Vermont Privacy Law

Vermont (VDPOSA)

Last updated Sep 29, 2026

VDPOSA Enacted, not yet effective

Who this affects: This page tracks Vermont’s VDPOSA, which governs controllers and processors.

Who it applies to: Entities that do business in Vermont or target its residents, and meet: 35,000+ consumers, or sensitive data of 3,000+ consumers, or offered for sale in trade or commerce the personal data of 3,000+ consumers; some provisions apply under a separate test (see below).

Content on this page is not legal advice

Must, Can't, Should VDPOSA Timeline

VDPOSA takes effect

days

hrs

min

sec

Jan 1, 2028 · live countdown

January 1, 2028

Effective ↗

Attorney General

Enforced by ↗

$10,000

Maximum penalty per violation ↗

No private right of action.

Private right of action ↗

The law, in plain English

Must · Can’t · Should

VDPOSA, distilled to what actually changes your week. Read one column to know your floor, your hard limits, and the further obligations and good practices worth planning for.

Must

Respond to consumer rights requests within 45 days, and if you decline, explain why and how to appeal in that same window. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. VT-2415d “shall respond to the consumer without undue delay, but not later than 45 days after receipt of the request” Read the statute VT-2415d “the controller shall inform the consumer without undue delay, but not later than 45 days after receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision” Read the statute
Honor opt-out preference signals sent with consumer consent for targeted ads and sales, and post a clear website opt-out link. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. VT-2415e “allow a consumer to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising, or any sale of the personal data, through an opt-out preference signal sent to the controller with the consumer’s consent” Read the statute VT-2415e “provide a clear and conspicuous link on the controller’s website to a web page that enables a consumer, or an agent of the consumer, to opt out of the processing of the consumer’s personal data for purposes of targeted advertising or any sale of the consumer’s personal data” Read the statute
Sign a binding contract with each processor stating instructions, purpose, data type, duration, and both parties' rights. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. VT-2415f “A contract between a controller and a processor shall govern the processor’s data processing procedures with respect to processing performed on behalf of the controller. (2) The contract shall be binding and clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties.” Read the statute

Can't

Process or sell sensitive data without consumer consent, or process it beyond what is reasonably necessary for its purposes. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. VT-2415e “not process the sensitive data unless the consumer has provided consent and unless the processing is reasonably necessary in relation to the purposes for which the sensitive data are collected” Read the statute VT-2415e “not sell the sensitive data unless the consumer has provided consent” Read the statute
Geofence within 1,850 feet of any health care facility to identify, track, or notify consumers about their health data. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. VT-2415k “use a geofence to establish a virtual boundary that is within 1,850 feet of any health care facility, including any mental health facility or reproductive or sexual health facility, for the purpose of identifying, tracking, collecting data from, or sending any notification to a consumer regarding the consumer’s consumer health data” Read the statute
Sell or offer to sell consumer health data without first obtaining the consumer's consent. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. VT-2415k “sell, or offer to sell, consumer health data without first obtaining the consumer’s consent” Read the statute

Should

Build a consent-revocation tool at least as easy as giving consent, and stop processing as soon as practicable, within 15 days. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. VT-2415e “provide an effective mechanism for a consumer to revoke the consumer’s consent under this section that is at least as easy as the mechanism by which the consumer provided the consumer’s consent and, upon revocation of the consent, cease to process the data as soon as practicable, but not later than 15 days after the receipt of the request” Read the statute
Plan for the law taking effect on January 1, 2028, and map heightened-risk processing that will need a documented assessment. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. 2026 Vt. Acts & Resolves No. 145, Sec. 4 “This act shall take effect on January 1, 2028.” Read the statute VT-2415g “A controller shall conduct and document a data protection assessment for each of the controller’s processing activities that presents a heightened risk of harm to a consumer” Read the statute
State in your privacy notice whether you collect, use or sell personal data to train large language models. DataGrail editorial summary: our plain-English wording, written from the sources below, not statutory text. VT-2415e “a statement disclosing whether the controller collects, uses, or sells personal data for the purpose of training large language models; and (I) the most recent month and year during which the controller updated the privacy notice.” Read the statute

These are the highlights we judge most important, not everything VDPOSA requires. The comprehensive law section below covers the full detail, fact by fact, with the statutory text behind every one.

The comprehensive law

Vermont Data Privacy and Online Surveillance Act

VDPOSA (S.71) is Vermont’s comprehensive privacy law. Every fact was extracted from the primary statute by the DataGrail regulation engine and is grounded to the cited source. Scan the facts; the exact statutory text sits one click away on each source link.

