Vermont Enacts Comprehensive Privacy Law

After years of false starts, Vermont has become the 23rd state to enact a comprehensive privacy law. In 2024, the legislature was unable to override Governor Scott's veto of a bill that included a private right of action. This time, lawmakers successfully advanced S.71 across the finish line. 

Although the law stops short of enabling private litigation, it includes several provisions that will require fine-tuning privacy programs. The product of extensive negotiation and compromise, Vermont's new law largely follows the familiar state privacy law framework while incorporating a few key deviations deserving of privacy pros attention:

• AI training disclosure. Controllers must disclose in their privacy notices whether they collect, use, or sell personal data to train large language models. Vermont is the second state to require such a disclosure, following Connecticut's amended privacy law (which takes effect July 1, 2026). As state legislatures increasingly focus on AI