The map of U.S. privacy regulation continues to expand.

On June 16, 2026, Vermont Governor Phil Scott signed Senate Bill 71, officially enacting the Vermont Data Privacy and Online Surveillance Act (VDPOSA). On the same day, he also signed Senate Bill 639, establishing a new framework governing the collection, use, and disclosure of consumers’ genetic information. Together, the two laws make Vermont the latest state to strengthen consumer privacy protections and continue the growing trend of state-led privacy legislation in the absence of a comprehensive federal privacy law.

For businesses, the message is increasingly clear: privacy compliance is no longer limited to California or a handful of jurisdictions. Organizations operating across the United States must now navigate an expanding patchwork of state privacy laws, each with its own obligations, consumer rights, and enforcement mechanisms.

A Growing Patchwork of State Privacy Laws

The Vermont Data Privacy and Online Surveillance Act introduces a comprehensive privacy framework requiring covered organizations to collect only personal information that is reasonably necessary for specified purposes, maintain appropriate administrative, technical, and physical safeguards, publish transparent privacy notices, and provide mechanisms for consumers to exercise their statutory rights. Processing sensitive personal information generally requires the consumer’s consent, reflecting an increasingly common approach among modern U.S. privacy laws.

The legislation follows a growing national trend, with Alabama, Louisiana, Oklahoma, and Vermont all adopting comprehensive privacy legislation during the 2026 legislative session. While the legal requirements differ from state to state, the direction is consistent: greater transparency, increased accountability, and stronger consumer control over personal information.

More Control for Consumers

Vermont residents will receive several new rights over their personal information. Subject to applicable exceptions, consumers may request access to the personal information organizations maintain about them, correct inaccuracies, obtain a portable copy of their data, request deletion of certain personal information, and opt out of targeted advertising, the sale of personal information, and qualifying profiling activities that produce significant legal or similarly significant effects.

These rights are designed to give individuals greater visibility into how their information is collected and used while providing meaningful mechanisms to influence those practices.

Sensitive Data Takes Center Stage

One of the most significant aspects of the legislation is its treatment of sensitive personal information. Health information, genetic and biometric data, precise geolocation information, government-issued identifiers, and information revealing characteristics such as race, religion, sexual orientation, or gender identity receive heightened protection under the Act.

The law also places restrictions on certain forms of geofencing around healthcare facilities, limiting the use of location-based technologies to identify or target individuals because they visited hospitals, reproductive healthcare providers, or similar medical facilities. As concerns surrounding digital surveillance continue to grow, this provision represents another step toward protecting individuals in particularly sensitive settings.

Vermont Draws a Line Around Genetic Information

Senate Bill 639, the Genetic Information Privacy Act, complements the broader privacy legislation by introducing dedicated protections for genetic information. Organizations handling genetic data must obtain appropriate consent before engaging in certain uses or disclosures, including the sale of covered genetic information where permitted by the Act. The law also strengthens consumers’ ability to request deletion of genetic information and, where applicable, the destruction of biological samples in accordance with statutory requirements.

As direct-to-consumer genetic testing becomes increasingly common, Vermont’s legislation recognizes that DNA data presents unique privacy risks extending beyond the individual to biological family members.

What Businesses Should Be Doing Now

Organizations operating in Vermont or serving Vermont residents should begin assessing whether their existing privacy programs align with the new legal requirements. This includes reviewing privacy notices, consent mechanisms, data inventories, vendor management practices, consumer rights request workflows, and security controls. Businesses that already comply with other comprehensive state privacy laws may have many foundational controls in place, but Vermont introduces state-specific obligations that warrant careful review before the law becomes effective.

A Strong Step Forward: But Not Without Questions

Although the legislation was signed in June 2026, most provisions of the Vermont Data Privacy and Online Surveillance Act will take effect on January 1, 2028, providing organizations with additional time to prepare for compliance. Supporters view this implementation period as a practical opportunity for businesses to build mature privacy programs, while critics argue that it delays meaningful protections for consumers.

The law is enforced by the Vermont Attorney General and does not generally create a private right of action. It also includes a temporary 60-day cure period through June 30, 2029, allowing organizations to address certain violations before formal enforcement proceeds. Whether this approach achieves the right balance between encouraging compliance and ensuring accountability will likely remain a topic of discussion within the privacy community.

And so,

Vermont’s latest legislation reflects the continued evolution of privacy regulation in the United States. As more states enact comprehensive privacy laws, organizations can no longer rely on a one-size-fits-all compliance strategy. Privacy governance must become an ongoing operational function supported by transparent data practices, effective consent management, robust security controls, and responsive consumer rights processes.

Organizations that invest in privacy by design today will be better positioned to meet tomorrow’s regulatory expectations while strengthening consumer trust in an increasingly data-driven economy.

References

1. Vermont General Assembly. Senate Bill 71 – Vermont Data Privacy and Online Surveillance Act.
2. Vermont General Assembly. Senate Bill 639 – Genetic Information Privacy Act.
3. International Association of Privacy Professionals (IAPP). Vermont becomes the 23rd state to enact a comprehensive privacy law.
4. National Conference of State Legislatures (NCSL). Consumer Data Privacy Legislation.

Future of Privacy Forum (FPF). U.S. State Privacy Legislation Tracker.