On June 16, Gov. Phil Scott signed the Vermont Data Privacy and Online Surveillance Act into law. Vermont also enacted separate legislation addressing data brokers, while another new law restricts the sale of genetic information. States are building their own rules because the existing data economy has failed to create enough trust on its own. And every new law makes the patchwork more complicated for businesses.
Vermont is putting more responsibility on companies
The Vermont Data Privacy and Online Surveillance Act takes effect January 1, 2028.
Among other provisions, the law applies to certain companies processing personal data from Vermont residents, requires recognition of opt-out preference signals, and requires disclosures about the use or sale of personal data for training large language models.
The law gives enforcement authority to the Vermont attorney general. The Vermont House approved a major amendment to the bill by a 129–3 vote.
Privacy is increasingly becoming an operational issue, not simply something for the legal department to manage.
Data brokers are getting additional attention
Vermont also approved H.211, legislation specifically addressing data brokers and personal information. The governor approved the measure on June 16.
The attention on data brokers gets at a deeper problem.
A data broker can collect and sell or license information about people with whom it has no direct relationship. Vermont law itself defines the category around that lack of a direct relationship.
Think about how strange that is from the consumer’s perspective.
A company you have never knowingly done business with may possess information about you, package it, and create economic value from it.
The regulatory response is increasingly to create registries, disclosures, opt-outs, and deletion mechanisms.
But they are still largely trying to manage what happens after the data has entered the system.
That is the bigger issue
At the Clean Data Alliance, we believe companies should pay attention to what Vermont represents without treating another compliance checklist as the end goal.
The bigger question is:
Why are companies collecting, buying, and inferring so much information that they need increasingly complicated systems to prove they are using it appropriately?
Instead of starting with extraction and adding compliance afterward, organizations can start with people.
Ask for information directly.
Explain why it is needed.
Receive meaningful permission.
Preserve the context in which it was provided.
Allow that permission to be revoked.
And when human data creates economic value, create a fair value exchange with the person who provided it.
That is the difference between trying to make dirty data safer and building with Clean Data from the beginning.
The AI provision should get executives’ attention
Vermont’s law also brings AI directly into the privacy conversation by requiring certain privacy notices to disclose the collection, use, or sale of personal data for training large language models.
AI has dramatically increased the potential value of human data. It has also increased the consequences of getting that data provenance wrong.
Companies increasingly need to answer questions that go beyond:
Can we legally use this data?
They also need to ask:
Where did it come from?
Did the person knowingly provide it?
What did they agree to?
Can we prove that?
Should we be using it at all?
Those are governance questions, but they are also questions about data quality, customer relationships and enterprise risk.
Twenty-three states should tell us something
Companies can continue responding state by state, adding another rule to the compliance stack each time a legislature acts. Or they can recognize what these laws are collectively telling us. People want greater agency over their information.Regulators want greater accountability from the companies using it.AI is making provenance harder to ignore. And businesses are being asked to defend data practices that were built during an era when collecting as much information as possible was considered an advantage.
The Clean Data alternative starts from a different premise:
Don’t collect first and justify later. Build systems where permission, provenance, transparency, and human agency exist from the beginning.
Vermont may be the 23rd state to enact a comprehensive privacy law.
It almost certainly won’t be the last.
The companies that get ahead of this won’t be the ones with the biggest compliance departments.
They’ll be the ones that eventually need less reactive compliance because they changed how they acquire and use human data in the first place.