When Does Vermont's Data Privacy and Online Surveillance Act Take Effect for Marketers?

Vermont's Data Privacy and Online Surveillance Act, enacted as Act 145 (S.71), takes effect January 1, 2028. Governor Phil Scott signed the bill on June 16, 2026, giving businesses that advertise to Vermont residents roughly 18 months to build a compliance program before the law reaches targeted advertising, data sales, and profiling activity.

Three Separate Thresholds, Not Just One

A business falls under the law if it does business in Vermont or targets Vermont residents and meets any one of three separate tests: it processes the personal data of at least 35,000 Vermont consumers (not counting data processed solely to complete a payment transaction), it processes the sensitive data of at least 3,000 consumers, or it sells the personal data of at least 3,000 consumers. That three-way structure means a business can trigger the law through a thin slice of sensitive-data or data-sale activity even if its overall Vermont audience is small — the sensitive-data and sale thresholds sit ten times lower than the general one.

A Geofencing Ban Built Specifically for Health Advertisers

Vermont's law gives consumer health data its own heightened protections, going beyond the standard opt-out-for-targeted-ads model most state laws use. Controllers cannot sell health data without consent, and the law separately bars geofencing a mental health facility, reproductive or sexual health facility, or similar healthcare location within 1,850 feet for the purpose of identifying, tracking, or sending a notification to a consumer. Any healthcare marketer running geofenced campaigns around clinics in Vermont needs to rule this out specifically, since it's a narrower and more specific restriction than a general targeted-advertising opt-out.

New Rights Beyond the Standard Package

Consumers get the now-common rights: access, correction, deletion, and portability, plus opt-out rights for targeted advertising, data sales, and certain profiling. Vermont adds two less common rights on top: consumers can request a list of the specific third parties that received their sold personal data, rather than just a general disclosure that sales occur, and they can question or appeal certain automated profiling decisions that produce a legal or similarly significant effect.

Built on the Connecticut Model, With Exemptions

Legal trackers describe Vermont's law as following the Connecticut-style framework that a majority of recent state privacy laws use, which should make compliance incremental for businesses that already have a program built around Connecticut, Colorado, or Virginia's laws. HIPAA-covered entities and their business associates, GLBA-regulated financial institutions, certain banks and their affiliates, and FERPA-covered educational data are exempt from the law entirely.

Enforcement Sits Entirely With the Attorney General

The Vermont Attorney General has exclusive enforcement authority, and the law includes no private right of action, so individual consumers cannot sue over a violation directly.

Bottom Line

If your campaigns reach Vermont residents, flag any geofenced advertising near healthcare facilities now — that 1,850-foot restriction is a narrower rule than the general consent model most state laws use, and it's the provision most likely to catch a healthcare or wellness advertiser off guard before January 1, 2028.

Sources: Vermont Act 145 (S.71), Data Privacy and Online Surveillance Act, signed June 16, 2026 (legislature.vermont.gov); Mayer Brown, "Vermont Enacts Comprehensive Consumer Privacy Law"; Hunton Andrews Kurth Privacy and Cybersecurity Law Blog, "Vermont Becomes 23rd State With Comprehensive Consumer Privacy Law."