Vermont's Governor signed two pieces of legislation this month that together impose some of the strictest state-level rules in the United States on artificial intelligence in healthcare and on the data broker industry - one law taking effect immediately, the other on January 1, 2027.

The first, Act 156, signed on June 17, 2026, prohibits corporations and entities from providing mental health services independently through AI systems. The second, Act 138, signed on June 16, 2026, overhauls Vermont's existing data broker registration framework, raising fees, tightening disclosure obligations, and introducing new provisions around generative AI and geolocation data.

The two laws passed the Vermont General Assembly on May 29, 2026, in a compressed end-of-session push. Both were delivered to the Governor in early June and signed within 24 hours of each other. Their effective dates diverge: Act 156 takes effect immediately upon passage, while the core provisions of Act 138 take effect on January 1, 2027.

The AI therapy ban: what it does and does not prohibit

Act 156, formally titled "An act relating to regulating the use of artificial intelligence in the provision of mental health services," creates a new statute at 18 V.S.A. Section 7115. According to the enacted text, a corporation or entity shall not provide, advertise, or otherwise offer mental health services - including through the use of artificial intelligence - to the public unless the services are provided by a mental health professional.

The law turns on three definitions that limit its scope precisely. "Artificial intelligence" is defined as an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. "Mental health services"means services provided to diagnose, treat, or address an individual's mental health or behavioral health through therapeutic communications and therapeutic decisions. "Therapeutic communication" encompasses written, verbal, or nonverbal interactions intended to diagnose or treat mental or behavioral health concerns - including clinical guidance, interventions, support such as reassurance or empathy, and collaboration to develop or modify treatment plans.

The definition of therapeutic communication is notably specific. It includes engaging in direct interactions with clients for the purpose of understanding or reflecting the client's mental health condition, providing clinical guidance, strategies, or interventions, offering clinical support including reassurance or empathy in response to emotional or psychological distress, collaborating with a patient to develop or modify treatment plans or therapeutic mental health goals, and delivering feedback intended to promote growth or address mental health outcomes.

What the statute does not prohibit is equally significant. Mental health professionals who operate within their scope of practice may still use AI tools that are compliant with the Health Insurance Portability and Accountability Act, provided the professional reviews and approves any mental health services generated. FDA-authorized, cleared, or approved software-based medical products - including digital therapeutics or software as a medical device - remain usable if prescribed or recommended by a licensed professional. Research conducted under an approved institutional review board or privacy board study is also exempt.

The enforcement mechanism routes violations through Vermont's Consumer Protection Act, 9 V.S.A. chapter 63. The Attorney General receives the same authority and private parties the same rights and remedies as provided under that subchapter - meaning both public enforcement and private civil actions are available from the date of enactment.

Violations also constitute unprofessional conduct for licensed mental health professionals. Act 156 amends 3 V.S.A. Section 129a, the general unprofessional conduct statute, and 26 V.S.A. Section 1354, the specific conduct provisions for certain licensed practitioners, to add prohibited AI use as a category of unprofessional conduct.

The Advisory Council report due January 2027

Act 156 does not leave the matter static. It tasks the Vermont Artificial Intelligence Advisory Council - established under 3 V.S.A. Section 5023 - with submitting a written report on or before January 15, 2027. That report must address the regulation of AI use by mental health professionals and include recommendations for legislative action. The report goes to four legislative committees: the House Committees on Government Operations and Military Affairs and on Health Care, and the Senate Committees on Government Operations and on Health and Welfare.

The Advisory Council itself is expanded by Act 156. The statute adds the Director of Professional Regulation or designee, the Executive Director of the Vermont Board of Medical Practice or designee, and the Executive Director of Racial Equity or designee as new members.

The three sponsors of H.816 - which became Act 156 - were Representatives Daisy Berbeco of Winooski, Angela Arsenault, and Monique Priestley of Bradford. All three are Democrats. The bill's legislative history is long for a short statute. It was first read in the House on January 29, 2026, passed the House on March 18, reached the Senate on March 20, went through the Senate Committee on Health and Welfare across multiple hearings from May 1 through May 8, and then entered a conference committee process when the House refused to concur in the Senate's proposed amendment on May 15. The conference committee report was adopted by both chambers on May 22 and May 26, and the bill was delivered to the Governor on June 11.

