Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Last Update: 08/01/2026 at 2:00 PM EST
Vermont Privacy Law Overhaul
Coverage from Hunton Andrews Kurth LLP, Vermont Business Magazine, and others
Articles
26
Active Days
166
The Topic
Vermont has enacted a broader privacy package centered on a comprehensive consumer privacy law, a separate genetic data statute, and new data broker registration rules. The measures expand consumer control over personal, genetic, and health-related data through consent requirements, deletion rights, opt-out signals, and disclosure obligations. They also add a public-facing regulatory structure through attorney general enforcement, broker registration, and targeted limits on data sales and geofencing.
First Article: 01/01/00
Latest Article: 07/28/26
Summary
- Vermont passed a comprehensive consumer privacy law with opt-out, access, correction, deletion, and profiling-related rights.
- The law adds notice duties, including disclosure when personal data is used to train large language models.
- A separate genetic privacy law restricts sale and disclosure of consumer genetic data and requires destruction or deletion on request.
- The package creates data broker registration requirements and a public registry in the state.
- Enforcement is centralized in the Vermont Attorney General, with no private right of action for the comprehensive privacy law.
- Consumer health data receives heightened restrictions, including limits on sale and certain geofencing near health care facilities.
History
The story has moved from a multi-state trend toward a concrete Vermont enactment: a comprehensive privacy law is now law, with exclusive attorney-general enforcement and added rules for health and AI-training disclosures. Genetic privacy remains part of the broader arc, but it is now framed within a more developed state privacy regime rather than as the sole focus.
Featured
03-23-2026
South Dakota Governor Rhoden signed the Genetic Data Privacy Act on March 23, 2026, making genetic testing security and consumer genetic data deletion rights effective July 1, 2026.
02-20-2026
Vermont lawmakers consider H.639 to regulate genetic data handling by genetic testing companies after the 2023 23andMe breach.
01-01-1900
Connecticut attorney general supports genetic privacy legislation in Hartford in 2026.
Timeline: 166 Days
Hover over any logo to see coverage summary, click for full article.
Additional Articles
⭐⭐⭐⭐⭐
Rhode Island lawmakers passed a Genetic Information Privacy Act in 2026 to require express consent and plain-language genetic data disclosures for direct-to-consumer DNA testing.
Governor Phil Scott signed Vermont’s Data Privacy and Online Surveillance Act on 16 June, granting attorney-general-only enforcement and requiring LLM training notice and opt-out controls.
Vermont legislature passed S71 on May 29, 2026, creating consumer privacy rights and stricter consumer health data duties pending Governor Phil Scott signature.
On June 16, 2026, Phil Scott signed Vermont House Bill H. 211 expanding data broker registration, breach notice, deletion rights, and penalties for noncompliance.
Vermont enacted a 2028 privacy and online surveillance law with low triggers, stronger health-data and profiling duties, and exclusive attorney general enforcement.
Vermont’s Data Privacy and Online Surveillance Act begins January 1, 2028, expanding coverage and teen and health data limits with attorney general enforcement.
Vermont enacted Senate Bill 71, effective January 1, 2028, establishing statewide privacy obligations and Attorney General enforcement with a 60-day cure period.
Vermont enacted H.639 and S.71 from 2026 and 2028 effective dates, expanding legal controls on genetic, consumer health, biometric, and neural data.
Phil Scott signed Vermont’s Data Privacy and Online Surveillance Act on June 16, 2026, requiring impact assessments and LLM training disclosures effective January 1, 2028.
On 16 June 2026, Vermont Governor signed the Data Privacy and Online Surveillance Act, effective 1 January 2028, granting Attorney General exclusive enforcement and requiring LLM training transparency.
Phil Scott signed Vermont Senate Bill S.71 on June 16, 2026, establishing VDPOSA with AG-exclusive enforcement starting January 1, 2028.
Vermont’s governor signed the Data Privacy and Online Surveillance Act on 16 June 2026, setting a 1 January 2028 start and Attorney General-only enforcement.
Vermont Governor Phil Scott signed the Data Privacy and Online Surveillance Act on 16 June 2026, setting low thresholds and Attorney General-only enforcement.
Vermont enacted H.639 and S.71 to regulate genetic and consumer health data with consent, deletion, and sharing limits enforced by the Vermont Attorney General.
Phil Scott signed Vermont's VDPOSA on June 16, 2026, taking effect January 1, 2028, with new consumer rights and health-data protections.
Vermont Governor Phil Scott signed Senate Bill 71 on 16 June, making Vermont the 23rd state to pass a comprehensive privacy law effective 1 Jan 2028.
Vermont Attorney General authority starts under S.71 signed June 16, 2026, giving consumers opt-out rights for targeted ads and personal-data sales and requiring LLM training disclosures.
Vermont signed S.71 into the Vermont Data Privacy and Online Surveillance Act on June 16, 2024, with attorney general enforcement starting January 1, 2028.
Vermont enacted H.639 and S.71 to impose stronger consent and deletion requirements for genetic and consumer health data, enforced by the Vermont Attorney General.
⭐⭐⭐
State lawmakers debate H.639 genetic data privacy bill after 23andMe controversy in January and February hearings in the state legislature.
Consumer Reports criticized Vermont S. 71 as passing the legislature with weakened privacy rights and enforcement, citing issues with targeted advertising definitions and sensitive data limits.
Alabama, Louisiana, Oklahoma, and Vermont enacted consumer privacy laws requiring notices, opt-outs, and attorney general enforcement, with Vermont setting notably low applicability thresholds.
Jessamyn West supports Vermont S.71, a bill proposing limits on business collection, use, and sale of personal data amid concerns about default tracking and consent friction.