Vermont Data Privacy and Online Surveillance Act

Newly enacted, not yet in force, and notably strict once it takes effect: applies at 35,000+ Vermont residents (excluding payment-only data). Separately — not fully captured by the numbers here — it applies at just 3,000+ residents if you process sensitive data or offer personal data for sale, among the lowest thresholds nationally. Consumer health-data provisions apply to any entity doing business in Vermont regardless of size. Nonprofit exemption is narrow (insurance-fraud-detection organizations only).