Vermont Data Privacy and Online Surveillance Act (Act 145)

Comprehensive privacy law with data minimisation duties, a ban on selling sensitive data and heightened protections for minors. Sources differ on the operative date (1 January 2027 or 2028); verify against the enrolled act.

Analysis

**Act 145 is the enrolled Vermont statute implementing the Vermont Data Privacy and Online Surveillance Act, and the official enrolled act says it takes effect on January 1, 2028—not January 1, 2027.** The enrolled act is the controlling source for the operative date and short title. Vermont Legislature – Act 145 as enacted Vermont Legislature – S.71 / Act 145 status

Key Requirements

• Scope and applicability
• The law is a comprehensive consumer privacy statute within 9 V.S.A. chapter 61A and applies to businesses that conduct business in Vermont or target Vermont residents and meet the statute’s processing thresholds. Vermont Legislature – Act 145 as enacted
• The enrolled act creates the Vermont Data Privacy and Online Surveillance Act as a new subchapter in Vermont’s privacy code. Vermont Legislature – Act 145 as enacted

• Data minimization
• Covered entities must limit collection and use of personal data to what is adequate, relevant, and reasonably necessary for the disclosed purposes. This is a core operational requirement because it constrains both collection and downstream use. Vermont Legislature – Act 145 as enacted

• Sensitive data restrictions
• The law imposes heightened protections for sensitive data, including a ban on selling sensitive data and stronger consent-based handling rules than ordinary personal data. Vermont Legislature – Act 145 as enacted
• Sensitive data treatment is one of the statute’s principal compliance pivot points because it triggers extra safeguards and limits on commercialization. Vermont Legislature – Act 145 as enacted

• Minors’ data protections
• The act provides heightened protections for minors, reflecting special handling requirements for younger users and their data. Vermont Legislature – Act 145 as enacted
• Organizations handling youth-facing products should treat age-gating, consent logic, and default settings as higher-risk compliance areas. Vermont Legislature – Act 145 as enacted

• Consumer rights
• The statute establishes consumer privacy rights typical of modern state privacy laws, including rights related to access, deletion, correction, portability, and opt-out style controls depending on the statutory provision. Vermont Legislature – Act 145 as enacted
• Businesses must build workflows to receive, verify, log, and respond to consumer requests within the statutory timelines. Vermont Legislature – Act 145 as enacted

• Privacy notices
• Covered businesses must provide clear privacy disclosures explaining the categories of data collected, purposes of processing, sharing practices, and consumer rights. Vermont Legislature – Act 145 as enacted
• Notice content must align with actual data practices; a privacy policy that is broader or narrower than operations creates compliance risk. Vermont Legislature – Act 145 as enacted

• Enforcement
• Enforcement is through Vermont’s attorney general framework, and violations are treated as consumer-protection violations under the act’s enforcement provisions. Vermont Legislature – Act 145 as enacted
• The statute’s operative date gives organizations time to align governance, technical controls, vendor management, and consumer-request processes before January 1, 2028. Vermont Legislature – Act 145 as enacted

Compliance Challenges

• Data inventory and classification
• Organizations often struggle to map where personal data resides, especially across marketing, ad tech, CRM, analytics, and customer support systems. This is a recurring issue in privacy program implementation because minimization and deletion obligations depend on accurate data mapping. NIST Privacy Framework IAPP privacy operations resources

• Sensitive data identification
• Many firms lack a reliable taxonomy for identifying sensitive data consistently across systems, vendors, and derived data sets, which complicates restrictions on sale and use. NIST Privacy Framework IAPP data mapping resources

• Consumer request workflows
• Fulfilling access, deletion, and correction requests requires identity verification, ticketing, legal review, and system-level deletion logic; these workflows are frequently fragmented in large organizations. NIST Privacy Framework IAPP DSAR operations resources

• Vendor and ad-tech oversight
• Third-party contracts often do not reflect privacy-law restrictions on use, sharing, retention, and onward transfer, making vendor governance a common gap. NIST Privacy Framework FTC guidance on data practices and vendor oversight

• Youth and age-assurance design
• Products with mixed audiences face challenges in age estimation, parental consent handling, and age-appropriate defaults. These issues are especially hard where users can self-report age inconsistently. FTC COPPA guidance NIST Privacy Framework

