Bill > H0812

This bill, titled the "Vermont Duty of Data Loyalty Act," establishes new privacy and data security regulations for businesses that collect, process, or transfer personal data of Vermont consumers, referred to as "covered entities" and "trusting parties" respectively. The act defines key terms such as "covered data" (information linked to an individual or device), "sensitive covered data" (including health information, financial accounts, and biometric data), and "cross-context behavioral advertising" (targeting ads based on activity across different websites or apps). It mandates that covered entities owe a "duty of loyalty" to trusting parties, meaning they must not collect or process data in ways that conflict with the best interests of consumers, ensuring a balanced allocation of benefits and risks. The bill requires data minimization, meaning data collection should be limited to what is strictly necessary for a requested product or service or a legitimate business interest. It prohibits cross-context behavioral advertising and deceptive marketing practices, while allowing first-party advertising (advertising by the entity that collected the data directly from the consumer). Furthermore, covered entities must implement reasonable security practices, obtain consent for transferring data to third parties, and provide consumers with rights to access, correct, delete, and export their data, with specific timelines and exceptions for "large data holders" (businesses with significant revenue and data processing). The bill also addresses algorithmic accountability by requiring assessments for algorithms that pose a consequential risk of harm and prohibits retaliation against consumers for exercising their data rights. Finally, it sets an effective date of January 1, 2027, and grants the Attorney General rulemaking authority to implement and enforce these provisions.

Business and Industry

https://legislature.vermont.gov/bill/status/2026/H.812