PRIA Logo™
VermontS.712025-2026 SessionSenate

An act relating to consumer data privacy and online surveillance

Sponsored By: Alison Clarkson (Democratic)

Signed by Governor

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

12 provisions identified: 5 benefits, 1 costs, 6 mixed.

Health data gets wider privacy protections

Beginning January 1, 2028, consumer health data rules cover businesses operating in Vermont or targeting Vermont residents, without general consumer-count thresholds. Workers and contractors need a legal or contractual duty to keep health data private, and data processors must meet contract requirements. Selling or offering health data for sale requires the consumer's prior consent. The law bans geofencing within 1,850 feet of health care facilities to identify, track, collect, or send notifications about consumers' health data. This includes mental-health and reproductive-health facilities.

Stronger data safeguards, especially for kids

Beginning January 1, 2028, covered businesses must collect only needed data, keep it secure, and follow anti-discrimination rules. They need consent for sensitive-data processing and sales, and for materially new uses that conflict with the original purpose. Sensitive data include health, race, religion, gender identity, genetic and biometric data, precise location, neural data, and sensitive identifiers. After consent is withdrawn, processing must stop as soon as practical and within 15 days. Businesses that know or deliberately ignore that users are 13 to 17 must not sell their data or use it for targeted ads. Children's sensitive data must follow federal children's privacy rules, and covered businesses must also follow Vermont's design rules for covered minors. Verified parental consent under federal children's privacy law satisfies the matching Vermont consent requirement.

Which Vermont businesses must protect data

Beginning January 1, 2028, general privacy rules cover businesses operating in Vermont or targeting Vermont residents. A business must meet at least one data threshold in the prior calendar year. The thresholds are personal data for 35,000 consumers, sensitive data for 3,000, or data offered for sale for 3,000. Data used only to complete a payment do not count.

Vermonters gain data rights with limits

Beginning January 1, 2028, covered Vermont consumers can check, access, correct, delete, and get portable copies of personal data. Access includes inferences and profiling results; consumers can request a list of third parties that bought their data. Consumers can opt out of targeted ads, data sales subject to a legal exception, and profiling with major legal or similar effects. When feasible, they can challenge major automated decisions, learn the reasons, and review the data used. Housing decisions have added correction and feasible reevaluation rights. Access does not require revealing trade secrets or information whose disclosure the law prohibits. Replies must describe collected sensitive details, not reveal Social Security, government ID, financial account, health ID, password, security-answer, or biometric data.

Businesses must explain data use changes

Beginning January 1, 2028, covered businesses must give clear, accessible notices explaining data collection, uses, privacy rights, and contact options. Notices must describe data sales, targeted ads, and large-language-model training practices, and show the latest update's month and year. Businesses must post notices on their websites or app pages or settings, or use their regular communication channel without a website. Notices must use every language offered with the service. Major changes affecting previously collected data require notice and a reasonable chance to withdraw consent for materially different future handling.

Businesses must oversee risky data handling

Beginning January 1, 2028, data-handling contractors must follow business instructions and help with privacy requests, security, breach notices, and assessments. Contracts must set scope, duration, confidentiality, data return or deletion, compliance access, and subcontractor duties; businesses can object to subcontractors. Contractors that decide processing purposes and methods take on the duties of businesses controlling that data. Businesses must assess risky uses such as targeted ads, data sales, sensitive data, and potentially harmful profiling. Major automated decisions need added impact reviews covering purpose, data, performance, transparency, and ongoing oversight. Assessments weigh benefits, risks, and safeguards; comparable operations can share an assessment, and similar reviews under other laws can qualify. Assessment duties cover processing created or generated on or after January 1, 2028; reviews remain confidential but available to Attorney General investigators.

Some records fall outside privacy protections

Beginning January 1, 2028, the law excludes government entities doing their normal work and specified health entities and records. Health exclusions include listed providers and business associates covered by federal health privacy rules. Listed research, patient-safety, credit, financial, education, insurance, victim-services, and media records or activities are also excluded. The law also excludes specified employment, emergency-contact, and benefits-administration data. Each exclusion covers only its listed entities, records, or activities; federal or state legal requirements apply where specified.

Allowed data uses still need safeguards

Beginning January 1, 2028, exceptions allow data uses for legal duties, government inquiries, law enforcement, claims, requested services, contracts, safety, and security. They also allow specified product development, repairs, recalls, error fixes, compatible operations, research, public health, and bias checks. Research needs independent oversight; public-health work needs safeguards and a responsible professional bound to confidentiality. Bias checks need security and safeguards, with data deleted afterward. Businesses claiming exceptions must prove they apply, limit data use to what is needed, and protect it. The law preserves legal privileges and speech rights, excludes household use, and lets private schools reject deletion or opt-outs that unreasonably disrupt education or operations. Lawful data sharers without actual knowledge of a recipient's planned violation are not liable solely for that violation; recipients are not liable for the sharer's violations.

Easier privacy choices, different loyalty prices

Beginning January 1, 2028, covered businesses must offer secure privacy-request tools without requiring a new account. They must provide an opt-out link for targeted ads or data sales and accept qualifying privacy signals. Signals must show a clear, freely chosen request and allow checks of Vermont residency and legitimacy. Businesses must honor signals over conflicting settings or loyalty-program choices, but can ask consumers to confirm their choice. Real, voluntary loyalty, rewards, discount, premium-feature, and club-card programs can offer different prices, quality, or selections, including free items.