• Real-world compliance failures
• Enforcement actions in other privacy regimes show that incomplete data inventories, weak deletion practices, and misleading notices are recurring causes of regulatory risk. FTC privacy enforcement cases CPPA enforcement and settlements

Implementation Best Practices

• Build a data map first
• Create and maintain a record of processing activities covering data categories, purposes, retention, sharing, sensitive-data flags, and system owners. A current data map is the foundation for minimization and notice accuracy. NIST Privacy Framework IAPP data mapping resources

• Classify data by risk
• Tag personal data into ordinary, sensitive, and minor-related categories so the organization can automatically route high-risk data through stricter controls. NIST Privacy Framework FTC children’s privacy guidance

• Implement request-management controls
• Use a standardized DSAR workflow for intake, verification, routing, search, approval, redaction, and response deadlines. This reduces missed deadlines and inconsistent responses. NIST Privacy Framework IAPP DSAR resources

• Update notices and consent logic
• Align privacy notices, cookie banners, mobile SDK disclosures, and in-product prompts with actual processing and with the statute’s sensitive-data and youth-related rules. Vermont Legislature – Act 145 as enacted NIST Privacy Framework

• Review contracts and DPIA-style assessments
• Re-paper vendor agreements to cover data use restrictions, deletion, subprocessor controls, audit rights, and security obligations. For higher-risk processing, adopt documented privacy impact assessments. NIST Privacy Framework FTC privacy and security guidance

• Use implementation resources
• The NIST Privacy Framework is a strong operating model for privacy governance and risk management. NIST Privacy Framework
• The FTC privacy and child-privacy guidance is useful for control design and youth-data practices. FTC privacy and security FTC children’s privacy
• The IAPP privacy operations resources provide practical templates and program guidance for mapping, DSARs, and governance. IAPP privacy operations IAPP data mapping

Recent Updates

• Enactment
• Vermont enacted the law as Act 145 on June 16, 2026. Vermont Legislature – S.71 / Act 145 status Vermont Legislature – Act 145 as enacted

• Effective date
• The enrolled act states: “This act shall take effect on January 1, 2028.” Vermont Legislature – Act 145 as enacted

• Operative deadline
• The practical compliance deadline is January 1, 2028, because that is when the act becomes effective. Vermont Legislature – Act 145 as enacted

• No later amendment identified in the official sources reviewed
• Based on the enrolled act and bill-status record, the controlling official materials show enactment and effective date, but no later amendment is reflected in those sources. Vermont Legislature – S.71 / Act 145 status Vermont Legislature – Act 145 as enacted

Related Regulations

• Virginia Consumer Data Protection Act
• Like Vermont’s law, Virginia’s privacy statute regulates consumer rights, controller duties, and data minimization, so multi-state programs can often harmonize controls across both regimes. Virginia legislative information system Virginia Attorney General privacy resources

• Connecticut Data Privacy Act
• Connecticut’s privacy law overlaps on consumer rights, sensitive-data treatment, and notice obligations, making it relevant for common program design. Connecticut General Assembly Connecticut Attorney General privacy information

• Colorado Privacy Act
• Colorado’s law is influential because it uses a similar controller/consumer-rights structure and has detailed rules on sensitive data and universal opt-outs. Colorado General Assembly Colorado Attorney General privacy guidance

• Children’s Online Privacy Protection Act
• Vermont’s heightened protections for minors overlap conceptually with COPPA for child-directed online services and websites. FTC COPPA guidance FTC COPPA Rule

• NIST Privacy Framework
• Although not a law, the NIST framework is a useful implementation standard for governance, mapping, controls, and risk assessment under Vermont-style privacy regimes. NIST Privacy Framework

Industry Impact

• Advertising and ad-tech
• Restrictions on sensitive-data sales and stronger consent expectations can reduce addressable audiences and increase reliance on first-party data. This materially affects ad-tech, retail media, and data-broker models. Vermont Legislature – Act 145 as enacted IAPP advertising and privacy resources

