Cybersecurity Policy Report, Vermont Governor Signs Consumer Data Privacy Bill, (Jun 17, 2026)
Organizations Mentioned:New Hampshire
Vermont Gov. Phil Scott (R.) has signed into law a consumer data privacy bill that will give consumers the right to access, correct, and delete their personal data, as well as opt out of targeted advertising, profiling, and data sales, making Vermont the 23rd state to enact a comprehensive state privacy law. The new law becomes effective Jan. 1, 2028.
Gov. Scott in 2024 vetoed similar legislation intended to enact consumer data privacy protections in Vermont due to the private right of action provision contained in the measure. The governor said certain provisions of that bill would have made Vermont “a national outlier, and more hostile than any other state to many businesses and non-profits.” Instead, he called on the Legislature to draft a bill with provisions similar to the privacy laws adopted by Connecticut and New Hampshire.
Signed by Gov. Scott into law yesterday, the Vermont Data Privacy and Online Surveillance Act largely resembles Connecticut’s state privacy law. The new law “more closely aligns with surrounding states and regional privacy frameworks, creating a more workable path forward for Vermont businesses and organizations navigating increasingly complex state privacy laws,” according to the Vermont Chamber of Commerce. In addition, it does not include a private right of action and gives the state attorney general sole enforcement authority.
Provisions of the new law (SB 71) will apply to businesses that process or control the personal data of at least 35,000 consumers or the sensitive data of at least 3,000 consumers or offer for sale the personal data of at least 3,000 consumers in the preceding year.
The new law limits the data that a business can collect to what is “reasonably necessary and proportionate in relation to the purposes for which the data are processed” and requires controllers to implement reasonable security measures and provide clear privacy notices. It further prohibits the use of subtle dark patterns to manipulate consumers when they make choices regarding their data.
The law includes extra protections for sensitive data such as biometric, health, data collected on minors, and financial data. Such information can’t be sold unless a consumer consents to the sale, and it can’t be collected unless a consumer consents to the collection, according to the new law.
The new law directs the state attorney general to report annually to the legislature on enforcement activities and to provide guidance to businesses. The law also includes a 60-day cure period for violations that expires June 30, 2029.
The bill (S.B. 71, Reg Sess.) was sponsored by Sen. Alison Clarkson (D.) and others.
News: StateLegislation DataPrivacy