Status

Enacted, not yet effective

2026 Vt. Acts & Resolves No. 145, Sec. 4 Archived excerpt — the text we read Sec. 4. EFFECTIVE DATE This act shall take effect on January 1, 2028. Date Governor signed bill: June 16, 2026 Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source

Effective

January 1, 2028

Signed

June 16, 2026

Enforced by

Attorney General

Archived excerpt — the text we read § 2415j. ATTORNEY GENERAL ENFORCEMENT; REPORTING (a) Consumer Protection Act. A violation of this subchapter shall be deemed a violation of the Vermont Consumer Protection Act, pursuant to chapter 63 of this title. The Attorney General has the same authority to enforce this subchapter as provided under 9 V.S.A. chapter 63, subchapter 1. This subchapter shall not be construed as providing the basis for, or be subject to, a private right of action for violations of this subchapter or any other law. (b) Reporting. Annually, on or before December 1, the At… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source

Maximum penalty per violation

$10,000

Source for each figure$10,000 · 9 V.S.A. § 2458 $10,000 · 9 V.S.A. § 2461 “the imposition of a civil penalty of not more than $10,000.00 for each unfair or deceptive act or practice in commerce” View the statute

Right to cure

60 days (Jan 1, 2028 to Jun 30, 2029)

2026 Vt. Acts & Resolves No. 145, Sec. 3 Mandatory where the AG finds a cure possible; 60 days from notice, Jan 1, 2028 to June 30, 2029. Archived excerpt — the text we read Sec. 3. DATA PRIVACY; ENFORCEMENT; CURE PERIOD During the period beginning January 1, 2028, and ending on June 30, 2029, the Attorney General shall, prior to initiating any action for a violation of the Vermont Data Privacy and Online Surveillance Act, issue a notice of violation to the alleged violator if the Attorney General determines that a cure is possible. If the person fails to cure the violation within 60 days after receipt of the notice of violation, the Attorney General may bring an action pursuant to 9 V.S.A. § 2415j(a). Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source

Private right of action

No private right of action.

Archived excerpt — the text we read …eemed a violation of the Vermont Consumer Protection Act, pursuant to chapter 63 of this title. The Attorney General has the same authority to enforce this subchapter as provided under 9 V.S.A. chapter 63, subchapter 1. This subchapter shall not be construed as providing the basis for, or be subject to, a private right of action for violations of this subchapter or any other law. (b) Reporting. Annually, on or before December 1, the Attorney General shall submit a report to the General Assembly disclosing: (1) the number of notices of violation pursuant to this subchapter that the Attorney Gener… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source

Universal opt-out signal

Required

Archived excerpt — the text we read … to a web page that enables a consumer, or an agent of the consumer, to opt out of the processing of the consumer’s personal data for purposes of targeted advertising or any sale of the consumer’s personal data; and (C) allow a consumer to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising, or any sale of the personal data, through an opt-out preference signal sent to the controller with the consumer’s consent indicating the consumer’s intent to opt out of any of the processing or sale, by a platform, technology, or other mechanism that shall: (i) not unfairly disadvantage another controller; (ii) … Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source