• Health, finance, and other sensitive-data-heavy sectors
• Sectors that routinely process sensitive data will face the largest burden because data classification, consent, and sale restrictions become core architecture issues rather than legal-formality issues. Vermont Legislature – Act 145 as enacted NIST Privacy Framework

• Consumer platforms and apps
• Consumer apps with minors in their user base will need stronger age-gating, default privacy settings, and data-collection restraint, which may affect product design and growth metrics. FTC children’s privacy guidance Vermont Legislature – Act 145 as enacted

• Enterprise compliance operations
• Privacy teams should expect higher operational load in data mapping, vendor review, request handling, and policy updates as the effective date approaches. NIST Privacy Framework IAPP privacy operations

Sources

• Vermont Legislature – Act 145 as enacted
• Vermont Legislature – S.71 / Act 145 bill status
• Vermont Legislature – Act 145 summary
• NIST Privacy Framework
• FTC privacy and security business guidance
• FTC children’s privacy guidance
• FTC COPPA Rule
• IAPP privacy operations resources
• IAPP data mapping resources
• IAPP DSAR resources
• IAPP ad-tech privacy resources
• Virginia privacy resources
• Colorado privacy guidance
• Connecticut privacy resources

Recent developments

• 2026-09-12 — Overview of Act 145 as a comprehensive Vermont consumer data privacy law, detailing scope, covered entities, exemptions, and key consumer rights, and confirming core provisions effective January 1, 2028 with enforcement by the Attorney General and no private right of action.[12] (source)
• 2026-09-07 — Analysis of the Vermont Data Privacy and Online Surveillance Act’s general applicability, including threshold criteria (35,000 consumers; 3,000 sensitive-data or data-sale thresholds), comparison to other state privacy laws, and confirmation of its in-force date of January 1, 2028.[8] (source)
• 2026-09-02 — Practical overview for organizations of Act 145’s requirements, including which businesses are covered, operational changes needed before the January 1, 2028 effective date, and explanation of the cure period running until June 30, 2029 for alleged violations.[4] (source)
• 2026-08-29 — Law firm summary of Act 145 providing a structured overview of obligations, consumer rights, and enforcement under the Vermont Data Privacy and Online Surveillance Act, and confirming codification in 9 V.S.A. Chapter 61A, §§ 2415a–2415k, effective January 1, 2028.[5] (source)
• 2026-08-25 — Industry-facing explainer highlighting Vermont as the 23rd U.S. state with a comprehensive consumer privacy law, outlining business compliance steps, the exclusive enforcement by the Attorney General, and the January 1, 2028 start date with a cure period through June 30, 2029.[11] (source)
• 2026-08-25 — Privacy counsel commentary on Vermont’s enactment of Act 145, emphasizing its broad consumer rights, data controller and processor obligations, and positioning within the wider U.S. privacy law landscape as another comprehensive state regime.[14] (source)
• 2026-08-14 — International law firm note on Vermont’s comprehensive privacy legislation, describing key consumer rights, business obligations, and noting that Act 145 makes Vermont the 23rd U.S. state with a comprehensive consumer privacy law effective January 1, 2028.[9] (source)
• 2026-07-30 — Newsletter item announcing Vermont as the 23rd state with a comprehensive consumer privacy law, summarizing Act 145’s effective date (January 1, 2028) and high-level implications for companies handling Vermont consumers’ data.[10] (source)
• 2026-07-23 — Detailed industry guidance on VDPOSA compliance, including data subject rights (access, correction, deletion, opt-out), controller duties, and expected operational impacts for organizations targeting Vermont residents by 2028.[11] (source)
• 2026-07-21 — Article explaining how Act 145 affects businesses that process or sell data for specified numbers of Vermont consumers, with practical recommendations for updating privacy programs, surveillance practices, and internal governance ahead of the law’s effective date.[4] (source)

Related regulations

• Vermont Data Broker Registry and Breach Law — Vermont, Active
• UK Data Protection Act 2018 — United Kingdom, Active
• Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
• General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
• COPPA (Children's Online Privacy Protection Act) — United States, Active
• Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
• Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
• New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01

Put it into practice

• Generate the policy: Privacy policy generator (generatepolicy.com)
• Buy the policy pack: State Privacy Law Checklist (cyberpolicy.shop)
• Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates