Vermont Passes Data Privacy and Online Surveillance Act (S.71)

Vermont's General Assembly completed passage of S.71, the Data Privacy and Online Surveillance Act, in the final days of the 2026 session, after the House approved it 129-3 on May 26, 2026 and the Senate concurred the same day. The bill would make Vermont roughly the 20th state with a comprehensive consumer privacy law and would ban geofencing near health facilities. It now awaits Governor Phil Scott.

Information last verified on June 8, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article addresses Vermont Senate Bill S.71 and the consumer privacy and online-surveillance duties it would create under Vermont law. It does not state the privacy law of other states, and it describes a bill that has passed the legislature but is not yet enacted as of June 8, 2026. For Vermont's existing privacy framework, see Vermont data privacy laws.

What Happened

In the final days of the 2026 session, the Vermont General Assembly completed passage of S.71, an act relating to consumer data privacy and online surveillance. The House passed the amended bill 129-3 on May 26, 2026, and the Senate concurred the same day, sending it to Governor Phil Scott. As of June 8, 2026, the Governor had not announced whether he would sign or veto it, so it is not yet law and its provisions are not in force.

The bill is Vermont's second run at a comprehensive privacy law in two years. In 2024, Governor Scott vetoed H.121, a broader proposal, citing its private right of action and the litigation exposure it would create for Vermont businesses; the Senate did not muster the votes to override. To address those concerns, the 2026 version removed the private right of action and left enforcement with the Attorney General, while keeping the data-minimization and online-surveillance provisions that supporters consider the heart of the bill. Whether the Governor signs this version, vetoes it, or allows it to become law without his signature was unresolved as of the date above.

What the Law Actually Says

S.71 would give Vermont consumers the standard set of rights now common across comprehensive state privacy laws: the right to access, correct, delete, and obtain a portable copy of their personal data, and the right to opt out of targeted advertising, the sale of personal data, and certain profiling. Sensitive data, which receives heightened protection, includes biometric information, precise geolocation, and health data. Businesses would have to honor universal opt-out mechanisms, including browser signals such as Global Privacy Control, so a consumer's choice carries across sites rather than requiring a separate click on each one.

Two features set the bill apart from a baseline privacy statute. First, a data-minimization rule limits a controller to collecting, using, and transferring personal data that is reasonably necessary and proportionate to provide the product or service the consumer requested, rather than whatever a privacy policy might disclose. Second, the online-surveillance title bars deploying a geofence within 1,850 feet of a health facility to identify or track a consumer, collect data about them, or send them messages related to their health data. That clinic-geofencing provision is among the more aggressive location-privacy measures in any state privacy law.

The Attorney General would enforce the Act, and the bill does not create a private right of action. Most provisions would take effect January 1, 2028. The bill also aligns certain definitions with Vermont's Age-Appropriate Design Code Act. For Vermont's current framework, including its data-broker registry, see Vermont data privacy laws; for how opt-out and Global Privacy Control signals work elsewhere, see opt-out and Global Privacy Control signals.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The clinic-geofencing ban is the provision worth watching. Comprehensive privacy laws usually converge on a familiar template of consumer rights and opt-outs, and S.71 includes that template. The 1,850-foot geofencing restriction around health facilities goes further, treating location data near sensitive sites as a distinct harm rather than just another data category. It reflects a post-Dobbs concern that location trails near clinics can reveal health decisions. Whether a future federal privacy law would preempt a provision like this is an open policy question that advocates on both sides have raised.

The other notable thread is the politics of the private right of action. The 2024 veto turned on it, and the 2026 drafters removed it to clear the Governor's desk. That trade keeps enforcement with the Attorney General and reduces business litigation exposure, which is the compromise that several states have reached. We are not predicting whether Governor Scott will sign S.71 or how the bill would fare if challenged. The signal for readers is that Vermont's negotiators concluded a privacy law without a private right of action was more likely to survive than a stronger bill that draws a veto.

How This Affects You

If you are a Vermont resident, S.71 would, if signed, give you rights to see, correct, delete, and move your data and to opt out of targeted advertising, sale, and certain profiling, with most provisions arriving on January 1, 2028. Because the bill recognizes browser-level signals such as Global Privacy Control, setting that signal once could carry your opt-out across covered sites. These are general descriptions of the bill as passed, not advice about your circumstances.

If you run a business that handles Vermont residents' data, the relevant questions are whether you meet the Act's coverage thresholds and what the data-minimization standard and the geofencing restriction would require of your practices. A general summary is not a substitute for a close read of the enacted text, if the bill is signed, and advice from a Vermont-licensed lawyer where the stakes warrant it. Enforcement would run through the Attorney General rather than private lawsuits.

This is general legal information, not legal advice. It covers Vermont S.71 as passed by the legislature and reflects sources verified on June 8, 2026. The bill is not yet enacted, laws change, and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

---

Related articles

• Vermont data privacy laws: data broker registry and consumer rights
• Louisiana Data Privacy Act becomes law (SB 386)
• Opt-out and Global Privacy Control signals

---

Last updated: 2026-06-08. This is a developing story; details verified as of June 8, 2026.