Why this statute matters beyond Vermont

Act 156 arrives in a landscape where AI-driven mental health chatbots and therapeutic apps have grown rapidly without dedicated statutory frameworks. Pennsylvania sued Character.AI in May 2026 for allegedly operating a character representing itself as a licensed psychiatrist - the first known case of a state medical licensing authority invoking its professional practice statute against an AI platform for chatbot conduct. New York's chatbot liability bill reached the Senate floor in February 2026, targeting AI providers whose chatbots impersonate licensed professionals including psychologists and social workers.

Vermont's approach is structurally different from those efforts. Rather than attaching liability to specific harm, it establishes a categorical operational prohibition: AI systems cannot deliver mental health services independently, period. The carve-out for human-supervised AI tools maintains room for technology that assists professionals, while excluding products that replace them.

Connecticut's Senate passed a broad AI bill in April 2026 that included companion chatbot provisions among its 37 sections. Tennessee introduced legislation in January 2026 that would have made AI companion training a felony. The White House released a national AI policy framework in March 2026 that called for federal preemption of state AI laws, a move that could affect Vermont's statute if Congress acts on those recommendations.

Texas investigated Character.AI and Meta in 2024 and 2025 for allegedly presenting AI chatbots as mental health tools without proper credentials. California enacted legislation requiring AI systems to disclose their non-human nature to usersin October 2025. Vermont's statute goes further by prohibiting independent AI provision of therapeutic services entirely, making the state's approach among the most restrictive in the country to date.

Act 138: the data broker overhaul

Act 138 - "An act relating to data brokers and personal information" - is a substantially longer piece of legislation, spanning 41 pages and amending Vermont's existing Chapter 62 framework for the protection of personal information. The bill's primary sponsors included Representatives Monique Priestley of Bradford, Michael Marcotte, Angela Arsenault, Sarita Austin, and 50 additional co-sponsors, a coalition spanning Democrats, Republicans, and independents.

Registration fees and penalties, rewritten

The most immediately practical change for businesses is to the annual registration fee. The existing fee of $100 is replaced with $900, effective January 1, 2027. The registration timing also changes: rather than an annual January 31 deadline, companies must register within 30 days of first meeting the definition of a data broker and then annually by July 1 of each subsequent year.

Penalties for non-registration are also significantly revised. Under the new statute, a data broker that fails to register faces an administrative fine of $200 for each day the data broker fails to register - up from $50 per day under prior law - plus an amount equal to the fees that were due during the non-registration period and any reasonable costs incurred by the state in investigation and administration. A data broker that files materially incorrect registration information faces a civil penalty of $25,000, and an additional $1,000 per day if the incorrect information is not corrected within 30 days of discovering or receiving notification of the error.

The law requires data brokers to maintain a bond of $20,000 that runs to the state for any liability arising under the subchapter, with a two-year limitation period on bond actions.

New disclosure obligations: GenAI systems, geolocation, and government data sharing

The registration information required from data brokers expands substantially. Companies must now disclose whether they share consumer data with - or sell it to - a developer of a GenAI system or model. The statute defines a "GenAI system" as an artificial intelligence system that can generate derived synthetic content, including text, images, video, and audio, that emulates the structure and characteristics of the system's training data.

Data brokers must also disclose whether they collect the precise geolocation of consumers. According to Act 138, "precise geolocation" means information derived from technology that can precisely and accurately identify the specific location of a consumer within a radius of 1,850 feet. Reproductive health care data, biometric data, immigration status, sexual orientation, union membership status, mobile advertising identification numbers, connected television identification numbers, and vehicle identification numbers are all listed among the categories that must be disclosed when collected.

Disclosure to government entities is another new category. Data brokers must report whether, in the past year, they shared or sold consumer data to a foreign actor, to the federal government, to other state or local governments, to law enforcement outside of a subpoena or court order, or to a developer of a GenAI system or model. The government data-sharing provision reflects a concern that has gained traction across multiple jurisdictions: that data brokers serve as a back-channel through which government agencies acquire personal information that would otherwise require legal process to obtain.

The statute also requires data brokers to report the three most common types of personal information they collect - but only for brokers that do not collect the specific categories itemized in the registration form. This provision addresses the long tail of data brokers whose practices fall outside the enumerated sensitive categories.

The accessible deletion mechanism study

Act 138 tasks the Vermont Secretary of State with studying the feasibility of establishing an accessible deletion mechanism - a single, state-operated system through which consumers could submit one verifiable request causing every registered data broker to delete their personal information. The proposal mirrors California's Delete Request and Opt-out Platform, which crossed 242,000 sign-ups in its first eight weeks of operation after launching January 1, 2026.

