Preparing for Vermont’s New Privacy Framework: Understanding S.71 (Act 145)

Written by: Victoria Xikis

Vermont has joined the growing movement of US states that are giving their residents control over their own personal data by passing its first comprehensive Data Privacy and Online Surveillance Act. On June 16, 2026, Vermont’s governor Phil Scott formally signed S.71 (Act 145) which is set to take effect on January 1, 2028. This act extends the control residents have on their data collection, targeted advertising, and data processing, and it bans manipulative design practices, which are deemed misleading design tactics used in websites or apps to trick consumers into agreeing to share their personal data. [1]

Brief Overview:

• S.71 (Act 145) is Vermont’s first comprehensive consumer data privacy law.
• Vermont previously considered a different privacy bill (H.121), which was vetoed largely due to its inclusion of a private right of action.[2]

Key aspects of S.71 (Act 145):

• • Requires clear and informed consent from consumers before processing their personal data.
  • Clearly defines terms such as “consumer,” “personal data,” and “biometric data.”
  • Creates a comprehensive legal framework to enhance consumer control over their personal data to avoid manipulation.
  • Bolsters the protection of minors.
  • Requires organizations to be transparent regarding their use of AI systems.[2]

What to Know About S.71 (Act 145):

S.71 (Act 145) provides consumers with the right to access, correct, and delete their personal data as well as opt out of certain processing activities. The bill directs organizations to respond to consumer requests within a set timeframe and requires them to clearly disclose how they collect and use data, especially related to a minor. Vermont’s Attorney General will be responsible for enforcing the act and may issue “notices of violation” to businesses that are not in compliance. The Attorney General will also oversee public education initiatives regarding consumer rights and obligations under the act.[2]

Consumer Rights:

Vermont residents will gain several important privacy rights that provide greater transparency and control over how businesses collect, use, and share their data.
Under S.71, consumers will have the following rights:

• Consent: Provide informed consent for collection of personal data.
• Transparency: Inquire and confirm what data is collected and how it is used.
• Access: Access to correct their personal data.
• Delete or Transfer: Request data deletion or transfer their information to another organization.
• Opt-Out: Decline certain data processing activities, such as targeted advertising, data sales, and profiling.
• Disclosure: Receive information regarding the use of AI in their personal data.[3]

Business Restrictions:

• Businesses cannot process sensitive data without a consumer’s consent
• Businesses cannot sell personal data of minors without consent nor:
  • Sell adult personal data for the purpose of targeted advertising without an opt out option and clear disclosure; or,
  • Sell consumer health data without express consent or provide any agent employed by the business with access to this data unless they are bound by confidentiality.
• Businesses cannot retain any personal data that is processed on behalf of another business after expiration of their services; and
• Businesses cannot delete data in order to avoid a subpoena.[2]

Business Compliance Requirements:

• Businesses must respond to a consumer access or other request within 45 days, and if they decline to take action, they must provide justification and outlined instructions on how a consumer may appeal this decision.
  • If the appeal is declined, the business must provide an “online mechanism” for consumers to submit a complaint to the Attorney General.
• Businesses may deny an opt-out request from a consumer if it is believed to be fraudulent, but they must provide justification.
  • Additionally, businesses may decline action or charge an administrative fee if a consumer’s requests are excessive and lack foundation.
• Businesses are required to conduct data protection assessments for activities that pose a “heightened risk” of harm to a consumer, and these assessments may also be conducted upon request by the Attorney General in relation to an investigation.[3]
  • Data Protection Impact Assessments (DPIAs) analyze privacy risks when processing, using, and storing consumer personal information with a focus on any risks to their freedom or rights.[4]

Enforcement Authority:

Consumers cannot directly sue businesses under S.71. Instead, the Attorney General has the power of enforcement, which includes issuing notices of violation if one is believed to have occurred. These notices will provide businesses with 60 days to cure the violation. If a business has not remedied the violation within the allotted timeframe, then the state attorney general may bring legal action against the violating business.[3]

Minor Protections Under COPPA:

Businesses under S.71 must adhere to the Children’s Online Privacy Protection Act (COPPA) when processing minors’ data and cannot use the data collected for targeted advertising nor sell the minor’s personal data.[2] COPPA is a federal law that oversees the data of minors and imposes requirements on how that data can be used. Additionally, organizations must use reasonable care in order to avoid harm to minors and provide continuous notice when precise geolocation is collected from a minor.[5]

Differences Between H.121 and S.71:

The vetoed 2024 H.121 bill included a broader privacy framework proposal that primarily focused on minor protections, allowed for private rights of action by consumers that were coupled with attorney general enforcement, and lacked a requirement of AI disclosure when processing consumer data.[6]

The main distinctions between these two bills are that S.71 imposes significant limits on business data collection and took away the opportunity for consumers to directly pursue private rights of action. In addition, H.121 contained stronger protections for minors online through an “Age-Appropriate Design Code,” and provided consumers with the opportunity to pursue private rights of action for legal remedies. However, it was vetoed primarily because Governor Scott believed that the private right of action provision would create litigation exposure for Vermont businesses.[6]

How This Will Impact Businesses and Consumers:

Consumers will benefit from having more control over how their personal data is used and shared, even though they cannot bring private lawsuits against businesses under S.71. Businesses will likely face increased compliance responsibilities, including updates to privacy notices, consumer request procedures, and internal data assessment practices. Compliance with personal data and health data protection requirements may be burdensome for both small and large businesses because these obligations can be time consuming and costly.

Conclusion:

While S.71 does not take effect until 2028, both Vermont consumers and businesses with operations in Vermont can begin preparing now. Consumers should familiarize themselves with their new privacy rights to better understand how their personal information is being collected and used.

Businesses are encouraged to use the implementation period to review their data collection practices, update their privacy notices, evaluate their AI-related disclosures, and assess whether their current privacy programs are sufficient to meet Vermont’s new requirements. As privacy regulation continues to expand across the United States, organizations that begin the necessary steps for a smoother transition sooner rather than later will be in a better position to adapt to the implementation of this new law.

 

References

[1]See, e.g., Wen-Ting Yang & Mark Leiser, Illuminating Manipulative Design: From “Dark Patterns” to Info. Asymmetry and the Repression of Free Choice Under the Unfair Com. Prac. Directive (2023).
“Illuminating Manipulative Design: From “Dark Patterns” to Information ” by
Wen-Ting Yang and Mark Leiser.
[2]See, e.g., Ben Kinsley, Consumer Data Privacy (S.71) – Overview, (2025)
Consumer Data
Privacy (S.71) 2025 – Campaign for Vermont
[3]See, e.g., LegiScan, Bill Text: VT S0071, LegiScan (2026),
VT S0071 | 2025-2026 | Regular
Session | LegiScan
[4]See, e.g., Osano, PIA vs. DPIA: What’s the Difference?, JDSUPRA (2024), PIA vs. DPIA: What’s the Difference? | Osano – JDSupra PIA vs. DPIA: What’s the Difference? | Osano – JDSupra
[5]See, e.g., Fed. Trade Comm’n, Children’s Online Privacy Protection Rule, (2025)
https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-
protection-rule
[6]See, e.g., LegiScan, Bill Text: VT H0121, LegiScan (2024), VT H0121 | 2023-2024 | Session | LegiScan Bill Texts: VT H0121 | 2023-2024 | Session | LegiScan