Learn about the Vermont Data Privacy Act (VDPA) and its implications for businesses operating in Vermont. Discover key provisions, compliance requirements, consumer rights, and enforcement measures to prepare for the July 1, 2025, implementation.
The Vermont legislation bodies passed the Vermont Data Privacy Act (VDPA), the state's landmark data privacy bill. It brings significant data minimization requirements on the amount of personal data companies can collect and use, among other duties. It also grants consumers privacy rights and threatens with penalties to controllers who do not comply.
To understand it better and to prepare for compliance in 2025, read this article and start making plans to adjust.
Explore more privacy compliance insights and best practices
The Vermont Data Privacy Act is Vermont's comprehensive privacy legislation, set to take effect on July 1, 2025. This act aims to enhance data protection and privacy rights for Vermont residents. Notably, it grants individuals a private right of action starting from January 1, 2027, allowing them to seek legal recourse for violations of their data privacy rights.
The Vermont Data Protection Act (VDPA) applies to persons conducting business in Vermont or producing products or services targeted to Vermont residents, who during the preceding calendar year:
The health data provisions apply to all persons conducting business in Vermont or producing products or services targeted to Vermont residents, regardless of the number of consumers' data controlled or processed.
Personal data is any information that could identify an individual, directly or indirectly.
The VDPA goes further to define what sensitive data is. The definition is necessary because the law gives it a special regime.
The following categories of data are considered sensitive:
According to the VDPA, "sensitive data" includes personal data that:
A controller must provide a privacy policy that is reasonably accessible, clear, and meaningful, containing the following information:
Consumers in Vermont have the right to:
Consumers can submit consumer requests and you'll be abliged to respond within 45 days.
The Vermont Data Privacy Act requires businesses to provide clear opt-out mechanisms for consumers. Specifically, businesses must offer a conspicuous link on their website that allows consumers to opt out of the sale of their personal data. This link should be easily accessible and prominently displayed, ensuring that consumers can exercise their opt-out rights without difficulty.
In addition to the direct opt-out link, businesses are also required to recognize universal opt-out mechanisms. This means that businesses must comply with signals sent by consumers through browser settings or other automated tools indicating their preference to opt out of data sales.
Controllers, i.e. the companies who decide to process data, have the following general duties:
Processors, the companies you hire to process data on your behalf, have the following duties:
Controllers are required to conduct and document a data protection assessment for processing activities that present a heightened risk of harm to a consumer. This general requirement ensures that controllers thoroughly evaluate and mitigate potential risks associated with their data processing activities.
Specific situations requiring a data protection assessment include processing personal data for targeted advertising, selling personal data, and profiling that poses a reasonably foreseeable risk of unfair or deceptive treatment, financial, physical, or reputational injury, or significant intrusion into consumers' private affairs. Additionally, processing sensitive data necessitates an assessment to ensure appropriate safeguards are in place.
Controllers must retain data protection assessments for at least five years. The Attorney General can request disclosure of these assessments during investigations, but such disclosures do not waive attorney-client privilege or work product protection and remain confidential under the Public Records Act.
Attorney General enforces the Vermont privacy law. The fines are up to $10.000 per violation, which is higher than the usual $7.500 in other states.
However, no one would be fined if they remedy the violation within a 60-day cure period.
The VDPA also provides for a private right of action in specific circumstances. Notably, this right is available to consumers harmed by violations committed by data brokers or large data holders, as outlined in the bill.