The Vermont deletion mechanism study requires the Secretary of State to produce an interim report on or before December 1, 2027, and a final report on or before December 1, 2028, including findings and any proposed legislation. The interim report is specifically intended to give the General Assembly recommendations to pursue in the 2028 legislative session.

The study's scope is detailed. According to Act 138, the mechanism must allow a consumer to request deletion of all brokered personal information at once through a single deletion request, allow consumers to selectively exclude specific data brokers, permit subsequent modification of requests after at least 45 days, be readily accessible and usable by consumers with disabilities, support authorized agents, provide status tracking, and impose no charge on the consumer.

Changes to the definition of "data broker"

Act 138 refines the definition of "data broker" in ways that matter for compliance. A data broker is a business that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship. The new statute specifies that a direct relationship requires a consumer to have intentionally interacted with a business for the purpose of accessing, purchasing, using, requesting, or obtaining information about the business's products or services.

Exercising a consumer right does not create a direct relationship, nor does a business simply collecting brokered personal information directly from a consumer without the consumer intending the interaction. A business remains a data broker with respect to information it collected outside a first-party interaction, even if it also has direct relationships with some consumers through other means.

The statute explicitly excludes from the sale definition certain types of transfers: disclosures to a processor acting on the data broker's behalf, disclosures with consumer consent, disclosures of publicly available information, and transfers in connection with mergers, acquisitions, or bankruptcy proceedings.

Brokered personal information: what the law now covers

The definition of "brokered personal information" is expanded. Under Act 138, it covers any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household. The new wording replaces a narrower enumerated list and brings Vermont closer to the comprehensive definitions found in state laws like the California Consumer Privacy Act.

Publicly available information does not qualify as brokered personal information if it is related to a consumer's business or profession. The statute carves out four activities that do not qualify a business as a data broker: developing or maintaining third-party e-commerce or application platforms, providing 411 directory assistance or directory information services on behalf of telecommunications carriers, providing publicly available information related to a consumer's business or profession, and providing publicly available information via real-time or near-real-time alert services for health or safety purposes.

Educational technology

Act 138 also adds a new Subchapter 3B, on educational technology, requiring providers of educational technology products used in Vermont schools to register with the Secretary of State and provide specific information at the time of filing. This includes privacy policies and terms of service for each product in use, the names of schools where the provider operates under a paid contract, and an attestation that each product meets student privacy standards, the Vermont Age-Appropriate Design Code Act, and relevant federal and state privacy laws including the Children's Online Privacy Protection Act.

Cybersecurity Council changes

The law also amends the Cybersecurity Advisory Council at 20 V.S.A. Section 4662, adding the Chair of the House Committee on Energy and Digital Infrastructure, the Chair of the Senate Committee on Institutions, and a representative from the Judiciary appointed by the Chief Justice as members. An existing repeal clause for the cybersecurity chapter is extended: the chapter now survives to June 30, 2033, instead of June 30, 2028.

What this means for the ad tech and marketing industry

Both acts carry direct implications for marketing professionals, ad tech companies, and businesses that rely on third-party data.

Act 138's expansion of brokered personal information to include any information reasonably linkable to an identifiable individual - including derived data and unique identifiers - reaches squarely into the data that powers digital advertising. Mobile advertising identification numbers, connected television identification numbers, and precise geolocation are all explicitly listed in the disclosure requirements. These are not marginal categories. They are central signals in programmatic advertising, audience targeting, and attribution.

The requirement to disclose whether consumer data has been shared with GenAI system developers adds a new dimension to data broker compliance. As advertising platforms increasingly incorporate generative AI features, the question of whether data flows to those systems falls within the statute's scope for Vermont-resident consumers.

The fee increase from $100 to $900 per year is not trivial for smaller operators, but the more significant operational burden comes from the expanded disclosure requirements and the sharpened penalty structure. A data broker that files materially incorrect information - even inadvertently - faces a $25,000 civil penalty, a figure that concentrates minds on the accuracy of registration filings.

California's data broker enforcement activity has escalated steadily, with a $45,000 fine issued in January 2026 for a Texas-based company that failed to register while selling health condition lists affecting California consumers. Vermont's new penalty structure for inaccurate filings suggests a comparable enforcement posture.

On the mental health AI side, companies offering AI-powered wellness apps, chatbot-based coaching platforms, or automated therapy tools need to assess carefully whether their products deliver what the Vermont statute defines as therapeutic communication or therapeutic decisions. The definitions are broad enough to capture products that might not style themselves as clinical services. Consumer Protection Act enforcement - available to both the Attorney General and private plaintiffs - applies from the date of enactment.

Timeline

  • January 29, 2026 - H.816 (AI mental health) first read in Vermont House and referred to Committee on Health Care
  • February 12, 2025 - H.211 (data brokers) first read in Vermont House and referred to Committee on Commerce and Economic Development
  • March 17-18, 2026 - H.816 passes Vermont House on third reading
  • March 24-25, 2026 - H.211 passes Vermont House on third reading
  • March 20, 2026 - H.816 referred to Vermont Senate Committee on Health and Welfare
  • March 27, 2026 - H.211 referred to Vermont Senate Committee on Economic Development, Housing and General Affairs
  • May 1-8, 2026 - Vermont Senate Committee on Health and Welfare considers H.816, with amendments agreed
  • May 15, 2026 - Vermont House refuses to concur in Senate amendment on H.816 and requests conference committee
  • May 19, 2026 - Senate appoints conference committee for H.816: Senators Gulick, Lyons, and Benson
  • May 22, 2026 - Conference committee report for H.816 adopted by both Senate and House
  • May 26, 2026 - Vermont House adopts conference committee report on H.816
  • May 28, 2026 - Vermont Senate passes H.211 with proposal of amendment; reads third time and passes
  • May 29, 2026 - Both bills pass both chambers; H.811 concurred in Senate proposal of amendment
  • June 10, 2026 - H.211 delivered to the Governor
  • June 11, 2026 - H.816 delivered to the Governor
  • June 16, 2026 - Governor signs H.211 (data brokers) into law as Act 138; Secs. 2 and 3 take effect July 1, 2026; Secs. 1 and 4 take effect January 1, 2027
  • June 17, 2026 - Governor signs H.816 (AI mental health) into law as Act 156; takes effect on passage
  • January 15, 2027 - Deadline for Vermont AI Advisory Council to submit mental health AI regulation report
  • July 1, 2026 - Act 138 Secs. 2 and 3 (Secretary of State study and Cybersecurity Council) take effect
  • January 1, 2027 - Act 138 core data broker and educational technology provisions take effect
  • December 1, 2027 - Interim report on accessible deletion mechanism due from Secretary of State
  • December 1, 2028 - Final report on accessible deletion mechanism due from Secretary of State

Related PPC Land coverage on state AI and data broker regulation:

Summary

Who: The Vermont General Assembly and Governor. Act 138 was sponsored primarily by Representative Monique Priestley of Bradford, with 50+ additional co-sponsors. Act 156 was sponsored by Representatives Daisy Berbeco, Angela Arsenault, and Monique Priestley. Both acts affect data brokers operating with respect to Vermont consumers, companies deploying AI for mental health services, educational technology providers, and licensed mental health professionals.

What: Two separate laws. Act 138 overhauls Vermont's data broker registration framework, raising the annual fee from $100 to $900, expanding disclosure requirements to include GenAI system data sharing, precise geolocation within 1,850 feet, government data transfers, and new categories of sensitive data. It also commissions a study of a centralized deletion mechanism and adds educational technology provider registration. Act 156 prohibits corporations and entities from delivering mental health services independently through AI, while allowing licensed professionals to use HIPAA-compliant AI tools under human oversight.

When: Both bills passed both chambers May 29, 2026. Act 138 was signed June 16, 2026; Act 156 was signed June 17, 2026. Act 156 takes effect immediately. Act 138 takes effect in stages - cybersecurity and study provisions on July 1, 2026, and the core data broker provisions on January 1, 2027.

Where: Vermont, applying to data brokers handling Vermont resident data and to corporations or entities offering mental health services to Vermont consumers. H.211 was first introduced February 12, 2025. H.816 was first introduced January 29, 2026.

Why: Act 156 addresses risks from AI systems that operate independently in mental health contexts, including potential for psychological harm and death by suicide, as stated in its purpose section. Act 138 responds to gaps in the existing data broker regime - including inadequate fees, limited disclosure of sensitive data categories, and lack of a consumer-facing deletion mechanism - and to the rise of generative AI systems as recipients of consumer data from data brokers.