Vermont

Law: Vermont Data Privacy and Online Surveillance Act

The act's official or short title as the statute or the state's official page gives it, with its code citation if stated.

Vermont Data Privacy and Online Surveillance Act

Source: https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf. Read 2026-11-01. Read once.

Takes effect: January 1, 2028

The first date the law's main consumer-privacy duties apply to businesses, as stated by the statute or state. Ignore later phase-ins for specific provisions.

This act shall take effect on January 1, 2028.

Source: https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf. Read 2026-11-01. Read once.

Who it applies to: Not looked at yet

The law's applicability threshold in short form, as the statute states it, such as revenue or number of consumers processed.

No source we could use stated this. A blank never means no.

Consumers threshold: 35000 consumers

The lowest number of state consumers whose personal data triggers the law on its own, without a revenue test. Null if the law has no such number.

controlled or processed the personal data of not fewer than 35,000

Source: https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf. Read 2026-11-01. Read once.

Cure period: 60 days

Days the statute gives a business to fix a violation before enforcement. Null if the law gives no right to cure.

fails to cure the violation within 60 days after receipt of

Source: https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf. Read 2026-11-01. Read once.

Cure period ends: June 30, 2029

The date the right to cure sunsets, as stated in the statute. Null if there is no cure period or it does not expire.

During the period beginning January 1, 2028, and ending on June 30, 2029,

Source: https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf. Read 2026-11-01. Read once.

Enforced by: Attorney General

The official or agency the statute names as enforcer.

The Attorney General has the same authority to enforce

Source: https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf. Read 2026-11-01. Read once.

Maximum penalty: 10000 USD per violation

The highest civil penalty per violation stated in the statute, including higher tiers such as intentional violations. Use the statute's base figure, not inflation-adjusted amounts, unless the statute itself states the adjusted figure.

a civil penalty of not more than $10,000.00 for each unfair or deceptive act or practice in commerce

Source: https://legislature.vermont.gov/statutes/section/09/063/02458. Read 2026-11-01. Read once.

Private right of action: No

True if consumers can sue directly under the law for any violation. False if the statute says it creates no private right of action or leaves enforcement solely to the state.

private right of action for violations of this subchapter or any other law.

Source: https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf. Read 2026-11-01. Read once.

Opt-out signal required: Yes

True if the statute requires businesses to honor a universal opt-out signal or preference signal, such as Global Privacy Control, now or by a stated date.

shall comply with the

Source: https://legislature.vermont.gov/Documents/2026/Docs/ACTS/ACT145/ACT145%20As%20Enacted.pdf. Read 2026-11-01. Read once.