What the law gives consumers

Right to access Archived excerpt — the text we read § 2415d. CONSUMER PERSONAL DATA RIGHTS (a) Consumer rights. A consumer shall have the right to: (1) confirm whether or not a controller is processing the consumer’s personal data and access such personal data, including any inferences about the consumer derived from such personal data and whether a controller or processor is processing a consumer’s personal data for the purposes of profiling to make a decision … Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Right to correct Archived excerpt — the text we read …oncerning a consumer, unless such confirmation or access would require the controller to reveal a trade secret or the controller is prohibited from disclosing such personal data under subsection (e) of this section; (2) correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data; (3) delete personal data provided by, or obtained about, the consumer; (4) obtain a copy of the consumer’s personal data processed by the controller, in a portable and, to the extent tec… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Right to delete Archived excerpt — the text we read …under subsection (e) of this section; (2) correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data; (3) delete personal data provided by, or obtained about, the consumer; (4) obtain a copy of the consumer’s personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another contr… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Right to data portability Archived excerpt — the text we read …onsumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data; (3) delete personal data provided by, or obtained about, the consumer; (4) obtain a copy of the consumer’s personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided the controller shall not be required to reveal any trade secret; (5… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Right to opt out of sale Archived excerpt — the text we read …e processing is carried out by automated means, provided the controller shall not be required to reveal any trade secret; (5) opt out of the processing of the personal data for purposes of: (A) targeted advertising; (B) the sale of personal data, except as provided in subsection 2415e(b) of this subchapter; or (C) profiling in furtherance of any automated decision that produces any legal or similarly significant effect concerning the consumer; (6) if the consumer’s person… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Right to opt out of targeted advertising Archived excerpt — the text we read …hat allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided the controller shall not be required to reveal any trade secret; (5) opt out of the processing of the personal data for purposes of: (A) targeted advertising; (B) the sale of personal data, except as provided in subsection 2415e(b) of this subchapter; or (C) profiling in furtherance of any automated decision that produces any legal or similarly significant effect concerning t… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Right to opt out of profiling for significant decisions Archived excerpt — the text we read … reveal any trade secret; (5) opt out of the processing of the personal data for purposes of: (A) targeted advertising; (B) the sale of personal data, except as provided in subsection 2415e(b) of this subchapter; or (C) profiling in furtherance of any automated decision that produces any legal or similarly significant effect concerning the consumer; (6) if the consumer’s personal data were processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly signific… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Sensitive data: opt-in consent required Archived excerpt — the text we read …ta security practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data at issue; (4) regarding the sensitive data of a consumer: (A) not process the sensitive data unless the consumer has provided consent and unless the processing is reasonably necessary in relation to the purposes for which the sensitive data are collected; (B) not sell the sensitive data unless the consumer has provided consent; and (C) if the controller has actual knowledge, or willfully disregards, that the consumer is a child, process the sensitive data in accordance … Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Right to appeal Archived excerpt — the text we read …suant to the provisions of this subchapter; or (B) opting the consumer out of the processing of the personal data for any purpose except for those exempted pursuant to the provisions of this subchapter. (d) Appeals. (1) A controller shall establish a process for a consumer to appeal the controller’s refusal to take action on a request pursuant to this section within a reasonable period of time after the consumer’s receipt of the decision. (2) The appeal process shall be conspicuously available and similar to the process for submitting requests to initiate action pursuant to … Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Right against discrimination Archived excerpt — the text we read …s, that a consumer is at least 13 years of age but younger than 18 years of age: (A) not process the personal data of the consumer for purposes of targeted advertising; and (B) not sell the consumer’s personal data; (8) not discriminate against a consumer for exercising any of the consumer rights contained in this subchapter, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods or services to the consumer; and (9) if the controller is a covered business and the consumer is a covered minor as both terms are defined in section 2449a of this title, comply with the requireme… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Right to a list of the third parties data was sold to Archived excerpt — the text we read …nal data were processed, be allowed to correct any incorrect personal data that were processed for the purposes of such profiling and have the profiling decision reevaluated based on the corrected personal data; and (7) obtain from the controller a list of the third parties to which such controller has sold the consumer’s personal data or, if such controller does not maintain a list of the third parties to which such controller has sold the consumer’s personal data, a list of all third parties to which such controller has sold personal data, provided the controller shall not be required to reveal any trade secret. (b) Exercising consumer rights. (1) A consumer may exercise rights under this section by a secure and reliable means established by the controll… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Right to question a profiling decision Archived excerpt — the text we read …5e(b) of this subchapter; or (C) profiling in furtherance of any automated decision that produces any legal or similarly significant effect concerning the consumer; (6) if the consumer’s personal data were processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer, and if feasible: (A) question the result of such profiling; (B) be informed of the reason that such profiling resulted in such decision; (C) review the consumer’s personal data that were processed for the purposes of such profiling; and (D) if the profiling decision concerned housing, taking into account the nature of the personal data and the purposes for which such personal data were processed, be allowed to correct any incorrect personal data that were processed for the purposes of such profiling and have the profiling decision reevaluated based on the corrected personal data; and (7) obtain from the controller a list of the third parties to which such controller has sold the consumer’s personal data or, if such controller does not maintain a list of the third parties to which such controlle… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Not granted: Private right of action Archived excerpt — the text we read …eemed a violation of the Vermont Consumer Protection Act, pursuant to chapter 63 of this title. The Attorney General has the same authority to enforce this subchapter as provided under 9 V.S.A. chapter 63, subchapter 1. This subchapter shall not be construed as providing the basis for, or be subject to, a private right of action for violations of this subchapter or any other law. (b) Reporting. Annually, on or before December 1, the Attorney General shall submit a report to the General Assembly disclosing: (1) the number of notices of violation pursuant to this subchapter that the Attorney Gener… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source

Who the law governs

Controllers Archived excerpt — the text we read …t, alone or jointly with others, determines the purpose and means of processing consumer health data. (11) “Consumer reporting agency” has the same meaning as in the Fair Credit Reporting Act, 15 U.S.C. § 1681a(f). (12) “Controller” means a person who, alone or jointly with others, determines the purpose and means of processing personal data. (13) “COPPA” means the Children’s Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501–6506, and any regulations, rules, guidance, and exemptions adopted pursuant to the act, as the act and regulations, rules, guida… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Processors Archived excerpt — the text we read …t of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data. (38) “Processor” means a person who collects or processes personal data on behalf of: (A) a controller; or (B) another processor. (39) “Profiling” means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects, including an individual’s economic situat… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source

