Governance, risk & compliance
Vermont Data Privacy and Online Surveillance Act (VTDPOSA) Act 145 (2026); effective 1 Jan 2028
The Vermont Data Privacy and Online Surveillance Act (S.
71, Act 145 of 2026, 9 V. S.
A. 2415a to 2415k), signed 16 June 2026 and effective 1 January 2028.
It is NOT in force on 24 October 2026, and its requirements are shown as recommended until then. It applies to a person that does business in Vermont or targets its residents and, in the preceding year, handled the data of at least 35,000 consumers, or the sensitive data of at least 3,000 consumers, or offered the data of at least 3,000 consumers for sale.
Consumers can access (including inferences), correct, delete, get a portable copy and opt out of targeted advertising, sale and profiling, with a 45-day response and a 60-day appeal. Controllers need consent for sensitive data, must honour consent revocation within 15 days and an opt-out preference signal, may not use targeted advertising or sell the data of known consumers aged 13 to 17, must follow the Vermont Age-Appropriate Design Code Act where it applies, and must assess heightened-risk processing.
Section 2415k restricts consumer health data for any business: confidentiality, processor terms, no sale without consent, and no geofence within 1,850 feet of a health care facility. The Attorney General alone enforces; a 60-day cure is mandatory from 1 January 2028 to 30 June 2029.
Not verified: (1) Not in force until 1 January 2028; every Vermont requirement is marked recommended until then. (2) The sensitive data definition, the notice content in 2415e and the free-response rule were not itemized.
(3) The Consumer Protection Act penalty amounts (9 V. S.
A. chapter 63) were not read.
(4) The Vermont Age-Appropriate Design Code Act (chapter 62, subchapter 6) is referenced in the Act and is not mapped here; it is a separate law. General information for compliance work, not legal advice.
Assessment tiers & levels Lavawall supports
Lavawall assesses Vermont Data Privacy and Online Surveillance Act (VTDPOSA) at every level below, so you can start where you are and step up as your program matures.
| Tier / level | What it covers | Builds on lower |
|---|---|---|
| Controller | A person that, alone or jointly with others, determines the purpose and means of processing personal data and meets the applicability test in 9 VSA 2415b (35,000 consumers, or 3,000 sensitive-data consumers, or sale of 3,000 consumers’ data). Carries the notice, consumer rights, consent, security, assessment and enforcement duties. The Act is enacted but not in force until 1 January 2028, so its rows are recommended until then. | — |
| Processor | A person that processes personal data on behalf of a controller (9 VSA 2415f). Must follow the controller’s instructions, help with consumer requests and security, give assessment information, bind its people and subcontractors, and delete or return data at the end of the service. A processor that decides purposes and means is treated as a controller. | — |
| Health data holder | Any person that handles consumer health data. Section 2415k applies whatever the size of the business: duty of confidentiality for people with access, processor contract terms, no sale without consent, and no geofence within 1,850 feet of a health care facility. | — |
How Lavawall® helps you get to Vermont Data Privacy and Online Surveillance Act (VTDPOSA) compliance
Most of Vermont Data Privacy and Online Surveillance Act (VTDPOSA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Vermont Data Privacy and Online Surveillance Act (VTDPOSA), and tracks your posture continuously instead of once a year at audit time.
- Assess your current state against Vermont Data Privacy and Online Surveillance Act (VTDPOSA) in the Lavawall GRC module, with the questionnaire and control set built in.
- Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
- Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.
Related
Lavawall® supports Vermont Data Privacy and Online Surveillance Act (VTDPOSA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.
At a glance
- Framework
- Vermont Data Privacy and Online Surveillance Act (VTDPOSA) Act 145 (2026); effective 1 Jan 2028
- Category
- Privacy
- Region
- USA - Vermont
- Levels
- 3 assessment tiers
All Vermont, United States frameworks and training →
Map this framework freeTalk to our team