More than just maple syrup: Vermont passes consumer privacy bill | McDermott Will & Schulte
More than just maple syrup: Vermont passes consumer privacy bill | McDermott Will & Schulte
https://www.jdsupra.com/legalnews/more-than-just-maple-syrup-vermont-4865291/
Publish Date: 2026-06-04 16:20:00
Source Domain: www.jdsupra.com
On May 29, 2026, Vermont’s legislature passed S71, the Vermont Data Privacy and Online Surveillance Act (the Act). The Act is now pending Vermont Governor Phil Scott’s signature. If signed, it would become effective January 1, 2028.
The Act revives data privacy legislation in Vermont after Governor Scott vetoed a previous version. Unlike its predecessor, this Act much more closely aligns to other state consumer privacy bills drafted in the Connecticut style. That said, as with any new consumer privacy law, companies doing business in the state should assess the applicability of the Act and implement a compliance program.
In Depth
Who does the Act apply to?
The Act applies to anyone who does business in Vermont or offers products or services to Vermont residents and who, in the preceding calendar year, engaged in any of the following:
- Controlled or processed the personal data of at least 35,000 Vermont residents; or
- Controlled or processed the sensitive personal data of at least 3,000 Vermont residents; or
- Offered to sell the personal data of at least 3,000 consumers.
The Act’s consumer health data provisions (described below) apply more broadly. Provisions in the Act relating to health data dispense with the numerical thresholds and apply to anyone that does business in Vermont or, when offering products or services, targets Vermont residents.
Two notable aspects of the Act’s applicability threshold include the relatively low number of consumers that trigger application of the Act, and the fact that the mere offering to sell or process sensitive data for a collection of state residents alone would be sufficient to trigger application of the Act.
Who is a “consumer”?
The definition of “consumer” in the Act aligns with the majority of other state consumer privacy laws. A “consumer” is “an individual who is a resident of [Vermont].” The term does not include individuals acting in a commercial or employment context.
