The Vermont Statutes Online

Title 9: Commerce and Trade

Chapter 061A: Data Privacy [Effective January 1, 2028]

• Subchapter 001: Vermont Data Privacy and Online Surveillance Act [Effective January 1, 2028]

• § 2415a. Short title and definitions [Effective January 1, 2028]

  (a) Short title. This subchapter shall be known and may be cited as the “Vermont Data Privacy and Online Surveillance Act.”

  (b) Definitions. As used in this subchapter:

  (1)(A) “Affiliate” means a legal entity that shares common branding with another legal entity or controls, is controlled by, or is under common control with another legal entity.

  (B) As used in subdivision (A) of this subdivision (1), “control” or “controlled” means:

  (i) ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a company;

  (ii) control in any manner over the election of a majority of the directors or of individuals exercising similar functions; or

  (iii) the power to exercise controlling influence over the management of a company.

  (2) “Authenticate” means to use reasonable means to determine that a request to exercise any of the rights afforded under subdivisions 2415d(a)(1)–(4) of this subchapter is being made by, or on behalf of, the consumer who is entitled to exercise the consumer rights with respect to the personal data at issue.

  (3)(A) “Biometric data” means data generated from the technological processing of an individual’s unique biological, physical, or physiological characteristics that are collected on or used to identify a specific consumer, including:

  (i) iris or retina scans;

  (ii) fingerprints;

  (iii) facial or hand mapping, geometry, or templates;

  (iv) vein patterns;

  (v) voice prints or vocal biomarkers; and

  (vi) gait or personally identifying physical movement or patterns.

  (B) “Biometric data” does not include:

  (i) a digital or physical photograph;

  (ii) an audio or video recording; or

  (iii) any data generated from a digital or physical photograph or an audio or video recording, unless such data is generated to identify a specific individual.

  (4) “Business associate” has the same meaning as in HIPAA.

  (5) “Child” has the same meaning as in COPPA.

  (6)(A) “Collect,” “collected,” or “collection” means buying, renting, gathering, obtaining, receiving, or accessing any personal data by any means, other than such activities between a controller and a processor or between a processor and its subcontractors.

  (B) “Collect,” “collected,” or “collection” includes receiving data from the consumer, either actively or passively, or by observing the consumer’s behavior.

  (7)(A) “Consent” means a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to allow the processing of personal data relating to the consumer.

  (B) “Consent” may include a written statement, including by electronic means, or any other unambiguous affirmative action.

  (C) “Consent” does not include:

  (i) acceptance of a general or broad terms of use or similar document that contains descriptions of personal data processing along with other, unrelated information;

  (ii) hovering over, muting, pausing, or closing a given piece of content; or

  (iii) agreement obtained through the use of dark patterns.

  (8)(A) “Consumer” means an individual who is a resident of the State.

  (B) “Consumer” does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit organization, or government agency whose communications or transactions with the controller occur solely within the context of that individual’s role with the company, partnership, sole proprietorship, nonprofit organization, or government agency.

  (9) “Consumer health data” means any personal data that a controller uses to identify a consumer’s physical or mental health condition, diagnosis, or status, including gender-affirming health data and reproductive or sexual health data.

  (10) “Consumer health data controller” means any controller that, alone or jointly with others, determines the purpose and means of processing consumer health data.

  (11) “Consumer reporting agency” has the same meaning as in the Fair Credit Reporting Act, 15 U.S.C. § 1681a(f).

  (12) “Controller” means a person who, alone or jointly with others, determines the purpose and means of processing personal data.

  (13) “COPPA” means the Children’s Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501–6506, and any regulations, rules, guidance, and exemptions adopted pursuant to the act, as the act and regulations, rules, guidance, and exemptions may be amended.

  (14) “Covered entity” has the same meaning as in HIPAA.

  (15) “Credit union” has the same meaning as in 8 V.S.A. § 30101.

  (16) “Dark pattern” means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice and includes any practice the Federal Trade Commission refers to as a “dark pattern.”

  (17) “Decision that produces any legal or similarly significant effect” means any decision made by the controller, or on behalf of the controller, that results in the provision or denial by the controller of any financial or lending service, any housing, any insurance, any education enrollment or opportunity, any criminal justice, any employment opportunity, or any health care service.

  (18) “Deidentified data” means data that does not identify and cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to the individual, if the controller that possesses the data:

  (A)(i) takes reasonable measures to ensure that the data cannot be used to reidentify an identified or identifiable individual or be associated with an individual or device that identifies or is linked or reasonably linkable to an individual; and

  (ii) for purposes of this subdivision (A), “reasonable measures” includes the deidentification requirements set forth under 45 C.F.R § 164.514 (other requirements relating to uses and disclosures of protected health information);

  (B) publicly commits to process the data only in a deidentified fashion and not attempt to reidentify the data; and

  (C) contractually obligates any recipients of the data to comply with all provisions of this subchapter.

  (19) “Derived data” means data that is created by the derivation of information, data, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or another source of information or data about a consumer’s device.

