71, enacting the Vermont Data Privacy and Online Surveillance Act, effective January 1, 2028. The Act creates extensive new obligations for businesses around consumer data rights, profiling, security controls, health data, large language model training disclosure, and data protection impact assessments, with enforcement centralized in the Office of the Attorney General. The General Assembly explicitly states its intent to provide additional appropriations and resources in coming years to support the Attorney General’s enforcement of the Act, potentially including creation of a dedicated data privacy unit, and to fund educational resources and technical support to help Vermont businesses comply.This is a pre-RFP signal that the Attorney General and other state entities will need legal, IT, compliance, training, and outreach support to design enforcement workflows, build case management and intake tools, develop guidance, and deliver statewide education well before the law’s 2028 effective date.

Key statutory sections include 9 V.S.A. §§ 2415a–2415k. AG must also file annual enforcement reports and issue compliance guidance, suggesting ongoing analytic and reporting needs.