Vermont
Vermont Data Privacy and Online Surveillance Act
Vermont’s VDPOSA, signed in 2026, takes effect January 1, 2028 and contains the broadest biometric definition in any state law: biometric data is protected even when it is not being used to identify anyone. It adds an AI-training disclosure rule, so companies must say when personal data trains a model, and its applicability thresholds are set so low that small face-data holders cannot duck under them. Once effective, it will be the strictest all-around face-privacy statute in the country.
Key Provisions
- Biometric data protected regardless of whether it is used for identification
- Consent required before processing sensitive data, including face geometry
- Disclosure required when personal data is used to train AI systems
- Low applicability thresholds designed to cover small data holders
- Data minimization duties that limit collection to what a service strictly needs
Penalties & Enforcement Record
AG enforcement under Vermont consumer protection law once effective in 2028; civil penalties per violation with no cure period after the initial phase-in.
What this means for your face
Nothing to file under VDPOSA until 2028, but Vermont has set the ceiling other states will copy. We file opt-out requests for Vermont residents through each engine’s own opt-out process.
Read our full breakdown of the VDPOSA → Get Protected