  (20) “Gender-affirming health care services” has the same meaning as in 1 V.S.A. § 150.

  (21) “Gender-affirming health data” means any personal data concerning a past, present, or future effort made by a consumer to seek, or a consumer’s receipt of, gender-affirming health care services.

  (22) “Genetic data” means any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material, including deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), epigenetic markers, uninterpreted data that results from analysis of the biological sample or other source, and any information extrapolated, derived, or inferred therefrom.

  (23) “Geofence” means any technology that uses global positioning coordinates, cell tower connectivity, cellular data, radio frequency identification, wireless fidelity technology data, or any other form of location detection, or any combination of such coordinates, connectivity, data, identification, or other form of location detection, to establish a virtual boundary.

  (24) “Health care facility” has the same meaning as in 18 V.S.A. § 9432.

  (25) “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, as may be amended.

  (26) “Hybrid entity” has the same meaning as in HIPAA.

  (27) “Identified or identifiable individual” means an individual who can be readily identified, directly or indirectly, including by reference to an identifier such as a name, an identification number, precise geolocation data, or an online identifier.

  (28) “Institution of higher education” means any individual who, or school, board, association, limited liability company, or corporation that, is licensed or accredited to offer one or more programs of higher learning leading to one or more degrees.

  (29) “Mental health facility” means any health care facility in which at least 70 percent of the health care services provided in the facility are mental health services.

  (30) “Minor” means any consumer who is younger than 18 years of age.

  (31) “Neural data” means any information that is generated by measuring the activity of an individual’s central nervous system.

  (32) “Nonprofit organization” means any organization that is qualified for tax exempt status under I.R.C. § 501(c)(3), 501(c)(4), 501(c)(6), or 501(c)(12), or any corresponding internal revenue code of the United States, as may be amended.

  (33) “Patient-identifying information” has the same meaning as in 42 C.F.R. § 2.11 (confidentiality of substance use disorder patient records).

  (34) “Person” means an individual, association, company, limited liability company, corporation, partnership, sole proprietorship, trust, or other legal entity.

  (35)(A) “Personal data” means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals.

  (B) “Personal data” does not include deidentified data or publicly available information.

  (36)(A) “Precise geolocation data” means information derived from technology, including global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet.

  (B) “Precise geolocation data” does not include:

  (i) the content of communications;

  (ii) data generated by or connected to an advanced utility metering infrastructure system; or

  (iii) data generated by equipment used by a utility company.

  (37) “Process” or “processing” means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.

  (38) “Processor” means a person who collects or processes personal data on behalf of:

  (A) a controller; or

  (B) another processor.

  (39) “Profiling” means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects, including an individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, movements, or identifying characteristics.

  (40) “Protected health information” has the same meaning as in HIPAA.

  (41) “Pseudonymous data” means personal data that cannot be attributed to a specific individual without the use of additional information, provided the additional information is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable individual.

  (42)(A) “Publicly available information” means information that:

  (i) is made available through federal, state, or local government records or to the general public from widely distributed media; or

  (ii) a controller has a reasonable basis to believe that the consumer has lawfully made available to the general public.

  (B) “Publicly available information” does not include:

  (i) biometric data collected by a business about a consumer without the consumer’s knowledge;

  (ii) information that is collated and combined to create a consumer profile that is made available to a user of a publicly available website either in exchange for payment or free of charge;

  (iii) an inference that is generated from the information described in subdivision (ii) of this subdivision (42)(B);

  (iv) solely for the purposes set forth in subdivisions 2415d(a)(1), (2), and (4) of this subchapter, information that is made available for sale;

  (v) any obscene visual depiction, as defined in 18 U.S.C. § 1460;

  (vi) personal data that is created through the combination of personal data with publicly available information;

  (vii) genetic data, unless otherwise made publicly available by the consumer to whom the information pertains;

  (viii) information provided by a consumer on a website or online service made available to all members of the public, for free or for a fee, where the consumer has maintained a reasonable expectation of privacy in the information, such as by restricting the information to a specific audience; or

  (ix) intimate images, authentic or computer generated, known to be nonconsensual.

  (43) “Reproductive or sexual health care” has the same meaning as “reproductive health care services” in 1 V.S.A. § 150(c).

  (44) “Reproductive or sexual health data” means any personal data concerning an effort made by a consumer to seek, or a consumer’s receipt of, reproductive or sexual health care.

  (45) “Reproductive or sexual health facility” means any health care facility in which at least 70 percent of the health care–related services or products rendered or provided in the facility are reproductive or sexual health care.

  (46)(A) “Sale of personal data” means the exchange of a consumer’s personal data by the controller with a third party for monetary or other valuable consideration.

  (B) “Sale of personal data” does not include:

  (i) the disclosure of personal data to a processor that processes the personal data on behalf of the controller;

  (ii) the disclosure of personal data to a third party for purposes of providing a product or service requested by the consumer;

  (iii) the disclosure or transfer of personal data to an affiliate of the controller;

  (iv) the disclosure of personal data when the consumer directs the controller to disclose the personal data or intentionally uses the controller to interact with a third party;

  (v) the disclosure of personal data that the consumer:

  (I) intentionally made available to the general public via a channel of mass media; and

  (II) did not restrict to a specific audience; or

  (vi) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction, or a proposed merger, acquisition, bankruptcy, or other transaction, in which the third party assumes control of all or part of the controller’s assets.

