This is a quick update to let you know that Vermont became the 23rd state to enact a comprehensive state privacy law. Gov. Phil Scott, R-Vt., signed Senate Bill 71, the Vermont Data Privacy and Online Surveillance Act, into law on June 16, 2026. The law will be enforceable on January 1, 2028.
Under Vermont’s new privacy law, enforcement power is granted exclusively to the state attorney general with no private right of action. Sorry, Plaintiff’s Bar, you don’t get to use the new law to abuse businesses. The state attorney general must submit an annual report to the Vermont General Assembly containing information on its enforcement activities. The law features a 60-day cure period for violations that expires 30 June 2029.
The law applies to data controllers or processors that handle the personal data of more than 35,000 state residents, those processing the sensitive personal data of at least 3,000 state residents, or those selling the personal data of at least 3,000 residents.
The patchwork framework of data privacy law in the United States continues.
