Compliance Radar · Privacy and consent
Vermont enacts a privacy law with data minimization and health data rules, effective 2028
Vermont's privacy law, with strict data minimization, takes effect in 2028.
- Status
- Enacted; not yet in effect
- Takes effect
- January 1, 2028
- Announced
- Jun 16, 2026 (S.71, Act 145)
- Type
- law
What changed
Collection is limited to what disclosed purposes need, and new purposes need consent. A 60-day cure period runs January 1, 2028 through June 30, 2029.
Who it affects
Businesses with data of 35,000+ Vermont consumers, or 3,000+ for sensitive data or sales. Health data rules apply at any size.
What to do
- Health and wellness sites: map health data and plan consent.
- Apply data minimization to forms and tags.
- Plan opt-out handling for Vermont visitors.
What ComplyMo already handles
Page audits and daily re-checks: Growth and up. Everything else: every plan, from $19 a month.
Sources
- Vermont Legislature: S.71 (Act 145) (opens in a new tab)
- Hunton: Vermont is the 23rd state (opens in a new tab)
Summary of public sources, not legal advice.