Key takeaways
- Vermont Governor Phil Scott signed Senate Bill 71, creating the state's first comprehensive data privacy framework.
- The Vermont Data Privacy and Online Surveillance Act governs the collection, use, disclosure, sale, and protection of personal data.
- Enforcement of the new regulations is scheduled to begin on January 1, 2028.
- Vermont is now the 23rd state in the nation to pass a comprehensive data privacy law.
The Development
Around June 26, 2026, legal media reported that Vermont Governor Phil Scott signed SB 71 (Vermont) into law. Officially titled the Vermont Data Privacy and Online Surveillance Act, the legislation establishes comprehensive state privacy regulations for Vermont. The new statutory framework governs the collection, use, disclosure, sale, and protection of personal data by entities doing business in the state. Under the terms of the legislation, the substantive requirements will become enforceable starting January 1, 2028.
By signing the bill, Governor Scott finalized a legislative effort to bring Vermont in line with a growing national movement toward localized data protection. The enactment firmly establishes a new regulatory baseline for any company that targets Vermont residents or processes their personal information on a large scale.
Why It Matters
With this enactment, Vermont becomes the 23rd state to pass a comprehensive data privacy law. The proliferation of state-level privacy statutes requires companies operating nationally to comply with a fragmented map of varying regulations. Because Congress has not passed a unified federal privacy statute, state legislatures continue to fill the void, creating distinct compliance obligations across different jurisdictions.
The Vermont Data Privacy and Online Surveillance Act adds another layer of legal responsibility for businesses that process consumer data. By establishing specific rules for data collection and disclosure, the legislation limits how companies can monetize personal information without consumer awareness or consent. Legal practitioners argue that reaching the 23-state mark indicates a sustained trend toward localized data governance. This milestone forces businesses to adopt broad compliance strategies rather than attempting to manage state-by-state policies, which often prove inefficient and prone to error.
Who Should Care
For lawyers
Corporate counsel and privacy attorneys must begin auditing their clients' data processing activities to ensure alignment with the Vermont Data Privacy and Online Surveillance Act before the January 1, 2028, enforcement date. Practitioners will need to map data inventories, review vendor contracts, and update privacy policies to address Vermont's specific requirements regarding the collection, sale, and protection of personal data. Because Vermont joins 22 other states with similar frameworks, attorneys should evaluate whether a unified compliance approach is more efficient than a jurisdictional one. Attorneys advising technology companies, data brokers, and retail corporations will be particularly busy preparing compliance roadmaps ahead of the enforcement date.
For consumers
Vermont residents will gain new legal rights concerning their personal information. The law provides mechanisms to control how businesses collect, use, and sell private data. Once the law becomes enforceable in 2028, consumers will have statutory backing to demand transparency and accountability from companies that hold their digital information. This means individuals will have greater visibility into what data is being collected about them and who is purchasing that information.
Legal Background
Before the passage of SB 71 (Vermont), Vermont lacked a single, comprehensive statutory framework governing general consumer data privacy. While the state had specific sector-based regulations, broad protections regarding the collection, use, and sale of personal data were absent.
In recent years, states across the country began enacting their own comprehensive privacy laws to address the commercial exploitation of digital information. The movement began with early adopters on the West Coast and has steadily spread eastward. Without a federal privacy law to preempt state action, state legislatures have taken it upon themselves to draft and pass their own bills. Vermont lawmakers recognized the necessity of joining this national trend to protect state residents from unchecked online surveillance and data brokering. The push for the Vermont Data Privacy and Online Surveillance Act grew out of this broader context, as legislators sought to provide their constituents with the same data rights enjoyed by residents in other jurisdictions.
What the Legislature Did
By passing the Vermont Data Privacy and Online Surveillance Act, the legislature established a comprehensive regulatory regime for personal data. The text of SB 71 (Vermont) explicitly governs the collection, use, disclosure, sale, and protection of personal information.
The legislature structured the law to give businesses a significant transition period, setting the enforcement date for January 1, 2028. This delay provides covered entities time to adjust their data architecture, renegotiate third-party contracts, and implement new compliance protocols. The legislative action firmly positions Vermont as the 23rd state to adopt such sweeping privacy measures, reflecting a deliberate policy choice to prioritize consumer data protection over unrestricted commercial data practices. By focusing on the entire lifecycle of data, the legislature ensured that the law covers modern digital business models comprehensively.
How It May Be Applied
The long lead time before the January 1, 2028, enforcement date leaves open questions about how state regulators will interpret the Vermont Data Privacy and Online Surveillance Act. Companies will likely spend the intervening months seeking regulatory guidance on specific definitions regarding the "sale," and the "disclosure," of personal data.
Furthermore, as technology advances, the application of the law to emerging data collection methods remains to be seen. Businesses may adopt a wait-and-see approach for specific rulemaking while conducting high-level data mapping exercises. If other states pass similar laws before 2028, companies might default to the strictest state standard to streamline their nationwide compliance operations. The extended implementation timeline also gives industry groups an opportunity to seek clarifying amendments during upcoming legislative sessions before enforcement begins.
Regulatory Impact Comparison
Here is a comparison of the regulatory environment in Vermont before and after the enactment of the new law:
| Feature | Prior to SB 71 | Under the Vermont Data Privacy and Online Surveillance Act |
|---|---|---|
| Comprehensive Framework | None existed in Vermont. | Establishes comprehensive state privacy regulations. |
| Data Collection & Sale | Governed by a patchwork of sector-specific rules. | Explicitly governs collection, use, disclosure, sale, and protection of personal data. |
| National Standing | Vermont was outside the group of states with broad privacy laws. | Vermont becomes the 23rd state to pass a comprehensive data privacy law. |
| Enforcement Status | Not applicable. | Becomes enforceable starting January 1, 2028. |
Plain-English Summary
Vermont has officially passed a new law to protect your digital information. Around June 26, 2026, Governor Phil Scott signed a bill that creates strict rules for how companies can collect, use, and sell your personal data. This makes Vermont the 23rd state in the country to pass this kind of broad privacy protection. The new rules will not be enforced immediately; companies have until January 1, 2028, to get their systems in order and comply with the law. This delay ensures businesses have enough time to change how they handle consumer information before facing penalties.
This article is general legal information and commentary about legal developments. It is not legal advice, does not address your specific situation, and is not a substitute for advice from a licensed attorney. Reading this article and contacting us through this website do not create an attorney-client relationship.
Sources & authorities
- SB 71 (Vermont) — source
Further reading
Additional perspectives (a link is not an endorsement):