AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Last Update: 10/27/2026 at 6:00 AM EST
Connecticut and Vermont Privacy Laws
Coverage from Inside Privacy, Fenwick, and others
Connecticut and Vermont illustrate how states are building comprehensive privacy regimes around consumer control of personal data and business accountability.
The subject includes rights to access, correct, delete, and port data; opt-outs from targeted advertising, data sales, and certain profiling; consent and data-minimization duties; and protections for sensitive, health, genetic, and biometric information. Vermont’s Data Privacy and Online Surveillance Act also addresses large-language-model training disclosures, health-data geofencing, opt-out preference signals, and exclusive Attorney General enforcement. Together, the two jurisdictions provide a durable view of state-level privacy legislation, implementation, and compliance design.
Looking Back
256 Day Timeline
Jan 30
Mar 13
Apr 24
Jun 5
Jul 17
Aug 28
Oct 9
All Articles50 articles
Important
Vermont enacted H.639 and S.71 from 2026 and 2028 effective dates, expanding legal controls on genetic, consumer health, biometric, and neural data.
6/24/2026 • Regulation, Law & Enforcement • General
Vermont will enforce the Vermont Data Privacy and Online Surveillance Act statewide from January 1, 2028, against covered companies handling residents' personal data.
8/3/2026 • Regulation, Law & Enforcement • General
Connecticut expanded the CTDPA through Public Act 25-113, adding profiling impact assessments and broader sensitive data and sale triggers effective in July and August 2026.
7/8/2026 • Regulation, Law & Enforcement • General
Vermont enacted H.639 and S.71 to regulate genetic and consumer health data with consent, deletion, and sharing limits enforced by the Vermont Attorney General.
6/27/2026 • Regulation, Law & Enforcement • General
Connecticut privacy law amendments under Public Act 25-113 signed June 24, 2025 require affirmative opt-in consent for sensitive data sales and LLM training disclosures starting July 1, 2026.
6/26/2026 • Regulation, Law & Enforcement • General
Vermont’s governor signed the Data Privacy and Online Surveillance Act on 16 June 2026, setting a 1 January 2028 start and Attorney General-only enforcement.
6/25/2026 • Regulation, Law & Enforcement • General
Vermont Governor Phil Scott signed the Data Privacy and Online Surveillance Act on 16 June 2026, setting low thresholds and Attorney General-only enforcement.
6/25/2026 • Regulation, Law & Enforcement • General
On 16 June 2026, Vermont Governor signed the Data Privacy and Online Surveillance Act, effective 1 January 2028, granting Attorney General exclusive enforcement and requiring LLM training transparency.
6/25/2026 • Regulation, Law & Enforcement • General
Phil Scott signed Vermont's VDPOSA on June 16, 2026, taking effect January 1, 2028, with new consumer rights and health-data protections.
6/22/2026 • Regulation, Law & Enforcement • General
Connecticut adopted Public Act No. 26-64 on May 27, 2026, expanding data broker duties and restricting precise geolocation sales and surveillance pricing for covered organizations.
6/18/2026 • Regulation, Law & Enforcement • General
Phil Scott signed Vermont’s Data Privacy and Online Surveillance Act on June 16, 2026, requiring impact assessments and LLM training disclosures effective January 1, 2028.
6/18/2026 • Regulation, Law & Enforcement • General
Governor Phil Scott signed Vermont’s Data Privacy and Online Surveillance Act on 16 June, granting attorney-general-only enforcement and requiring LLM training notice and opt-out controls.
6/17/2026 • Regulation, Law & Enforcement • General
Vermont Governor Phil Scott signed Senate Bill 71 on 16 June, making Vermont the 23rd state to pass a comprehensive privacy law effective 1 Jan 2028.
6/17/2026 • Regulation, Law & Enforcement • General
Phil Scott signed Vermont Senate Bill S.71 on June 16, 2026, establishing VDPOSA with AG-exclusive enforcement starting January 1, 2028.
6/17/2026 • Regulation, Law & Enforcement • General
Connecticut Governor Ned Lamont signed May 27, 2026 Senate Bill 4 to expand the Connecticut Data Privacy Act with a data broker registry, deletion mechanism, and new limits on precise geolocation, surveillance pricing, facial recognition, profiling, and genetic testing.
6/10/2026 • Regulation, Law & Enforcement • General
Rhode Island lawmakers passed a Genetic Information Privacy Act in 2026 to require express consent and plain-language genetic data disclosures for direct-to-consumer DNA testing.
5/5/2026 • Regulation, Law & Enforcement • General
Connecticut passed SB 4 on precise geolocation, surveillance pricing, facial recognition, and one-click data broker deletion, pending Governor Ned Lamont action.
5/5/2026 • Regulation, Law & Enforcement • General
Vermont enacted Senate Bill 71, effective January 1, 2028, establishing statewide privacy obligations and Attorney General enforcement with a 60-day cure period.
6/29/2026 • Regulation, Law & Enforcement • General
Vermont enacted a 2028 privacy and online surveillance law with low triggers, stronger health-data and profiling duties, and exclusive attorney general enforcement.
6/25/2026 • Regulation, Law & Enforcement • General
Vermont’s Data Privacy and Online Surveillance Act begins January 1, 2028, expanding coverage and teen and health data limits with attorney general enforcement.
6/25/2026 • Regulation, Law & Enforcement • General
Vermont legislature passed S71 on May 29, 2026, creating consumer privacy rights and stricter consumer health data duties pending Governor Phil Scott signature.
6/4/2026 • Regulation, Law & Enforcement • General
Connecticut lawmakers discuss dna privacy protections after the 23andMe breach.
2/18/2026 • Regulation, Law & Enforcement • General
Connecticut Attorney General William Tong announced that SB4 and SB5 will impose expanded privacy and artificial intelligence requirements statewide on October 1, 2026.
