With the 2026 Vermont Legislative Session concluding at the end of May, we’re diving into issues that impact small business owners in the Green Mountain State.

Part I focused on taxes. Part II looked at healthcare and energy.

This edition examines proposals for more regulations and red tape, including two new laws that small business owners should know about.

NO Hot/Cold Workplace Regulations. For the second year in a row, state lawmakers debated imposing heavy-handed and duplicative workplace management regulations when temperatures are above or below certain levels. And for the second year in a row, the proposal failed to advance (S.230 Amendment).

NFIB VT and other organizations raised concerns about the duplicative nature of these requirements. Employers already have obligations and incentives under OSHA, Workers’ Compensation, and more to prepare and practice safety in the heat or cold.

Not only is it already required, but safety is imperative for keeping your workforce healthy and on the job, maintaining your reputation as a responsible employer, and staying in business.

Small businesses don’t need another mandate to do what they’re already doing well.

NO Flexible Scheduling Mandate. A concerning proposal would have created a presumptive right to a flexible work schedule for employees of private businesses (S.230 as introduced).

Employers would have been required to approve an employee’s request for an alternative schedule, including different days, hours, starting times, job sharing, or work from home. They could only deny such a request for specific subjective, undefined reasons enumerated in the proposal.

NFIB VT raised concerns about the disruptive impact this would have on workplaces, the inability for any employer to accommodate these requests in an equitable manner, and the likelihood of conflict that would arise among employees and employers.

Ultimately, lawmakers shelved this part of the bill.

NEW Franchise Disclosure Requirement. At the end of April, Governor Scott signed a new requirement that businesses operating as franchisors or franchisee disclose in filings with the Secretary of State disclose whether they are a franchisor or franchisee, and for franchisees to disclose the name of their franchisor. For more information, see 2026 Act 82.

NEW Consumer Data Privacy Mandate. In the final days of session, lawmakers agreed on a complex piece of legislation dictating consumer rights and business obligations over consumer data. Similar in substance to laws in 20 other states, the Vermont version takes effect in 2028 and differs in several ways that small businesses should know.

Most notably, the law applies to businesses that handle much lower volumes of consumer data than most other states, including businesses that controlled or processed the:

– personal data of 35,000 or more consumers, where “personal data” means any data that is linked or linkable to an identified or identifiable individual or a device that is linked to an individual; or

– sensitive data of 3,000 or more consumers, where “sensitive data” means data that reveals racial or ethnic origin, religious beliefs, sexual orientation, gender identification, or mental or physical health condition, diagnosis, or treatment, as well as consumer health data, genetic or biometric data, data collected from a child, precise geolocation data, neural data, financial data, government-issued ID; or

– offered for sale the personal data of 3,000 or more consumers.

Data solely related to completing a payment transaction does not count toward these thresholds.

The law gives consumers numerous rights regarding their data, including:

– to confirm and access their personal data held by a controller, including any inferences derived from that data;

– correct inaccuracies in the consumer’s personal data;

– delete personal data that was provided by or obtained about the consumer;

– obtain a copy of the personal data held by the controller in a portable and readily usable format; and

– opt out of processing of personal data for the purposes of targeted advertising, sale of personal data, or profiling that furthers automatic decision making.

In addition to saddling business owners with the burden of complying with demands to exercise these consumer rights, the law imposes a series of obligations on impacted entities intended to minimize consumer data collection and use.

The obligations include:

– providing requested information free of charge at least once per 12 month period;

– limiting collection of consumer data to only that which is reasonably necessary to carry out the purpose for which it was collected

– forbidding use of data for purposes beyond the reasons for which it was collected

– establishing and maintaining data security practices to protect the confidentiality, integrity and accessibility of personal data

– forbidding the processing of sensitive consumer data

– forbidding targeted advertising and the sale of consumer data if the consumer is between 13 and 18 years

– providing a reasonably accessible, clear, and meaningful privacy notice

On the bright side, lawmakers rebuked trial lawyer demands to include a private right of action – individual lawsuits – for alleged violations of this new mandate. Enforcement is solely the responsibility of the Vermont Attorney General.

NFIB Vermont opposed applying this heavy-handed mandate on small business owners.

Outrage over online and consumer data privacy is largely directed at giant corporations that control millions or billions of pieces of personal information, not small businesses that collect customer names, emails and birthdays for coupons, promotions, and new product updates.

We urged lawmakers to follow the high data collection threshold used in most other states and to adopt an exemption for those who meet the U.S. Small Business Administration’s definition of a small business.

Protecting and responsibly using customer data is critical for small business owners. It preserves trust and guards against liability.

But like with the Workplace Temperature regulation, state and federal requirements and incentives already exist to ensure small businesses securely and responsibly maintain customer data without new mandates.

Compliance costs for similar mandates in other states range from $5,000 to $15,000.

NFIB Vermont will have more information on this mandate in future updates.

(As of June 3, Governor Scott had not yet acted on this bill).