Vermont Data Privacy and Online Surveillance Act

Vermont's comprehensive consumer privacy law, 9 V.S.A. chapter 61A (Act 145 of 2026), effective 1 January 2028: low thresholds (35,000 consumers, or 3,000 for sensitive data or sale), rights including access to inferences, a list of data buyers and contestation of significant profiling decisions, consent and necessity for sensitive data including neural and health data, no targeted advertising or sale for teens, opt-out preference signals, a privacy notice disclosing large language model training, data protection and profiling impact assessments, and consumer health data rules for every business, including a geofencing ban near health facilities. Enforced by the Attorney General. Built from the act as enacted, read in full. It comprises 45 controls organised across 6 domains, and applies in the United States - Vermont.