Vermont Enacts Broad Privacy Protections

The main update is a reframing of the Vermont privacy package: it now clearly includes a separate genetic privacy law, public data broker registry requirements, and related measures for health and edtech data. The comprehensive privacy act’s enforcement and effective-date timeline remain broadly unchanged, but the current version adds more specific operational obligations and stakeholder coverage.

The story now centers on a more fully specified statewide framework: Vermont’s S.71 has a set enactment date and delayed effective date, while related genetic, data broker, and health-data rules are further fleshed out. The most notable addition is that the law’s operational obligations are now tied to January 2028, making implementation timing a central part of the story.

The update mainly formalizes the package by naming the statutes and adding that data brokers will appear in a public registry; the underlying legislative story is otherwise unchanged.

The update sharpens the laws’ operational impact by highlighting lower applicability thresholds and earlier July 2026 obligations, while adding more specific genetic-data compliance duties. It otherwise largely confirms the previously established legislative package and enforcement structure.

The story has broadened from Vermont’s comprehensive privacy law to an implemented package of related laws, most notably adding operational oversight of data brokers. Genetic-data restrictions also appear to have moved from proposals or advances into enacted policy, reinforcing a shift from debate toward implementation.

The story has moved from a multi-state trend toward a concrete Vermont enactment: a comprehensive privacy law is now law, with exclusive attorney-general enforcement and added rules for health and AI-training disclosures. Genetic privacy remains part of the broader arc, but it is now framed within a more developed state privacy regime rather than as the sole focus.

• Vermont enacted the Vermont Data Privacy and Online Surveillance Act.
• The attorney general has exclusive enforcement authority under the law.
• The law includes opt-out signal handling and AI-training disclosure notices.
• Consumer health data gets separate limits on sale and geofencing.
• Vermont is now the 23rd state with a comprehensive consumer privacy law.

Several states are tightening rules for consumer genetic data, with new laws and bills requiring explicit consent, stronger deletion rights, clearer disclosures, and limits on insurer, employer, and marketing uses.