Exemptions

Federal, state, tribal, or local government entities Archived excerpt — the text we read § 2415c. EXEMPTIONS (a) This subchapter does not apply to: (1) in the ordinary course of its operation, a federal, state, tribal, or local government entity or an instrumentality of the State; (2)(A) a covered entity that is not a hybrid entity; (B) any health care component of a hybrid entity; or (C) a business associate; (3) patient-identifying information,… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
HIPAA covered entities that are not hybrid entities, and others Entity-level HIPAA covered entities that are not hybrid entities, the health care component of a hybrid entity, and business associates. Entity-level, 2415c(a)(2)(A)-(C). Archived excerpt — the text we read § 2415c. EXEMPTIONS (a) This subchapter does not apply to: (1) in the ordinary course of its operation, a federal, state, tribal, or local government entity or an instrumentality of the State; (2)(A) a covered entity that is not a hybrid entity; (B) any health care component of a hybrid entity; or (C) a business associate; (3) patient-identifying information, for purposes of 42 U.S.C. § 290DD– 2; (4)(A) information to the extent it is used for public health, community health, or population health activities and purposes, as authorized b… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Patient-identifying substance use disorder information Archived excerpt — the text we read … an instrumentality of the State; (2)(A) a covered entity that is not a hybrid entity; (B) any health care component of a hybrid entity; or (C) a business associate; (3) patient-identifying information, for purposes of 42 U.S.C. § 290DD– 2; (4)(A) information to the extent it is used for public health, community health, or population health activities and purposes, as authorized by HIPAA, when provided by or to a covered entity or when provided by or to a… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Public, community or population health information authorized by HIPAA When provided by or to a HIPAA covered entity or business associate. Archived excerpt — the text we read … entity; (B) any health care component of a hybrid entity; or (C) a business associate; (3) patient-identifying information, for purposes of 42 U.S.C. § 290DD– 2; (4)(A) information to the extent it is used for public health, community health, or population health activities and purposes, as authorized by HIPAA, when provided by or to a covered entity or when provided by or to a business associate in accordance with the business associate agreement with a covered entity; (B) information that is a health care record, as that term is defined in 18 V.S.A. § 9419, if the information is held by an entity that is a covered entity or business associate under HIPAA because it collects, uses, o… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Deidentified information derived from individually identifiable health information Archived excerpt — the text we read …, as that term is defined in 18 V.S.A. § 9419, if the information is held by an entity that is a covered entity or business associate under HIPAA because it collects, uses, or discloses protected health information; (C) information that is deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R. § 164.514 and that is derived from individually identifiable health information as described in HIPAA; and (D) personal information consistent with the human subject protection requirements of the U.S. Food and Drug Administration; (5) information used only for public health activities and purposes described in 45 C.F.R… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
FDA human subject protection information Archived excerpt — the text we read …rmation that is deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R. § 164.514 and that is derived from individually identifiable health information as described in HIPAA; and (D) personal information consistent with the human subject protection requirements of the U.S. Food and Drug Administration; (5) information used only for public health activities and purposes described in 45 C.F.R. § 164.512 (disclosure of protected health information without authorization); … Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Public health activity information under 45 CFR 164.512 Archived excerpt — the text we read …at is derived from individually identifiable health information as described in HIPAA; and (D) personal information consistent with the human subject protection requirements of the U.S. Food and Drug Administration; (5) information used only for public health activities and purposes described in 45 C.F.R. § 164.512 (disclosure of protected health information without authorization); (6) information that identifies a consumer in connection with: (A) activities that are subject to the Federal Policy for the Protection of Human Subjects, codified as 4… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Human subjects research information Archived excerpt — the text we read …s described in 45 C.F.R. § 164.512 (disclosure of protected health information without authorization); (6) information that identifies a consumer in connection with: (A) activities that are subject to the Federal Policy for the Protection of Human Subjects, codified as 45 C.F.R. Part 46 (HHS protection of human subjects) and in various other federal regulations; (B) activities that are subject to the protections provided in 21 C.F.R. Parts 50 (FDA clinical investigations protection of human subjects) and 56 (FDA clinical investigations institutional review boards); or (C) rese… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
