introduced, it would take effect July 1, 2026 and give Vermont residents meaningful rights over their personal data — including the right to access, correct, delete, and opt out of the sale of their data. Until then, only sector-specific federal and state laws apply to most Vermonters.

What protections do exist in Vermont

Vermont Security Breach Notice Act

Vermont requires businesses and data brokers to notify consumers when their personal information is involved in a security breach. Notification must be made in the most expedient time possible and without unreasonable delay. (9 V.S.A. § 2435)

Vermont Data Broker Law

Vermont requires data brokers — companies that collect and sell personal information about consumers they don't have a direct relationship with — to register annually with the Attorney General and disclose their data collection and sale practices. This is one of the few state laws nationwide specifically targeting data brokers. (9 V.S.A. § 2430 et seq.)

Vermont Consumer Protection Act

Vermont's general consumer protection law prohibits unfair and deceptive acts and practices in commerce. The Attorney General can use this law to take action against businesses that engage in deceptive privacy practices, and consumers have a private right of action in some circumstances. (9 V.S.A. § 2451 et seq.)

Vermont Electronic Surveillance Law

Vermont law restricts the interception of wire, oral, or electronic communications without consent, providing some baseline privacy protections for electronic communications. (13 V.S.A. § 2601 et seq.)

Federal protections that apply to Vermont residents

Even without a comprehensive state privacy law, federal protections still apply to Vermont residents. The FTC Act (Section 5) prohibits unfair or deceptive data practices by most businesses. HIPAA protects your medical records held by health care providers and insurers. COPPA restricts online collection of data from children under 13. The Gramm-Leach-Bliley Act provides some protections for your financial data held by banks and financial institutions.

What’s happening in the Vermont legislature

Several privacy bills have been introduced in Vermont. None has passed into law yet, but they signal where consumer privacy legislation in the state may be heading.

H.208 — Vermont Data Privacy and Online Surveillance Act

H.208 would enact the Vermont Data Privacy and Online Surveillance Act (VDPOSA), creating comprehensive data privacy rights for Vermont residents. It would grant rights to access, correct, delete, and obtain a portable copy of personal data, as well as the right to opt out of targeted advertising, data sales, and automated profiling. Enforcement would be primarily through the Attorney General, with a limited private right of action against data brokers and large data holders. The main provisions would take effect July 1, 2026, with the applicability thresholds phased down through 2028. Status: introduced. Read the bill text.

How Optery helps Vermont residents

Data brokers collect and sell personal information about almost every American adult — home addresses, phone numbers, family relationships, employment history. They do this regardless of whether your state has a comprehensive privacy law. Optery scans over 200 data brokers to find where your information is exposed, then submits removal requests on your behalf and tracks compliance. Our service works for every US resident, not just those in states with strong privacy statutes.

See which data brokers have your information →