Vermont DPOSA

Vermont's Data Privacy and Online Surveillance Act, signed June 16, 2026 as Act 145, takes effect January 1, 2028 and is among the strictest state laws. It applies to controllers handling the personal data of 35,000 Vermonters, or the sensitive data of 3,000, and its consumer health data rules apply to any business regardless of size. Collection must be limited to what is reasonably necessary and proportionate, sensitive data needs consent to process or sell, and controllers must honor opt-out preference signals. Consumers can question the result of significant profiling decisions and obtain a list of third parties that bought their data, and privacy notices must disclose whether data trains large language models. Geofencing within 1,850 feet of a health care facility is banned. The Attorney General enforces; there is no private right of action, and a 60-day cure period runs through June 30, 2029.