FDA clinical investigation human subjects protections Archived excerpt — the text we read …connection with: (A) activities that are subject to the Federal Policy for the Protection of Human Subjects, codified as 45 C.F.R. Part 46 (HHS protection of human subjects) and in various other federal regulations; (B) activities that are subject to the protections provided in 21 C.F.R. Parts 50 (FDA clinical investigations protection of human subjects) and 56 (FDA clinical investigations institutional review boards); or (C) research conducted in accordance with the requirements set forth in subdivisions (A) and (B) of this subdivision (a)(6) or otherwise in accordance with applicable law; (7) patient-identifying information that is… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Substance use disorder patient records under 42 CFR Part 2 Archived excerpt — the text we read …stigations institutional review boards); or (C) research conducted in accordance with the requirements set forth in subdivisions (A) and (B) of this subdivision (a)(6) or otherwise in accordance with applicable law; (7) patient-identifying information that is collected and processed in accordance with 42 C.F.R. Part 2 (confidentiality of substance use disorder patient records); (8) patient safety work product that is created and used for purposes of patient safety improvement in accordance with 42 C.F.R. § 3, established in accordance with 42 U.S.C. §§ 299b–21 through 299b–26; (9) information… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Patient safety work product Archived excerpt — the text we read …6) or otherwise in accordance with applicable law; (7) patient-identifying information that is collected and processed in accordance with 42 C.F.R. Part 2 (confidentiality of substance use disorder patient records); (8) patient safety work product that is created and used for purposes of patient safety improvement in accordance with 42 C.F.R. § 3, established in accordance with 42 U.S.C. §§ 299b–21 through 299b–26; (9) information or documents created for the purposes of the Healthcare Quality Improvement Act of 1986, 42 U.S.C. §§ 11101–11152, and regulations adopted to implement that act; (10) information processed or maintained… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Healthcare Quality Improvement Act information Archived excerpt — the text we read …nt records); (8) patient safety work product that is created and used for purposes of patient safety improvement in accordance with 42 C.F.R. § 3, established in accordance with 42 U.S.C. §§ 299b–21 through 299b–26; (9) information or documents created for the purposes of the Healthcare Quality Improvement Act of 1986, 42 U.S.C. §§ 11101–11152, and regulations adopted to implement that act; (10) information processed or maintained solely in connection with, and for the purpose of, enabling notice of an emergency to persons that an individual specifies; (11… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Emergency notification information Archived excerpt — the text we read …2 U.S.C. §§ 299b–21 through 299b–26; (9) information or documents created for the purposes of the Healthcare Quality Improvement Act of 1986, 42 U.S.C. §§ 11101–11152, and regulations adopted to implement that act; (10) information processed or maintained solely in connection with, and for the purpose of, enabling notice of an emergency to persons that an individual specifies; (11) any activity that involves collecting, maintaining, disclosing, selling, communicating, or using information for the purpose of evaluating a consumer’s creditworth… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
FCRA-regulated data Archived excerpt — the text we read …(10) information processed or maintained solely in connection with, and for the purpose of, enabling notice of an emergency to persons that an individual specifies; (11) any activity that involves collecting, maintaining, disclosing, selling, communicating, or using information for the purpose of evaluating a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living if done strictly in accordance with the provisions of the Fair Credit Reporting Act, 15 U.S.C. §§ 1681–1681x, as may be amended, by: (A) a consumer reporting agency; (B) a person who furnishes information to a consumer reporting agency under 15 U.S.C. § 1681s-2 (responsibilities of furnishers of information to consumer reporting agencies); or (C… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Driver's Privacy Protection Act data Archived excerpt — the text we read …er report as provided in 15 U.S.C. § 1681b(a)(3) (permissible purposes of consumer reports); (12) information collected, processed, sold, or disclosed under and in accordance with the following laws and regulations: (A) the Driver’s Privacy Protection Act of 1994, 18 U.S.C. §§ 2721– 2725; (B) data that is subject to the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and regulations adopted to implement that act; (C) data that is subject to the Airline Deregulation Act, Pub. L. No. 95-504,… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
FERPA-regulated education data Archived excerpt — the text we read …consumer reports); (12) information collected, processed, sold, or disclosed under and in accordance with the following laws and regulations: (A) the Driver’s Privacy Protection Act of 1994, 18 U.S.C. §§ 2721– 2725; (B) data that is subject to the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and regulations adopted to implement that act; (C) data that is subject to the Airline Deregulation Act, Pub. L. No. 95-504, only to the extent that an air carrier collects information related to prices, routes, or services, and only to the extent that the provisio… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Airline Deregulation Act price/route/service data collected by air carriers To the extent preempted. Archived excerpt — the text we read … (A) the Driver’s Privacy Protection Act of 1994, 18 U.S.C. §§ 2721– 2725; (B) data that is subject to the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and regulations adopted to implement that act; (C) data that is subject to the Airline Deregulation Act, Pub. L. No. 95-504, only to the extent that an air carrier collects information related to prices, routes, or services, and only to the extent that the provisions of the Airline Deregulation Act preempt this subchapter; (D) data that is subject to the Farm Credit Act, Pub. L. No. 92-181, as may be amended; and (E) data that is subject to federal policy under 21 U.S.C. § 830 (regulation… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Farm Credit Act data Archived excerpt — the text we read …rrier collects information related to prices, routes, or services, and only to the extent that the provisions of the Airline Deregulation Act preempt this subchapter; (D) data that is subject to the Farm Credit Act, Pub. L. No. 92-181, as may be amended; and (E) data that is subject to federal policy under 21 U.S.C. § 830 (regulation of listed chemicals and certain machines); (13) data subject to Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, and regulatio… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Regulated chemicals data under 21 U.S.C. 830 Archived excerpt — the text we read …t the provisions of the Airline Deregulation Act preempt this subchapter; (D) data that is subject to the Farm Credit Act, Pub. L. No. 92-181, as may be amended; and (E) data that is subject to federal policy under 21 U.S.C. § 830 (regulation of listed chemicals and certain machines); (13) data subject to Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, and regulations adopted to implement that act; (14) a state- or federally chartered bank or credit union, or an affiliate or subsidiary t… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Data subject to GLBA Title V Data-level exemption only; GLBA financial institutions are not exempt as entities except as covered by 2415c(a)(14)-(16). Archived excerpt — the text we read … (D) data that is subject to the Farm Credit Act, Pub. L. No. 92-181, as may be amended; and (E) data that is subject to federal policy under 21 U.S.C. § 830 (regulation of listed chemicals and certain machines); (13) data subject to Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, and regulations adopted to implement that act; (14) a state- or federally chartered bank or credit union, or an affiliate or subsidiary that is principally engaged in financial activities, as described in 12 U.S.C. § 1843(k); (15) an agent, broker-dealer, investmen… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Banks and credit unions and their financial affiliates Entity-level State- or federally chartered banks and credit unions, and affiliates or subsidiaries principally engaged in financial activities (12 U.S.C. § 1843(k)). Archived excerpt — the text we read …al policy under 21 U.S.C. § 830 (regulation of listed chemicals and certain machines); (13) data subject to Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, and regulations adopted to implement that act; (14) a state- or federally chartered bank or credit union, or an affiliate or subsidiary that is principally engaged in financial activities, as described in 12 U.S.C. § 1843(k); (15) an agent, broker-dealer, investment adviser, or investment adviser representative, as those terms are defined in section 5102 of this title, who is regulated by the Department of Financial Regulation or the Securi… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Securities/investment adviser regulated persons Archived excerpt — the text we read …ions adopted to implement that act; (14) a state- or federally chartered bank or credit union, or an affiliate or subsidiary that is principally engaged in financial activities, as described in 12 U.S.C. § 1843(k); (15) an agent, broker-dealer, investment adviser, or investment adviser representative, as those terms are defined in section 5102 of this title, who is regulated by the Department of Financial Regulation or the Securities and Exchange Commission; (16) a person regulated pursuant to 8 V.S.A. part 3 (chapters 101–165) other than a person who, alone or in combination with another person, establishes and maintains a self-insurance program and who does not otherwise… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Insurance-regulated persons Archived excerpt — the text we read …estment adviser, or investment adviser representative, as those terms are defined in section 5102 of this title, who is regulated by the Department of Financial Regulation or the Securities and Exchange Commission; (16) a person regulated pursuant to 8 V.S.A. part 3 (chapters 101–165) other than a person who, alone or in combination with another person, establishes and maintains a self-insurance program and who does not otherwise engage in the business of entering into policies of insurance; (17) health care providers and health care facilities, as those terms are defined in 18 V.S.A. § 9402, provided such providers and facilities maintain all protected health information in accordance with the requirement… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
HIPAA-compliant health care providers and facilities Health care providers and facilities maintaining HIPAA compliance, regardless of whether they are HIPAA covered entities (entity-level). Archived excerpt — the text we read …65) other than a person who, alone or in combination with another person, establishes and maintains a self-insurance program and who does not otherwise engage in the business of entering into policies of insurance; (17) health care providers and health care facilities, as those terms are defined in 18 V.S.A. § 9402, provided such providers and facilities maintain all protected health information in accordance with the requirements of 18 V.S.A. § 1881 and HIPAA regardless of whether such providers or facilities are covered entities under 45 C.F.R. § 160.103; (18) protected health information under HIPAA; (19) a third-party administrator, as that term is defined in the Third Party Administrator Rule… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Protected health information under HIPAA Archived excerpt — the text we read …in accordance with the requirements of 18 V.S.A. § 1881 and HIPAA regardless of whether such providers or facilities are covered entities under 45 C.F.R. § 160.103; (18) protected health information under HIPAA; (19) a third-party administrator, as that term is defined in the Third Party Administrator Rule adopted pursuant to 18 V.S.A. § 9417, provided that the third-party administrator is subject to and in compliance with the… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Third-party administrators regulated by Department of Financial Regulation Archived excerpt — the text we read …. § 1881 and HIPAA regardless of whether such providers or facilities are covered entities under 45 C.F.R. § 160.103; (18) protected health information under HIPAA; (19) a third-party administrator, as that term is defined in the Third Party Administrator Rule adopted pursuant to 18 V.S.A. § 9417, provided that the third-party administrator is subject to and in compliance with the Department of Financial Regulation’s