9/20/2026 • Regulation, Law & Enforcement • General
Connecticut will implement expanded privacy protections on October 1, 2026, covering genetic data, geolocation, facial recognition, chatbots, surveillance pricing, and workplace AI.
9/16/2026 • Regulation, Law & Enforcement • General
Connecticut lawmakers expanded the Connecticut Data Privacy Act and created data broker restrictions statewide on July 1, 2026.
7/31/2026 • Regulation, Law & Enforcement • General
Vermont Governor Phil Scott signed VDPOSA on June 16, 2026, creating expanded consumer data rights and health-related surveillance restrictions statewide.
7/28/2026 • Regulation, Law & Enforcement • General
South Dakota Governor Rhoden signed the Genetic Data Privacy Act on March 23, 2026, making genetic testing security and consumer genetic data deletion rights effective July 1, 2026.
3/23/2026 • Personal Data & Identity • General
Vermont lawmakers consider H.639 to regulate genetic data handling by genetic testing companies after the 2023 23andMe breach.
2/20/2026 • Regulation, Law & Enforcement • General
Connecticut Attorney General William Tong announces 1800 breach notifications in 2025 and seeks tighter privacy laws in Connecticut.
2/6/2026 • Regulation, Law & Enforcement • General
Connecticut attorney general supports genetic privacy legislation in Hartford in 2026.
1/1/1900 • Regulation, Law & Enforcement • General
Connecticut enacted 2026 privacy amendments expanding consumer rights and regulating data brokers and precise geolocation sales statewide.
8/3/2026 • Regulation, Law & Enforcement • General
Connecticut signed SB 4 on May 27, 2026, creating data broker registration and deletion mechanisms while restricting precise geolocation resale and surveillance pricing.
7/6/2026 • Regulation, Law & Enforcement • General
Louisiana and Vermont passed comprehensive privacy laws in 2026, adding sensitive data consent rules, profiling assessments, and expanded consumer rights for covered organizations.
7/2/2026 • Regulation, Law & Enforcement • General
Vermont Attorney General authority starts under S.71 signed June 16, 2026, giving consumers opt-out rights for targeted ads and personal-data sales and requiring LLM training disclosures.
7/2/2026 • Regulation, Law & Enforcement • General
Vermont enacted H.639 and S.71 to impose stronger consent and deletion requirements for genetic and consumer health data, enforced by the Vermont Attorney General.
6/24/2026 • Regulation, Law & Enforcement • General
Vermont signed S.71 into the Vermont Data Privacy and Online Surveillance Act on June 16, 2024, with attorney general enforcement starting January 1, 2028.
6/17/2026 • Regulation, Law & Enforcement • General
On June 16, 2026, Phil Scott signed Vermont House Bill H. 211 expanding data broker registration, breach notice, deletion rights, and penalties for noncompliance.
6/16/2026 • Regulation, Law & Enforcement • General
Connecticut signed SB 4 on May 27, expanding CTDPA deletion rights, creating a data broker registry, restricting surveillance pricing, and adding direct-to-consumer genetic testing protections.
5/27/2026 • Regulation, Law & Enforcement • General
Interesting
Connecticut Attorney General reports 2025 CTDPA enforcement actions on breach notices, opt-out rights, and chatbots.
2/19/2026 • Regulation, Law & Enforcement • General
Connecticut House passed Senate Bill 4 in 2020s, regulating data brokers and adding consumer data deletion and restrictions on geolocation and facial recognition for Gov. Ned Lamont review.
5/4/2026 • Regulation, Law & Enforcement • General
Connecticut Senate passed S.B. 4 in 2024 to regulate data brokers, add a deletion system, and provide protections for genetic and biological data.
4/23/2026 • Regulation, Law & Enforcement • General
Alabama, Louisiana, Oklahoma, and Vermont enacted comprehensive consumer privacy laws, described on October 12, 2026, that expand state-level requirements across the United States.
10/12/2026 • Regulation, Law & Enforcement • General
Alabama, Louisiana, Oklahoma, and Vermont enacted consumer privacy laws requiring notices, opt-outs, and attorney general enforcement, with Vermont setting notably low applicability thresholds.
7/28/2026 • Regulation, Law & Enforcement • General
Louisiana Data Privacy Act implementation needs privacy teams to adopt scalable rights workflows and sensitive-data controls as additional state laws take effect in 2026.
7/10/2026 • Regulation, Law & Enforcement • General
Consumer Reports criticized Vermont S. 71 as passing the legislature with weakened privacy rights and enforcement, citing issues with targeted advertising definitions and sensitive data limits.
5/29/2026 • Regulation, Law & Enforcement • General
Jessamyn West supports Vermont S.71, a bill proposing limits on business collection, use, and sale of personal data amid concerns about default tracking and consent friction.
5/10/2026 • Regulation, Law & Enforcement • General
CBIA opposed several Connecticut committee bills in 2026 that would expand employer privacy and cybersecurity duties, including data broker controls, geolocation limits, and massive-breach forensic reporting.
3/27/2026 • Regulation, Law & Enforcement • General
State lawmakers debate H.639 genetic data privacy bill after 23andMe controversy in January and February hearings in the state legislature.
2/20/2026 • Regulation, Law & Enforcement • General
Connecticut Attorney General in 2025 enforces CTDPA focusing on data rights requests, breach notices, and opt-out signals in Connecticut.
3/2/2026 • Regulation, Law & Enforcement • General
Connecticut Governor Ned Lamont announced May 29, 2026 that Senate Bill 5 creates AI notice, whistleblower, and minors-safety duties across multiple AI categories.
6/9/2026 • Privacy Technology & AI • General