US States · 1 law · 11 requirements
Vermont: the laws your website or app must follow
If your customers are in Vermont, these are the privacy, consumer, security, accessibility and AI laws SafeLaunch checks your site against, with what each one requires and where in the law it says so.
Coming up in Vermont
- 2028-01-01 · Vermont Data Privacy and Online Surveillance Act: Applies from 1 Jan 2028 (Act 145 of 2026, S.71). The Attorney General enforces it, with a 60-day chance to fix a violation from 1 Jan 2028 to 30 June 2029; no private lawsuits.
- 2029-06-30 · Vermont Data Privacy and Online Surveillance Act: The Attorney General enforces it, with a 60-day chance to fix a violation from 1 Jan 2028 to 30 June 2029; no private lawsuits.
How a SafeLaunch audit checks each one
- CheckedChecked automatically on every scan
- AI reviewLooked for by the AI analysis, reported only with evidence
- Your answersDecided from your answers to the audit questions
- PreparedPrepared for you in the report's compliance pack
- You confirmA scan can't see this; you need to confirm it
Vermont Data Privacy and Online Surveillance Act
Applies from 1 Jan 2028 (Act 145 of 2026, S.71).
Who it covers: Businesses handling data of 35,000+ Vermont residents a year, or 3,000+ while earning any revenue from selling data.
What it requires of a website or app (11)
- A privacy notice: categories, purposes, rights and how to appeal, data shared and with whomCheckedVDPOSA 9 V.S.A. §2415e(c)
- Rights to access, correct, delete and port data, and to opt out of targeted ads, sale and profiling; appealsCheckedVDPOSA §2415d
- Honour universal opt-out signals such as Global Privacy ControlCheckedVDPOSA §2415e(d)(2)(C) (opt-out preference signals)
- Consent (or where the law allows, notice and an opt-out) before processing sensitive data; children's data handled under COPPAYour answersVDPOSA §2415e(a)(4)
- Reasonable data securityCheckedVDPOSA §2415e(a)(3)
- Data protection assessments for targeted ads, sale, profiling and sensitive dataPreparedVDPOSA §2415g
- Say in your privacy notice whether you collect, use or sell personal data to train large language models, and show the month and year it was last updatedAI review§2415e(c)(1)(H)–(I)
- No geofence within 1,850 feet of a health care facility to track or message people about their health; no sale of consumer health data without consentAI review§2415k
- Impact assessment for any profiling that makes legal or similarly significant decisions about peopleAI review§2415g(c)
- Offer the privacy notice in every language you sell in, and keep it accessible to people with disabilitiesAI review§2415e(c)(2)(C)–(D)
- No targeted ads to, or sale of data of, anyone you know or wilfully ignore is 13 to 17AI review§2415e(a)(7)
Check your site against Vermont's rules
A free scan checks your website or app against these rules in about a minute and shows what applies, with evidence from your pages. The full report gives the exact fix for each finding.
Check my site freeOne free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.
By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
A plain-language summary of what each law requires of a website or app, from the SafeLaunch rulebook, with the provision and official sources. It is not legal advice and not every duty in each law is listed.