Regulation IH-2001-01 (Privacy of Consumer Financial and Health Information); (20) personal data of a victim or witness of child abuse, domestic violence, human trafficking, sexual assault, violent felony, or stalking that a victim services … Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Victim services data for abuse/trafficking/assault victims Archived excerpt — the text we read …V.S.A. § 9417, provided that the third-party administrator is subject to and in compliance with the Department of Financial Regulation’s Regulation IH-2001-01 (Privacy of Consumer Financial and Health Information); (20) personal data of a victim or witness of child abuse, domestic violence, human trafficking, sexual assault, violent felony, or stalking that a victim services organization collects, processes, or maintains in the course of its operation; (21) a nonprofit organization that is established to detect and prevent fraudulent acts in connection with insurance; (22) information that is processed for purposes of compliance, enrollment or degree verification, or… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Nonprofit insurance fraud detection organizations Archived excerpt — the text we read …tim or witness of child abuse, domestic violence, human trafficking, sexual assault, violent felony, or stalking that a victim services organization collects, processes, or maintains in the course of its operation; (21) a nonprofit organization that is established to detect and prevent fraudulent acts in connection with insurance; (22) information that is processed for purposes of compliance, enrollment or degree verification, or research services by a nonprofit organization that is established to provide enrollment data reporting services on be… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Information processed for compliance, enrollment or degree verification, and others Data-level Information processed for compliance, enrollment or degree verification, or research services by a nonprofit providing enrollment data reporting for postsecondary schools. Archived excerpt — the text we read …a victim services organization collects, processes, or maintains in the course of its operation; (21) a nonprofit organization that is established to detect and prevent fraudulent acts in connection with insurance; (22) information that is processed for purposes of compliance, enrollment or degree verification, or research services by a nonprofit organization that is established to provide enrollment data reporting services on behalf of postsecondary schools as that term is defined in 16 V.S.A. § 176; (23) noncommercial activity of: (A) a publisher, editor, reporter, or other person who is connected with or employed by a newspaper, magazine, periodical, newsletter, pamphlet… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Noncommercial activity of news publishers, editors and reporters (2415c(a)(23)(A)) Archived excerpt — the text we read …h services by a nonprofit organization that is established to provide enrollment data reporting services on behalf of postsecondary schools as that term is defined in 16 V.S.A. § 176; (23) noncommercial activity of: (A) a publisher, editor, reporter, or other person who is connected with or employed by a newspaper, magazine, periodical, newsletter, pamphlet, report, or other publication in general circulation; (B) a radio or television station that holds a license issued by the Federal Communications Commission; (C) a nonprofit organization that provides programming to radio o… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Noncommercial activity of FCC-licensed radio or television stations (2415c(a)(23)(B)) Archived excerpt — the text we read …cial activity of: (A) a publisher, editor, reporter, or other person who is connected with or employed by a newspaper, magazine, periodical, newsletter, pamphlet, report, or other publication in general circulation; (B) a radio or television station that holds a license issued by the Federal Communications Commission; (C) a nonprofit organization that provides programming to radio or television networks; or (D) a press association or wire service; or (24) data processed or maintained… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Noncommercial activity of nonprofit programming providers to radio or television networks 2415c(a)(23)(C). Archived excerpt — the text we read …pamphlet, report, or other publication in general circulation; (B) a radio or television station that holds a license issued by the Federal Communications Commission; (C) a nonprofit organization that provides programming to radio or television networks; or (D) a press association or wire service; or (24) data processed or maintained: (A) in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor,… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Noncommercial activity of press associations and wire services (2415c(a)(23)(D)) Archived excerpt — the text we read …tion that holds a license issued by the Federal Communications Commission; (C) a nonprofit organization that provides programming to radio or television networks; or (D) a press association or wire service; or (24) data processed or maintained: (A) in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, consumer health data controller, or third p… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Employment data Archived excerpt — the text we read … (C) a nonprofit organization that provides programming to radio or television networks; or (D) a press association or wire service; or (24) data processed or maintained: (A) in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, consumer health data controller, or third party, to the extent that the data is collected and used within the context of that role; (B) as the emergency contact information of a consumer pursuant to this subchapter, used for emergency contact purposes; or (C) that is necessary to retain to administer benefits for another individual relating to the … Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Emergency contact information Archived excerpt — the text we read …yed by, or acting as an agent or independent contractor of a controller, processor, consumer health data controller, or third party, to the extent that the data is collected and used within the