Vermont Data Privacy and Online Surveillance Act (Act 145) Reference Guide

Under enacted § 2415b(a), an organization doing business in Vermont or targeting residents meets ordinary scope if in the preceding calendar year it controlled or processed at least 35,000 consumers’ personal data, at least 3,000 consumers’ sensitive data, or offered for sale at least 3,000 consumers’ personal data. The first two routes exclude payment-only processing from the count. Vermont Legislature: Act 145 as enacted

Section 2415b(b) separately reaches Vermont-facing persons for § 2415k and provisions concerning consumer health data and its controllers without applying those ordinary numerical thresholds. Counsel must also assess enumerated exemptions in § 2415c; a scan cannot count people or decide whether health data and an exemption are involved. Vermont Legislature: Act 145 as enacted

Act 145 sets access, correction, deletion, portability and opt-out rights for eligible consumers and requires controllers to describe secure ways to exercise them. Its notice and processing requirements should be mapped to vendors, assessments and internal request handling ahead of January 2028. Vermont Legislature: Act 145 as enacted

The separate consumer-health-data section addresses access by employees and processors, certain geofencing near health care facilities and consent before selling or offering to sell consumer health data. A page about health or treatment could produce data flows that need more analysis even where the ordinary consumer-volume threshold is not reached. Vermont Legislature: Act 145 as enacted

Targeted advertising under the enacted act concerns ads selected using activities over time across nonaffiliated sites or applications, with exclusions for first-party, contextual and measurement-only activity. Audit embedded tags, URLs, conversion events and server transfers with their purpose and recipient rather than treating every request as a statutory sale. Vermont Legislature: Act 145 as enacted

For a health-related page, examine whether a tag, URL path, event parameter or geofence can expose consumer health data. The act’s health-data scope and sensitive-data route call for different legal questions from a generic ad-tech audit. Technical observations must be paired with the actual agreements and data meaning. Vermont Legislature: Act 145 as enacted

The rights-access section calls for a clear website link to a page enabling an opt-out of targeted advertising or sale and an opt-out preference signal sent with the consumer’s consent through a qualifying platform or technology. Conditions include an affirmative choice, ease of use, alignment with similar mechanisms and the ability to determine residency and legitimacy. Vermont Legislature: Act 145 as enacted

A GPC test can reveal whether a site receives and propagates a candidate signal, but counsel should decide whether the particular mechanism meets Vermont’s enacted conditions. Act 145 also describes how a signal conflicting with an existing controller-specific setting or loyalty program is treated: comply with the signal, then potentially offer a choice to confirm the other setting. Vermont Legislature: Act 145 as enacted

Act 145 takes effect January 1, 2028. It assigns enforcement to the Vermont Attorney General and expressly states that its subchapter creates no private right of action. Its separate transition section directs a notice of violation before an action from January 1, 2028 through June 30, 2029 if the Attorney General determines a cure is possible. Vermont Legislature: Act 145 as enacted

If noticed during that window, an alleged violator has 60 days after receipt to cure before an action may be brought under that provision. This is conditional, temporary and future-effective; it should not be described as an unconditional or existing 2026 cure guarantee. Vermont Legislature: Act 145 as enacted

Begin with the three ordinary thresholds and § 2415b(b)’s health-data rule. Legal and privacy teams should determine whether a site’s events expose consumer health data, which exemptions apply, how any sale is classified and how the notices and requests will operate. Vermont Legislature: Act 145 as enacted

Engineering should inventory pages, tags, URLs, server events and recipients, then test consent rejection, direct opt-out and qualifying preference-signal behavior. Repair unexpected flows under approved legal classifications, maintain a dated technical baseline and revisit Act 145 near the January 2028 effective date. Vermont Legislature: Act 145 as enacted

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, rights-request procedures, sensitive-data obligations, and organizational governance should be handled by qualified privacy counsel.

The Vermont Legislature’s final Act 145 and S.71 record are the sources. This guide uses its official short title, distinguishes § 2415b(a) from § 2415b(b), and labels every obligation as future-effective until January 1, 2028.

Prepared by Etalon Editorial Team. Last reviewed September 28, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for coverage, exclusions, classifications, notices, requests, sensitive data, children, contracts, assessments and governance. The Act 145 (S.71, 2026); 9 V.S.A. ch. 61A is enacted but its obligations are not yet in force; a present scan cannot establish a violation of this future-effective law.