LOGIN Request a call

← BLOG  |  EMPLOYMENT LAW UPDATES  |  NEWS

Vermont Data Privacy Act Coming Soon

05 Jun

Share
Update Applicable to:Effective date
See “Applicability” belowJuly 1, 2025


What happened?

The Vermont legislature recently passed H. 121, the Vermont Data Privacy Act. This law makes Vermont the 18th state to grant consumers privacy rights similar to those under the California Consumer Privacy Act (CCPA). The Act is scheduled to go into effect on July 1, 2025.


What are the details?


Applicability

The Vermont Data Privacy Act (H. 121) applies to businesses that process or control the personal data of at least 25,000 consumers in Vermont in a given year. It also applies to businesses that make more than 50% of their gross revenue from selling personal data. The law also applies to people who do business in Vermont or produce products or services for Vermont residents.


Provisions

  • The Act includes provisions similar to the CCPA, such as consumer rights to delete, access, correct, and opt-out.
  • However, it also includes some provisions that are more protective than the CCPA:
    • Data Minimization: The Act prohibits businesses from collecting personal information for any purpose outside of providing the product or service.
    • Private Right of Action: The Act grants consumers a private right of action against businesses not only when the entity causes a breach of personal information, but also if the business misuses data about their race, religion, sexual orientation, health, or other categories of sensitive information.


Limitations and Future Considerations

  • The law’s private right of action must be reauthorized after two years and only applies to large data brokers.
  • The Vermont legislature passed this law amidst the push by the federal government to pass a comprehensive privacy law, which has yet to come to fruition over the last decade.
  • Businesses should continue to monitor new consumer privacy rights laws and consider how these laws may affect their data collection and use practices.


Business Considerations

  • Data Collection Practices: With the data minimization requirements, businesses should review and possibly revise their data collection practices to ensure they are not collecting personal information for any purpose outside of providing the product or service.
  • Consumer Rights: Businesses should understand and implement processes to handle consumer rights to delete, access, correct, and opt-out of their personal data.
  • Private Right of Action: Businesses should be aware of the expanded private right of action and consider the potential legal risks associated with misuse of sensitive information.
  • Reauthorization Requirement: Businesses, especially large data brokers, should keep track of the reauthorization requirement for the law’s private right of action and plan accordingly.
  • Ongoing Monitoring: Given the evolving nature of privacy laws, businesses should continue to monitor new consumer privacy rights laws and consider how these laws may affect their data collection and use practices.


Source References


Resources

Need help understanding how changes to employment laws will affect your business?

Learn more about how Vensure's Vermont PEO services can help you navigate complex employment laws and keep your business compliant.


This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.

Keep Your Business Compliant

Fill out the form below to receive monthly Employment Law Updates right in your inbox.

Keep Your Business Compliant

Fill out the form below to receive monthly Employment Law Updates right in your inbox.

Amazing!

You're all set.

Thanks for subscribing. Be on the look out for the Legal HR updates in your email.

Tracking Convertion image