context of that role; (B) as the emergency contact information of a consumer pursuant to this subchapter, used for emergency contact purposes; or (C) that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information pursuant to subdivision (18) of this subsection (a) and used for the pur… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Benefits administration data Archived excerpt — the text we read …d party, to the extent that the data is collected and used within the context of that role; (B) as the emergency contact information of a consumer pursuant to this subchapter, used for emergency contact purposes; or (C) that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information pursuant to subdivision (18) of this subsection (a) and used for the purposes of administering such benefits. (b) Controllers, processors, and consumer health data controllers that comply with the verifiable parental consent requirements of COPPA shall be deemed compliant with any obligation to obtain parental consent pursuant… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Purely personal or household activity Archived excerpt — the text we read …s the rights or freedoms of any person, including the rights of any person: (A) to freedom of speech or freedom of the press guaranteed in the First Amendment to the U.S. Constitution; or (B) under 12 V.S.A. § 1615; (2) apply to any person’s processing of personal data in the course of the person’s purely personal or household activities; or (3) require an independent school as defined in 16 V.S.A. § 11(a)(8) or a private institution of higher education, as defined in 20 U.S.C. § 1001 et seq., to delete personal data or opt out of processing of personal… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Limited carve-out: independent schools and private colleges are not required to delete data or honor opt-outs Where that would unreasonably interfere with education services or the ordinary operation of the school or institution; all other duties apply. 2415i(e)(3). Archived excerpt — the text we read …ranteed in the First Amendment to the U.S. Constitution; or (B) under 12 V.S.A. § 1615; (2) apply to any person’s processing of personal data in the course of the person’s purely personal or household activities; or (3) require an independent school as defined in 16 V.S.A. § 11(a)(8) or a private institution of higher education, as defined in 20 U.S.C. § 1001 et seq., to delete personal data or opt out of processing of personal data that would unreasonably interfere with the provision of education services by or the ordinary operation of the school or institution. (f) Personal data processing. (1) Personal data processed by a controller or consumer health data controller pursuant to this section may be processed to the extent that the processing is: (A) reasonably necessary and p… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Evidentiary privilege (compliance would violate a Vermont evidentiary privilege) Archived excerpt — the text we read …accordance with the internal operations exception established in COPPA if the controller, processor, or consumer health data controller is processing data in accordance with the exception. (c) Evidentiary privilege. (1) The obligations imposed on controllers, processors, or consumer health data controllers under this subchapter shall not apply if compliance by the controller, processor, or consumer health data controller with this subchapter would violate an evidentiary privilege under the laws of this State. (2) This subchapter shall not be construed to prevent a controller, processor, or consumer health data controller from providing personal data concerning a consumer to a person covered by an evidentiary privilege under… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Privileged communications to a person covered by an evidentiary privilege Archived excerpt — the text we read …trollers under this subchapter shall not apply if compliance by the controller, processor, or consumer health data controller with this subchapter would violate an evidentiary privilege under the laws of this State. (2) This subchapter shall not be construed to prevent a controller, processor, or consumer health data controller from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this State as part of a privileged communication. (3) Nothing in this subchapter modifies 2020 Acts and Resolves No. 166, Sec. 14 or authorizes the use of facial recognition technology by law enforcement. (d) Third parties. (1) A controller, processor, or consumer heal… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source
Rights and freedoms of others, including free speech and press Archived excerpt — the text we read …ressions of the controller, processor, or consumer health data controller from which the third-party controller or processor receives the personal data. (e) Clarifications. This subchapter shall not be construed to: (1) impose any obligation on a controller or processor that adversely affects the rights or freedoms of any person, including the rights of any person: (A) to freedom of speech or freedom of the press guaranteed in the First Amendment to the U.S. Constitution; or (B) under 12 V.S.A. § 1615; (2) apply to any person’s processing of personal data in the course of the person’s purely personal or household activities; or (3) require an independent school as defined in 16 V.S.A. § 11(a)(8) or a private institut… Archived from source — captured 2026-08-03 · snapshot 06e6c157 Verify at the source

Published Sep 29, 2026 from the DataGrail regulation engine; each fact links to its primary source.

Timeline

The road to VDPOSA enforcement

This state currently has one dated milestone on the books.

Enforcement January 1, 2028

VDPOSA takes effect

Enforcement begins — obligations are live from this date.

Source: primary citation

Published Sep 29, 2026 from the DataGrail regulation engine; each fact links to its primary source. Reference only, not legal advice.

Status Maximum penalty per violation

When staying on top of the law isn't enough, DataGrail automates the work.

DSR automation and regulatory tracking — handled by the platform behind this reference.

How DataGrail helps

Back to the Regulations Hub Reference only — not legal advice. Published Sep 29, 2026