Cybersecurity Policy Report, Vermont Legislature Advances Privacy Bill, (May 29, 2026)

By Tony Foley

The Vermont state Senate concurred today in the state House’s proposed amendments to legislation that would make the Green Mountain state the latest to enact a comprehensive privacy and data protection law.

The legislation (S.B. 71, Reg Sess.) would enact the Vermont Data Privacy and Online Surveillance Act, with elements similar to those included in more than 20 state laws over the past several years. Specifically, the bill would give consumers the right to access, correct, and request deletion of their personal data and to opt-out of certain forms of processing, while requiring data controllers to limit data collection to what is reasonably necessary, obtain consent prior to processing sensitive data, impose robust security measures, provide notices of their privacy practices to consumers, and conduct data protection impact assessments under specified circumstances, among other provisions.

The bill, which was introduced in 2025 but fell short in last year’s legislative session, was reintroduced this year, and passed the state Senate in March. The state House approved an amended version of the bill on Tuesday, and the Senate concurred in the House version today. The bill originally contemplated a private right of action for violations by data brokers and large data holders, but the final version stripped this provision out, opting instead to include a statement of intent clarifying that in prohibiting a private right of action, it expects to provide additional appropriations and resources to support enforcement by the state attorney general.

If signed by Gov. Phil Scott (R.), the bill will take effect on Jan. 1, 2028.

News: StateLegislation DataPrivacy DataSecurity