All Roll Calls
Yes: 158 • No: 3
VermontS.712025-2026 SessionSenateWALLET
An act relating to consumer data privacy and online surveillance
Sponsored By: Alison Clarkson (Democratic)
Signed by Governor
Your PRIA Score
Score Hidden
Personalized for You
How does this bill affect your finances?
Sign up for a PRIA Policy Scan to see your personalized alignment score for this bill and every other piece of legislation we track. We analyze your financial profile against policy provisions to show you exactly what matters to your wallet.
Bill Overview
Analyzed Economic Effects
21 provisions identified: 15 benefits, 1 costs, 5 mixed.
You can sue data brokers
Starting July 1, 2026, you can sue a data broker or large data holder in Vermont court if you are harmed by a covered violation. You can get at least $5,000 or your actual damages, plus possible injunctions, punitive damages for intentional violations, and attorney’s fees. Before filing, you must notify the Attorney General and send the company a demand letter at least 65 days in advance. You cannot sue controllers registered in Vermont with under $25 million in prior‑year revenue.
Core privacy rights and company duties
Starting January 1, 2028, companies must collect only what is needed and cannot switch to a new, incompatible use without your consent. They must use reasonable security to protect personal data. You can request access, correction, deletion, or portability; companies must answer in 45 days and give one free response each 12 months. Companies cannot punish you for using your rights or use data in ways that break anti‑discrimination laws. Sensitive data gets extra limits: from July 1, 2026, sale of sensitive data is banned and use must be strictly necessary for a requested service; from January 1, 2028, processing and sale of sensitive data require your consent.
Extra protection for your health data
Only staff with a duty of confidentiality may access consumer health data, and processors need required contracts. Companies cannot sell your health data without your consent. No one may use a geofence to track or message people about health data near a health care facility; the law sets a 1,850‑foot limit (and 1,750 feet in another section). These health‑data rules apply to any business doing business in Vermont or targeting Vermonters. Some parts begin July 1, 2026, and the rest apply January 1, 2028.
New privacy rights for Vermonters
The law gives Vermont residents key privacy rights. You can ask if a company has your data and get a copy. You can fix errors, delete data, and get it in a portable format. You can opt out of targeted ads, data sales, and profiling with big effects. These rights apply starting July 1, 2026, with limited trade‑secret exceptions.
Privacy rules for kids and teens online
From July 1, 2026, services that know users are minors must avoid heightened risk of harm and show a clear signal while collecting precise location. They cannot target ads to minors or sell a minor’s personal data. If a business is covered and the user is a covered minor, it must follow Vermont’s age‑appropriate design rules. Starting January 1, 2028, if a company knows a user is 13–17, it also cannot target ads to that teen or sell the teen’s data.
Companies must collect less and secure data
The law limits data collection to what is needed for the service you asked for. Companies must get consent for sensitive data and for new uses that do not match their original purpose. They must keep reasonable security and dispose of data on a schedule. From July 1, 2026, processors must follow controller instructions, use safeguards, and work under binding contracts. From January 1, 2028, contracts must include deletion or return of data and subcontractor limits, and a processor that sets purposes becomes a controller.
Risk checks for high-risk data uses
For high‑risk data uses like targeted ads, selling data, harmful profiling, or using sensitive data, companies must do written risk assessments. This applies to new processing created after July 1, 2025, and expands on January 1, 2028. Assessments must weigh benefits and risks, list safeguards, and, for profiling, explain purpose, data used, performance checks, and user safeguards. The Attorney General can require these assessments during investigations, and the documents stay confidential. Assessment rules are not retroactive to processing that began before the effective dates.
Who must follow Vermont privacy law
A business is covered if it handled personal data of 35,000 or more Vermonters last year. It is also covered if it handled sensitive data of 3,000 or more, or offered 3,000 or more people’s data for sale. The 35,000 count excludes data used only to process payments. On July 1, 2027, the thresholds drop to 12,500 consumers, or 6,250 if over 20% of revenue comes from selling data; on July 1, 2028, they drop to 6,250, or 3,125 with over 20% sale revenue. The law’s rules take effect January 1, 2028.
