Vermont Enacts Comprehensive Consumer Privacy Law - Mayer Brown
Vermont has enacted a comprehensive consumer privacy law, joining the ranks of states like California and Virginia. The law introduces new requirements for data brokers, opt-out mechanisms, and risk assessments, affecting businesses that collect or process personal data of Vermont residents.
Aforeworn detected this change in the US State Data-Privacy Laws space on July 18, 2026 and published this briefing so affected operators are forewarned rather than caught off guard. It is rated High urgency. Multistate retailers, adtech/data brokers, SaaS platforms, privacy consultants should confirm how it applies to their specific situation before acting. There is a time constraint attached: The law takes effect on July 1, 2024, with enforcement likely starting shortly after. Immediate action is needed to meet the deadline.. Acting after that point can mean penalties, a lapsed licence, or lost eligibility — exactly the kind of surprise Aforeworn exists to prevent. Aforeworn monitors US State Data-Privacy Laws continuously and turns every detected change into a plain-English briefing like this one, so you always know first. Forewarned is forearmed.
What changed
Vermont now has a comprehensive privacy law with provisions similar to CCPA/CPRA, including a universal opt-out mechanism, sensitive data protections, and risk assessment requirements for automated decision-making technologies (ADMT).
Who it affects
Multistate retailers, adtech/data brokers, SaaS platforms, privacy consultants
What you must do
Review and update privacy policies, implement universal opt-out signals (e.g., Global Privacy Control), conduct data mapping and risk assessments for ADMT, and ensure compliance with data minimization principles.
Deadline
The law takes effect on July 1, 2024, with enforcement likely starting shortly after. Immediate action is needed to meet the deadline.
Never miss a change like this again
Aforeworn watches US State Data-Privacy Laws around the clock and alerts you the moment a rule moves — with a plain-English brief on what to do.
Start your free trialRelated changes in US State Data-Privacy Laws
- California's Delete Act forces brokers to erase personal data starting August 1 - ABC7 Bay Area
- New Jersey Adopts New Data Broker Registration Regime and Sensitive Data Sale and Licensing Restrictions - Hunton Andrews Kurth LLP
- Supreme Court rules geofence warrants are Fourth Amendment searches - JD Supra
- Villanueva law to protect patients’ reproductive health records - Illinois Senate Democratic Caucus
- US-CONGRESS BILLS-119s4946is: Health and Location Data Protection Act of 2026