Vermont Gov. Phil Scott signed Senate Bill 71, the Vermont Data Privacy and Online Surveillance Act, on June 16, 2026, making Vermont the 23rd state to enact a comprehensive privacy law, according to National Law Review. The law becomes enforceable January 1, 2028. It applies to businesses that handle personal data of more than 35,000 Vermont residents, process sensitive personal data of at least 3,000 residents, or sell personal data of at least 3,000 residents.
Because the thresholds are set in the low thousands of residents, a regional retailer, healthcare-adjacent business or online service with a modest Vermont customer base could be covered, especially if it handles sensitive data or sells data to partners. There is no private right of action; the state attorney general enforces the law, with a 60-day cure period for violations that expires June 30, 2029.
Check whether you could meet any of the three thresholds, including through marketing lists and website analytics. If so, put Vermont on your privacy compliance roadmap now rather than in late 2027. Ask the vendors that process customer data for you, such as CRM, email marketing, analytics and payment providers, how they support consumer rights requests and data processing agreements across multiple states.
With more states adding laws on different schedules, many businesses find it simpler to build one privacy program around the strictest requirements that apply to them and adjust for state differences, rather than handling each law separately.
Sources
Does this affect your business?
Our advisors can help you figure out the right move, at no cost.