Privacy enforcement includes temporary fix period

Beginning January 1, 2028, the Vermont Attorney General enforces privacy violations under the state Consumer Protection Act. The law does not create a right for individuals to sue. From January 1, 2028 through June 30, 2029, fixable violations require notice before an enforcement action. The alleged violator gets 60 days after receiving notice to fix the violation. The Attorney General can bring an action if it remains unfixed.

Privacy requests get deadlines and appeals

Beginning January 1, 2028, covered businesses must answer privacy requests within 45 days, without needless delay. One extension of up to 45 days is allowed for complexity or request volume, with reasons given during the initial period. Information is free once every 12 months; businesses must justify fees or refusals for clearly baseless, excessive, or repetitive requests. Identity checks apply to access, correction, deletion, and copy requests; opt-out denials require a documented, reasonable fraud concern and notice. Special deletion options apply to data obtained from other sources. Consumers can appeal refusals through an easy-to-find process and must receive a written decision with reasons within 60 days. A denied appeal must include a way to complain to the Vermont Attorney General, online when available.

Unlinked data gets safeguards, fewer rights

Beginning January 1, 2028, businesses holding deidentified data must prevent links to people and publicly promise not to identify them. They must bind recipients to privacy duties, monitor shared deidentified or coded data, and address violations. Businesses need not identify people again or keep extra data solely to match privacy requests. They can decline unmatched or unreasonably burdensome requests only without identifying or linking the consumer, or selling or voluntarily sharing the data, subject to the law's exception. Some rights also do not cover coded data when identifying details are separate and safeguards prevent the business from accessing them.

Sponsors & Cosponsors

Sponsor

  • Alison Clarkson

    Democratic • Senate

Cosponsors

  • Joseph "Joe" D Major

    Democratic • Senate

  • Nader A Hashim

    Democratic • Senate

  • Rebecca "Becca" E White

    Democratic • Senate

  • Tanya C Vyhovsky

    Democrat/Progressive • Senate

  • Wendy K Harrison

    Democratic • Senate

Roll Call Votes

All Roll Calls

Yes: 158 • No: 3

House vote • 5/26/2026

Which was agreed to on a Roll Call Passed -- Needed 66 of 132 to Pass -- Yeas = 129, Nays = 3

Yes: 129 • No: 3 • Other: 1

Senate vote • 3/26/2025

Recommendation of amendment by Committee on Institutions agreed to on roll call, requested by Senator Beck, Passed -- Needed 15 of 29 to Pass -- Yeas = 29, Nays = 0

Yes: 29 • No: 0

Actions Timeline

  1. Senate Message: Signed by Governor June 16, 2026

    5/29/2026Senate

  2. Signed by Governor on June 16, 2026

    5/29/2026Senate

  3. Delivered to Governor on June 10, 2026

    5/29/2026Senate

  4. Senate Message: House proposal of amendment concurred in

    5/29/2026Senate

  5. Rules suspended & messaged to House forthwith, on motion of Senator Lyons

    5/29/2026Senate

  6. As passed by Senate and House

    5/29/2026Senate

  7. House proposal of amendment concurred in

    5/29/2026Senate

  8. House proposal of amendment; text

    5/29/2026Senate

  9. House proposal of amendment

    5/29/2026Senate

  10. House proposal of amendment

    5/28/2026Senate

  11. Entered on Notice Calendar

    5/28/2026Senate

  12. House message: House passed bill in concurrence with proposal(s) of amendment

    5/27/2026House

  13. Rules suspended and bill messaged forthwith to the Senate as moved by Rep. McCoy of Poultney

    5/26/2026House

  14. Read third time and passed in concurrence with proposal of amendment

    5/26/2026House

  15. Rules suspended and bill placed in all remaining stages of passage as moved by Rep. McCoy of Poultney

    5/26/2026House

  16. Third Reading ordered

    5/26/2026House

  17. Which was agreed to on a Roll Call Passed -- Needed 66 of 132 to Pass -- Yeas = 129, Nays = 3

    5/26/2026House

  18. Report of Committee on Commerce and Economic Development agreed to

    5/26/2026House

  19. Rep. Headrick of Burlington demanded yeas and nays

    5/26/2026House

  20. Rep. Greer of Bennington, Cole of Hartford, Galfetti of Barre Town, Headrick of Burlington, Lipsky of Stowe, Logan of Burlington, McCann of Montpelier, Sibilia of Dover, and Tomlinson of Winooski moved to amend the report of the Committee on Commerce and Economic Development, which was disagreed to

    5/26/2026House

  21. Rep. Priestley of Bradford reported for the Committee on Commerce and Economic Development

    5/26/2026House

  22. Read second time

    5/26/2026House

  23. Rules suspended and taken up for immediate consideration as moved by Rep. McCoy of Poultney

    5/26/2026House

  24. Notice Calendar: Favorable with Amendment

    5/26/2026House

  25. Read first time and referred to the Committee on Commerce and Economic Development

    4/1/2025House

Bill Text

  • As Enacted (ACT 145)Opens in a new window

    6/19/2026

    PDF

  • As Passed by Both Chambers

    6/5/2026

    PDF

  • As Passed by Both Chambers (Unofficial)

    6/5/2026

    PDF

  • House Proposal of Amendment

    5/27/2026

    PDF

  • House Proposal of Amendment (Unofficial)

    5/27/2026

    PDF

  • As Passed by the Senate

    3/31/2025

    PDF

  • As Passed by the Senate (Unofficial)

    3/31/2025

    PDF

  • As Introduced

    2/14/2025

    PDF

Related Bills

Back to State Legislation