Bill > S0071

This bill proposes the Vermont Data Privacy Act, a comprehensive law designed to protect consumer data privacy and regulate online surveillance. The bill establishes extensive rights for consumers and obligations for businesses (called "controllers") that collect and process personal data. Key provisions include requiring businesses to limit data collection, obtain consumer consent for processing sensitive data, provide clear privacy notices, and allow consumers to access, correct, delete, and opt out of certain data processing activities like targeted advertising and data sales. The law applies to businesses that process data of 100,000 consumers or 25,000 consumers with 25% of revenue from data sales. A notable feature is a special section on consumer health data privacy, which prohibits using geofencing near health facilities and selling health data without consent. The bill also includes specific definitions for terms like "personal data," "sensitive data," and "targeted advertising," and grants the Attorney General exclusive enforcement authority with an initial two-year period allowing businesses to cure violations before potential penalties. The law will take effect on July 1, 2026, giving businesses time to prepare for compliance.

Business and Industry, Government Affairs, Housing and Urban Affairs

https://legislature.vermont.gov/bill/status/2026/S.71