What actually applies: the recording and interception statute
This is the statute that most often reaches a website. Session recording, chat transcripts, form-field capture and analytics that replay a visit have all been argued as interception of a communication.
- Citation
18 U.S.C. § 2520 (no state wiretap statute)- Consent regime
- One-party consent
- Private lawsuits
- Yes. A private party can sue.
- Damages named
- Greater of actual damages plus profits, $100 a day, or $10,000, plus punitive damages and fees
- Observed filing volume
- Low
Vermont has no state wiretap statute; claims proceed under the federal Wiretap Act.
The law that is coming
Vermont Data Privacy and Online Surveillance Act (S.71)
- Takes effect
- January 1, 2028
- Applies to
- 35,000 consumers, or sensitive data of 3,000+ consumers, or sale of 3,000+ consumers' data
- Maximum penalty
- Penalties available under the Vermont Consumer Protection Act; a per-violation figure was not verified for this build
Your state is not the only one that applies
Wiretap exposure follows the visitor, not the practice. A Vermont practice whose website is read by someone sitting in an all-party-consent state can be answering to that state's statute, not this one. Twenty states also have a comprehensive consumer privacy law in effect, and those reach your visitors from Vermont wherever your servers are.
Start with California, Colorado, Connecticut, Delaware, Florida, Indiana, or see the full list of jurisdictions.
The federal floor
HIPAA applies to a covered entity in every state. Civil money penalties were last adjusted January 28, 2026; the highest tier reaches $2,190,294 per violation with an annual cap of $2,190,294 for the same requirement.
Neighbouring states
Sources
- Reporters Committee for Freedom of the Press — Reporter's Recording Guide, civil suits: https://www.rcfp.org/reporters-recording-sections/civil-suits/
- DarrowEverett — Tracking Pixel Litigation Expands: A State-by-State Guide to Wiretapping Risk (2026): https://darroweverett.com/pixel-litigation-trends-by-state-compliance-legal-analysis/
- Davis+Gilbert — New State Privacy Laws: Alabama, Louisiana, Oklahoma, and Vermont Join the Party (2026): https://www.dglaw.com/new-state-privacy-laws-alabama-louisiana-oklahoma-and-vermont-join-the-party/
Figures last reviewed July 25, 2026.