Vermont
Vermont Data Privacy and Online Surveillance Act
Vermont’s VDPOSA, signed in 2026, takes effect January 1, 2028 and contains the broadest biometric definition in any state law: biometric data is protected even when it is not being used to identify anyone. It adds an AI-training disclosure rule, so companies must say when personal data trains a model, and its applicability thresholds are set so low that small face-data holders cannot duck under them. Once effective, it will be the strictest all-around face-privacy statute in the country.
Key Provisions
- Biometric data protected regardless of whether it is used for identification
- Consent required before processing sensitive data, including face geometry
- Disclosure required when personal data is used to train AI systems
- Low applicability thresholds designed to cover small data holders
- Data minimization duties that limit collection to what a service strictly needs
Penalties & Enforcement Record
AG enforcement under Vermont consumer protection law once effective in 2028; civil penalties per violation with no cure period after the initial phase-in.
What this means for your face
Nothing to file under VDPOSA until 2028, but Vermont has set the ceiling other states will copy. We prepare Vermont residents’ requests today under existing law and will add VDPOSA citations the day it takes effect.
Read our full breakdown of the VDPOSA → Get Protected