AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Vermont Enacts Broad Privacy Protections
Coverage from IAPP, Fenwick, and others
Vermont enacted the Vermont Data Privacy and Online Surveillance Act together with measures addressing genetic data, data brokers, and education technology providers.
The framework expands consumer rights, regulates sensitive health, biometric, neural, and genetic information, restricts certain sales and geofencing practices, and requires disclosures about personal-data use for large language model training. Most provisions of the comprehensive privacy act take effect in January 2028, while the genetic privacy measure takes effect earlier.
The main update is a reframing of the Vermont privacy package: it now clearly includes a separate genetic privacy law, public data broker registry requirements, and related measures for health and edtech data. The comprehensive privacy act’s enforcement and effective-date timeline remain broadly unchanged, but the current version adds more specific operational obligations and stakeholder coverage.
The story now centers on a more fully specified statewide framework: Vermont’s S.71 has a set enactment date and delayed effective date, while related genetic, data broker, and health-data rules are further fleshed out. The most notable addition is that the law’s operational obligations are now tied to January 2028, making implementation timing a central part of the story.