Bill > H0630

This bill requires businesses to meet minimum security standards before selling or delivering internet-connected consumer electronic products in Vermont, meaning devices that can connect to the internet or other internet-connected devices. These standards include using encryption for secure communications, providing automatic security updates that are enabled by default and installed seamlessly without extended downtime, requiring strong passwords and resetting any default passwords during initial setup, and having a system for managing and reporting product vulnerabilities. Additionally, businesses must provide an easily accessible and understandable privacy policy, notify consumers of significant changes, disclose if data is collected, transmitted, or shared for marketing purposes with an opt-out option, and allow consumers to delete their data and accounts while establishing data retention policies. Violating these provisions will be considered an unfair and deceptive business practice, and the act will take effect on July 1, 2026.

Business and Industry

https://legislature.vermont.gov/bill/status/2026/H.630