Vermont's Privacy Law Has the Lowest Bar in the Country — And You Have Until 2028
Vermont's Data Privacy and Online Surveillance Act doesn't take effect until January 1, 2028, more than a year away. It's easy to file that under "not urgent yet." But Vermont's thresholds are low enough, and its rights broad enough, that it's worth understanding well before that clock starts running.
A Threshold Unlike Anything Else on the Map
Compare this to what you're used to: most comprehensive state privacy laws trigger at 100,000 consumers or more. Vermont triggers at 35,000, or just 3,000 consumers if any sensitive data is involved, or 3,000 consumers whose data is sold. Independent legal analysts have described it as one of the most progressive state privacy laws enacted in the country. A far broader range of Shopify sellers will need to pay attention to Vermont than to almost any other state on this list.
Rights No Other State Regulens Tracks Includes
Beyond the standard set, access, correction, deletion, portability, and opt-out, Vermont adds rights specifically tied to automated decision-making: the right to obtain information about how profiling was used in a significant decision, the right to question that decision, the right to be told why it was made, and the right to review the data used in it. Vermont also includes a right to obtain the specific list of third parties your data was sold to, a feature shared with only one other state Regulens tracks, Minnesota.
The Sensitive Data Definition Is Also Unusually Broad
Vermont's definition of sensitive data extends to neural data, financial account and login credentials, and government-issued identification numbers, categories not uniformly covered elsewhere. Combined with the 3,000-consumer threshold for sensitive data specifically, this means a relatively small operation handling any of these categories could find itself covered.
Enforcement
The Vermont Attorney General holds exclusive enforcement authority, with no private right of action. A 60-day cure period applies, but it expires on June 30, 2029, so it's a genuinely temporary grace period, not a permanent feature. The Attorney General must also submit an annual enforcement report to the state legislature, a transparency requirement not common elsewhere.
Why the Distance to 2028 Is an Advantage
Given how low Vermont's thresholds sit, this is one of the few cases where getting ahead of a law years in advance genuinely changes your position. Waiting until 2027 to start thinking about this is a much worse position than starting now.
Check Your Future Exposure
All information in this article is sourced from the Vermont Data Privacy and Online Surveillance Act (S.71, Act 145 of 2026) and independent legal analysis from IAPP. Regulens is informational only and this article is not legal advice. Speak to a licensed privacy attorney about your specific compliance situation.
Regulens tracks Vermont as part of its ongoing state-by-state privacy coverage, ready to activate the moment the law takes effect.
Free to check, takes three minutes, no credit card needed. Not legal advice. Informational only.
Check your store's Vermont privacy readiness at getregulens.com
Further Reading
Q4 Is Starting — Here's the Multi-State Compliance Check Most Sellers Skip Before It Does
Fourth quarter brings the highest sales volume of the year for most Shopify sellers, which means it also brings the highest chance of crossing a state threshold you haven't checked yet.
Twenty States. One Question Most Sellers Haven't Asked Yet.
As of mid-2026, twenty U.S. states now have comprehensive privacy laws in effect, with four more already signed and coming. Most Shopify sellers checking their compliance still only think about California.