Bill > S0071

This bill establishes the Vermont Data Privacy and Online Surveillance Act, granting consumers rights regarding their personal data and imposing duties on businesses that collect and process this data. Key provisions include defining terms like "personal data" (information linked to an identifiable individual or device), "sensitive data" (which includes health, genetic, biometric, and precise location data), and "sale of personal data" (exchanging data for monetary or valuable consideration). Businesses that meet certain thresholds, such as processing the personal data of at least 35,000 consumers or sensitive data of 3,000 consumers, are subject to the act. Consumers gain rights to confirm data processing, access, correct, and delete their personal data, and opt out of targeted advertising, the sale of their data, and profiling that leads to significant legal or similar effects. The bill also outlines specific protections for "consumer health data," prohibiting its sale without consent and restricting the use of geofences near healthcare facilities. Enforcement of the act will be handled by the Attorney General, with a grace period for businesses to cure violations before enforcement actions can be taken, and the bill emphasizes the importance of educational resources for businesses to comply. The act will take effect on January 1, 2028.