How the law is enforced
Starting July 1, 2026, the Vermont Attorney General enforces the law, can make rules, and bring civil cases; violations count as unfair and deceptive acts. Private lawsuits are not allowed; the Attorney General handles enforcement. From July 1, 2025 to December 31, 2026, and again January 1, 2028 to June 30, 2029, the Attorney General provides a 60‑day cure window before suing when a fix is possible. Starting January 1, 2028, the Attorney General publishes compliance guidance and, by December 1 each year, reports on violation notices and outcomes. Companies that materially follow the Attorney General’s guidance receive a safe harbor against being treated as having committed the unfair act.
Vendor contracts and data handling rules
Processors must follow the controller’s instructions and help with rights requests, security, and breach notices. Contracts must say what data is processed, for what purpose, for how long, how it will be deleted or returned, and set rules for subcontractors. Controllers and processors stay responsible for harms tied to their role. Starting January 1, 2028, companies do not have to reidentify deidentified or pseudonymous data, and some rights may not apply to pseudonymous data when it cannot be reasonably linked to you.
No retaliation for using your rights
The law bars companies from punishing you for using your privacy rights. They cannot deny service, charge more, or give worse quality because you refused or used your rights. These protections apply starting July 1, 2026.
Simple ways to use your privacy choices
Companies must try to verify your identity for access, fixes, and deletion. You can name an agent or use a browser or device setting to opt out. Starting January 1, 2028, every site must post a clear opt‑out link and accept a valid opt‑out preference signal. If that signal conflicts with a loyalty setting, your signal controls unless you choose otherwise. Companies must offer secure ways to send requests and cannot make you open a new account. You can revoke consent as easily as you gave it, and the company must stop using your data within 15 days.
Stronger limits on ads and teen data
If a company knows a user is 13 to 15, it cannot target ads or sell that teen’s data without consent. Starting July 1, 2026, only limited, broad location and device info may be used for contextual ads, not to profile people. Allowed areas must be at least a 10‑mile radius or include about 5,000 users. Companies may not block tools that hide precise location.
Attorney General enforcement and education
Starting July 1, 2025, the Attorney General runs education and help programs so people and businesses understand the law. The AG must report findings and advice to lawmakers by December 15, 2027. Beginning January 1, 2028, breaking this law also breaks the Vermont Consumer Protection Act, and the Attorney General enforces it.
Clear privacy notices and change alerts
From July 1, 2026, companies must post a clear, accessible privacy notice. It must list data categories (including sensitive data), uses, who gets data, how long data is kept, and how to opt out or appeal. Starting January 1, 2028, notices must also say if data trains AI, who buys data, and show the last update month and year. The notice must be easy to find with a "privacy" link on home pages and app stores, in each service language, and accessible to people with disabilities. If a company makes a material change, it must tell affected consumers and give them a chance to withdraw consent for new or different uses.
Rules for de-identified and pseudonymous data
From July 1, 2026, companies holding de‑identified data must prevent reidentification, use it only in de‑identified form, and bind recipients by contract. They may reidentify only to test their methods. Access and correction rights may not apply to pseudonymous data when identity is kept separate and protected. Starting January 1, 2028, companies must publicly promise not to reidentify and must monitor recipients and act on contract breaches.
Who must follow Vermont privacy law
Starting July 1, 2026, many businesses must follow this law if they handled data for at least 25,000 consumers last year, or 12,500 if over 25% of revenue came from selling data. Payment‑only data does not count in these totals. The law also defines "sensitive data," like health, precise location, biometrics, and financial credentials. Extra rules apply to these categories.
Enforcement by Attorney General, no private suits
Individuals cannot sue under this chapter unless the law clearly allows it. The Attorney General enforces the law. Starting January 1, 2027, the Attorney General may weigh set factors before offering a company a chance to fix a violation. Factors include the number of violations, company size and complexity, likely public harm or safety issues, and data sensitivity.
Legal exceptions and data not covered
Some data and activities are outside this law. Examples include HIPAA‑protected health data, certain clinical research, de‑identified data under HIPAA, credit‑reporting uses under the FCRA, and FERPA student records. The law also allows processing to follow other laws, respond to subpoenas or investigations, help law enforcement in good faith, protect life and safety, prevent fraud, and do approved research with safeguards.
Most rules start July 1, 2026
The law takes effect on July 1, 2026. Unless a section sets a different date, its rules apply starting then.
