Vermont Enacts Data Privacy and Online Surveillance Act (S.71)

Vermont enacted S.71, the Data Privacy and Online Surveillance Act, on June 16, 2026, when Governor Phil Scott signed it into law eight days after vetoing the same bill. The Act gives consumers data-access and opt-out rights, imposes a data-minimization duty, and bars geofencing near health facilities, with most provisions effective January 1, 2028.

Information last verified on June 19, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article addresses Vermont Senate Bill S.71, now enacted as the Vermont Data Privacy and Online Surveillance Act, and the consumer privacy and online-surveillance duties it creates under Vermont law. It does not state the privacy law of other states. For Vermont's existing privacy framework, see Vermont data privacy laws.

What Happened

In the final days of the 2026 session, the Vermont General Assembly completed passage of S.71, an act relating to consumer data privacy and online surveillance. The House passed the amended bill 129-3 on May 26, 2026, and the Senate concurred the same day, sending it to Governor Phil Scott. Scott vetoed the bill on June 8, 2026. Eight days later, on June 16, 2026, he reversed course and signed S.71 into law, listing it among the bills he approved in his June 16 action on legislation. The Act therefore takes effect without a legislative override.

The bill was Vermont's second run at a comprehensive privacy law in two years. In 2024, Governor Scott vetoed H.121, a broader proposal, citing its private right of action and the litigation exposure it would create for Vermont businesses; the Senate did not muster the votes to override. To address those concerns, the 2026 version removed the private right of action and left enforcement with the Attorney General, while keeping the data-minimization and online-surveillance provisions that supporters consider the heart of the bill. Scott's June 8 veto briefly put the bill in doubt before his June 16 signature resolved it. The General Assembly had passed S.71 by a House margin, 129-3, that exceeded the two-thirds an override would have required.

What the Law Actually Says

S.71 gives Vermont consumers the standard set of rights now common across comprehensive state privacy laws: the right to access, correct, delete, and obtain a portable copy of their personal data, and the right to opt out of targeted advertising, the sale of personal data, and certain profiling. Sensitive data, which receives heightened protection, includes biometric information, precise geolocation, and health data. Businesses must honor universal opt-out mechanisms, including browser signals such as Global Privacy Control, so a consumer's choice carries across sites rather than requiring a separate click on each one.

Two features set the Act apart from a baseline privacy statute. First, a data-minimization rule limits a controller to collecting, using, and transferring personal data that is reasonably necessary and proportionate to provide the product or service the consumer requested, rather than whatever a privacy policy might disclose. Second, the online-surveillance title bars deploying a geofence within 1,850 feet of a health facility to identify or track a consumer, collect data about them, or send them messages related to their health data. That clinic-geofencing provision is among the more aggressive location-privacy measures in any state privacy law.

The Attorney General holds exclusive enforcement authority, and the Act does not create a private right of action. From the January 1, 2028 effective date through June 30, 2029, the Attorney General must give a business 60 days to cure a violation before bringing an action where a cure is possible. Legislators also added a statement of intent: if the Attorney General is not given sufficient resources to enforce the law, the General Assembly will consider adding a private right of action. The Act aligns certain definitions with Vermont's Age-Appropriate Design Code Act. For Vermont's current framework, including its data-broker registry, see Vermont data privacy laws; for how opt-out and Global Privacy Control signals work elsewhere, see opt-out and Global Privacy Control signals.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The clinic-geofencing ban is the provision worth watching. Comprehensive privacy laws usually converge on a familiar template of consumer rights and opt-outs, and S.71 includes that template. The 1,850-foot geofencing restriction around health facilities goes further, treating location data near sensitive sites as a distinct harm rather than just another data category. It reflects a post-Dobbs concern that location trails near clinics can reveal health decisions. Whether a future federal privacy law would preempt a provision like this is an open policy question that advocates on both sides have raised.

The other notable thread is the private right of action. Scott's 2024 veto of H.121 turned on it, and the 2026 drafters removed it to clear the Governor's desk. His June 8 veto of S.71 followed by a June 16 signature shows how narrow the path to enactment was even after that concession. The statement of intent the legislature attached, signaling it will revisit a private right of action if the Attorney General lacks enforcement resources, keeps the question open rather than closing it. The signal for readers is that Vermont reached a privacy law by trading private litigation for Attorney General enforcement, a compromise several states have made, while leaving a marker for a future fight over how the law is enforced.

How This Affects You

If you are a Vermont resident, S.71 gives you rights to see, correct, delete, and move your data and to opt out of targeted advertising, sale, and certain profiling, with most provisions arriving on January 1, 2028. Because the Act recognizes browser-level signals such as Global Privacy Control, setting that signal once could carry your opt-out across covered sites. These are general descriptions of the Act as enacted, not advice about your circumstances.

If you run a business that handles Vermont residents' data, the relevant questions are whether you meet the Act's coverage thresholds and what the data-minimization standard and the geofencing restriction require of your practices. The January 1, 2028 effective date leaves time to prepare, and a cure period runs through June 30, 2029. A general summary is not a substitute for a close read of the enacted text and advice from a Vermont-licensed lawyer where the stakes warrant it. Enforcement runs through the Attorney General rather than private lawsuits.

This is general legal information, not legal advice. It covers Vermont S.71, the Data Privacy and Online Surveillance Act, which Governor Scott signed into law on June 16, 2026, and reflects sources verified on June 19, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

---

Related articles

• Vermont data privacy laws: data broker registry and consumer rights
• Louisiana Data Privacy Act becomes law (SB 386)
• Opt-out and Global Privacy Control signals

---

Last updated: 2026-06-19. This is a developing story; details verified as of June 19, 2026.

More Vermont Laws

• Vermont Deepfake Laws
• Vermont Employee Monitoring Laws
• Vermont GPS Tracking Laws
• Vermont Recording Laws

Frequently Asked Questions

Has Vermont S.71 become law?

Yes. Governor Phil Scott signed S.71 into law on June 16, 2026, eight days after vetoing it on June 8, 2026. Most provisions take effect January 1, 2028.

What does the geofencing provision do?

S.71 bars deploying a geofence within 1,850 feet of a health facility to identify or track a consumer, collect data about them, or send them messages related to their health data.

What rights do Vermont consumers gain?

Rights to access, correct, delete, and port personal data, and to opt out of targeted advertising, the sale of data, and certain profiling. Sensitive data includes biometric, precise-geolocation, and health information.

Does the law honor Global Privacy Control?

Yes. Covered businesses must honor universal opt-out mechanisms, including browser signals such as Global Privacy Control, so a consumer's opt-out carries across sites.

Is there a private right of action?

No. The enacted version removed the private right of action that drew Governor Scott's 2024 veto of the earlier H.121 bill. The Vermont Attorney General enforces the Act, though legislators signaled they may revisit a private right of action if enforcement is underfunded.

When does S.71 take effect?

Most provisions take effect January 1, 2028, with a 60-day cure period for enforcement running through June 30, 2029.