Bill > S0093

This bill establishes the Vermont Data Privacy Act, a comprehensive consumer data privacy law that provides Vermonters with significant protections and rights regarding their personal data. The bill applies to businesses that process personal data of at least 100,000 consumers or 25,000 consumers with over 25% of gross revenue from data sales. Consumers are granted several key rights, including the ability to confirm what personal data is being processed, access and correct their data, delete their personal data, obtain a copy of their data, and opt out of targeted advertising, data sales, and certain automated profiling. Controllers (businesses handling personal data) must obtain consent for processing sensitive data, limit data collection, maintain data security, and provide clear privacy notices. The bill includes special provisions for consumer health data, prohibiting actions like using geofences near health facilities to track consumers and selling health data without consent. Enforcement is exclusively handled by the Attorney General, with a temporary cure period from July 2025 to December 2026 that allows businesses to address violations before potential legal action. Notably, the bill does not create a private right of action for consumers. The law will take effect on July 1, 2026, giving businesses time to prepare for compliance with these new data privacy requirements.

Housing and Urban Affairs

https://legislature.vermont.gov/bill/status/2026/S.93