Which businesses the privacy law covers
The law applies to businesses that handled data for at least 100,000 people in the prior year. It also applies if a business handled 25,000 people’s data and got over 25% of its revenue from selling personal data. These counts use the previous calendar year. Many entities are excluded, including state and local governments, nonprofits, universities, certain banks and GLBA‑covered data, HIPAA‑covered health entities, tribal governments, and some air carriers.
Sponsors & Cosponsors
Sponsor
Alison Clarkson
Democratic • Senate
Cosponsors
Joseph "Joe" D Major
Democratic • Senate
Nader A Hashim
Democratic • Senate
Rebecca "Becca" E White
Democratic • Senate
Tanya C Vyhovsky
Democrat/Progressive • Senate
Wendy K Harrison
Democratic • Senate
Roll Call Votes
House vote • 5/26/2026
Which was agreed to on a Roll Call Passed -- Needed 66 of 132 to Pass -- Yeas = 129, Nays = 3
Yes: 129 • No: 3 • Other: 1
Senate vote • 3/26/2025
Recommendation of amendment by Committee on Institutions agreed to on roll call, requested by Senator Beck, Passed -- Needed 15 of 29 to Pass -- Yeas = 29, Nays = 0
Yes: 29 • No: 0
Actions Timeline
Signed by Governor on June 16, 2026
5/29/2026SenateDelivered to Governor on June 10, 2026
5/29/2026SenateSenate Message: House proposal of amendment concurred in
5/29/2026HouseRules suspended & messaged to House forthwith, on motion of Senator Lyons
5/29/2026SenateAs passed by Senate and House
5/29/2026SenateHouse proposal of amendment concurred in
5/29/2026SenateHouse proposal of amendment; text
5/29/2026SenateHouse proposal of amendment
5/29/2026SenateHouse proposal of amendment
5/28/2026SenateEntered on Notice Calendar
5/28/2026SenateHouse message: House passed bill in concurrence with proposal(s) of amendment
5/27/2026SenateRules suspended and bill messaged forthwith to the Senate as moved by Rep. McCoy of Poultney
5/26/2026HouseRead third time and passed in concurrence with proposal of amendment
5/26/2026HouseRules suspended and bill placed in all remaining stages of passage as moved by Rep. McCoy of Poultney
5/26/2026HouseThird Reading ordered
5/26/2026HouseWhich was agreed to on a Roll Call Passed -- Needed 66 of 132 to Pass -- Yeas = 129, Nays = 3
5/26/2026HouseReport of Committee on Commerce and Economic Development agreed to
5/26/2026HouseRep. Headrick of Burlington demanded yeas and nays
5/26/2026HouseRep. Greer of Bennington, Cole of Hartford, Galfetti of Barre Town, Headrick of Burlington, Lipsky of Stowe, Logan of Burlington, McCann of Montpelier, Sibilia of Dover, and Tomlinson of Winooski moved to amend the report of the Committee on Commerce and Economic Development, which was disagreed to
5/26/2026HouseRep. Priestley of Bradford reported for the Committee on Commerce and Economic Development
5/26/2026HouseRead second time
5/26/2026HouseRules suspended and taken up for immediate consideration as moved by Rep. McCoy of Poultney
5/26/2026HouseNotice Calendar: Favorable with Amendment
5/26/2026HouseRead first time and referred to the Committee on Commerce and Economic Development
4/1/2025HouseRead 3rd time & passed
3/27/2025Senate
Bill Text
As Passed by Both Chambers
6/5/2026
As Passed by Both Chambers (Unofficial)
6/5/2026
House Proposal of Amendment
5/27/2026
House Proposal of Amendment (Unofficial)
5/27/2026
As Passed by the Senate
3/31/2025
As Passed by the Senate (Unofficial)
3/31/2025
As Introduced
2/14/2025
Related Bills
H.951 — An act relating to making appropriations for the support of the government
H.955 — An act relating to next steps in transforming Vermont’s education system
S.326 — An act relating to miscellaneous amendments to laws relating to motor vehicles
H.933 — An act relating to miscellaneous administrative and policy changes to the tax laws
S.198 — An act relating to the regulation of tobacco products and tobacco substitutes
H.944 — An act relating to the fiscal year 2027 Transportation Program and miscellaneous changes to laws related to transportation