Vermont Joins the Growing List of States With Comprehensive Privacy Laws
Vermont Gov. Phil Scott signed Senate Bill 71, the Vermont Data Privacy and Online Surveillance Act, into law on June 16. The signing makes Vermont the 23rd state in the country to enact a comprehensive consumer data privacy law, adding another entry to a patchwork of state-level protections that has been expanding steadily over the past several years. The law will not take effect immediately: businesses and consumers have until Jan. 1, 2028, before the new rules apply.
That timeline matters. Companies operating in Vermont, or handling the personal data of Vermont residents, now have a window to review how they collect, store, and use consumer information before compliance obligations kick in. For everyday residents, the law represents a meaningful, if delayed, expansion of control over personal data that companies gather about them online.
What the Vermont Data Privacy and Online Surveillance Act Covers
The Vermont Data Privacy and Online Surveillance Act follows a pattern familiar to anyone tracking state privacy legislation. It establishes rights for consumers to access, correct, and delete personal information held by businesses, along with the ability to opt out of certain data practices. What sets Vermont apart from many earlier state laws is the explicit inclusion of "online surveillance" in its name and scope, signaling that lawmakers wanted to address not just data collection in the abstract but the broader ecosystem of tracking, profiling, and monitoring that has become common across websites, apps, and connected devices.
By joining the ranks of states like Louisiana, which enacted its own Louisiana Data Privacy Act set to take effect in 2027, Vermont adds to a growing regional trend of states moving ahead of federal action on privacy. Readers who want a deeper breakdown of the law's specific provisions can find a fuller explainer in our coverage of what the Vermont Data Privacy and Surveillance Act means in 2028, which walks through the compliance details business owners and residents should watch for as the effective date approaches.
This is not Vermont's first attempt at comprehensive privacy legislation. The state's path to S.71 involved earlier legislative efforts, and our previous reporting on when Vermont passed Senate Bill 71 traces how the bill moved through the statehouse before reaching the governor's desk.
Why the Surveillance Angle Stands Out
Most state privacy laws focus narrowly on data collection, sale, and consumer rights requests. Vermont's decision to fold "online surveillance" into the title of its law reflects a broader public conversation happening across the country about tracking technologies that extend well beyond typical data brokers and advertisers. That conversation has touched everything from browser fingerprinting to physical surveillance tools. Debates over automated license-plate readers and camera networks, for instance, have drawn political attention in other states, as seen in ongoing pushback like the one detailed in our report on opposition to Flock camera surveillance. Vermont's law does not directly regulate that category of surveillance technology, but its framing suggests lawmakers are increasingly aware that "privacy" today means more than just how a website handles a shopping cart's worth of data.
What This Means For You
If you live in Vermont, the practical effects of this law will not arrive overnight. Businesses have roughly a year and a half to build compliance programs, which means the rights created by the Vermont Data Privacy and Online Surveillance Act, such as accessing, correcting, or deleting your personal data, will not be enforceable until Jan. 1, 2028. In the meantime, it is worth paying attention to how companies you interact with communicate about data practices, since many will start adjusting policies well before the deadline to avoid a last-minute scramble.
For businesses, especially smaller companies that may not have dedicated privacy or legal teams, the lead time is an opportunity rather than a burden. Mapping out what personal data is collected, where it is stored, and who it is shared with now will make the eventual compliance process far less disruptive.
Key Takeaways
Vermont's new law adds another state to the expanding list of comprehensive privacy statutes, reinforcing a trend that shows no sign of slowing as more legislatures act in the absence of a single federal standard. Residents should watch for updated privacy notices from companies they use regularly as the 2028 effective date nears, and businesses with any Vermont customers should begin reviewing their data practices sooner rather than later. As more states pass their own versions of these laws, staying informed about how each one differs, and what rights it actually grants, remains one of the simplest ways consumers can protect their personal information in an increasingly data-driven economy.