  (47) “Sensitive data” means personal data that includes:

  (A) data revealing:

  (i) racial or ethnic origin, religious beliefs, sex life, sexual orientation, status as nonbinary or transgender, or citizenship or immigration status; or

  (ii) a mental or physical health condition, diagnosis, disability, or treatment;

  (B) consumer health data;

  (C) genetic or biometric data or information derived therefrom;

  (D) personal data collected from an individual the controller has actual knowledge, or willfully disregards, is a child;

  (E) precise geolocation data;

  (F) neural data;

  (G) a consumer’s financial account number, financial account login information, or credit card or debit card number that, in combination with any required access or security code, password, or credential, would allow access to a consumer’s financial account; or

  (H) a government-issued identification number, including, but not limited to, Social Security number, passport number, State identification card number, or driver’s license number, that applicable law does not require to be publicly displayed.

  (48)(A) “Targeted advertising” means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred from that consumer’s activities over time and across nonaffiliated websites or online applications to predict the consumer’s preferences or interests.

  (B) “Targeted advertising” does not include:

  (i) an advertisement based on activities within the controller’s own website or online application;

  (ii) an advertisement based on the context of a consumer’s current search query or visit to a website or online application;

  (iii) an advertisement directed to a consumer in response to the consumer’s request for information or feedback; or

  (iv) processing of personal data solely to measure or report advertising frequency, performance, or reach.

  (49) “Third party” means a person, public authority, agency, or body, other than the consumer, controller, or processor or an affiliate of the processor or the controller.

  (50) “Trade secret” has the same meaning as in section 4601 of this title. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)

• § 2415b. Applicability [Effective January 1, 2028]

  (a) Thresholds. Except as provided in subsection (b) of this section, this subchapter applies to a person that conducts business in this State or a person that produces products or services that are targeted to residents of this State and that during the preceding calendar year:

  (1) controlled or processed the personal data of not fewer than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction;

  (2) controlled or processed the sensitive data of not fewer than 3,000 consumers, excluding personal data controlled or processed solely for the purposes of completing a payment transaction; or

  (3) offered for sale in trade or commerce the personal data of not fewer than 3,000 consumers.

  (b) Health data applicability. Section 2415k of this subchapter and the provisions of this subchapter concerning consumer health data and consumer health data controllers apply to a person that conducts business in this State or a person that produces products or services that are targeted to residents of this State.

  (c) Controlling law. In the event of a conflict between the provisions of this subchapter and any other law, including the Vermont Age-Appropriate Design Code Act, the provisions of the law that afford the greatest protection for the right of privacy for consumers shall control. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)

• § 2415c. Exemptions [Effective January 1, 2028]

  (a) This subchapter does not apply to:

  (1) in the ordinary course of its operation, a federal, state, tribal, or local government entity or an instrumentality of the State;

  (2)(A) a covered entity that is not a hybrid entity;

  (B) any health care component of a hybrid entity; or

  (C) a business associate;

  (3) patient-identifying information, for purposes of 42 U.S.C. § 290DD-2;

  (4)(A) information to the extent it is used for public health, community health, or population health activities and purposes, as authorized by HIPAA, when provided by or to a covered entity or when provided by or to a business associate in accordance with the business associate agreement with a covered entity;

  (B) information that is a health care record, as that term is defined in 18 V.S.A. § 9419, if the information is held by an entity that is a covered entity or business associate under HIPAA because it collects, uses, or discloses protected health information;

  (C) information that is deidentified in accordance with the requirements for deidentification set forth in 45 C.F.R. § 164.514 and that is derived from individually identifiable health information as described in HIPAA; and

  (D) personal information consistent with the human subject protection requirements of the U.S. Food and Drug Administration;

  (5) information used only for public health activities and purposes described in 45 C.F.R. § 164.512 (disclosure of protected health information without authorization);

  (6) information that identifies a consumer in connection with:

  (A) activities that are subject to the Federal Policy for the Protection of Human Subjects, codified as 45 C.F.R. Part 46 (HHS protection of human subjects) and in various other federal regulations;

  (B) activities that are subject to the protections provided in 21 C.F.R. Parts 50 (FDA clinical investigations protection of human subjects) and 56 (FDA clinical investigations institutional review boards); or

  (C) research conducted in accordance with the requirements set forth in subdivisions (A) and (B) of this subdivision (a)(6) or otherwise in accordance with applicable law;

  (7) patient-identifying information that is collected and processed in accordance with 42 C.F.R. Part 2 (confidentiality of substance use disorder patient records);

  (8) patient safety work product that is created and used for purposes of patient safety improvement in accordance with 42 C.F.R. § 3, established in accordance with 42 U.S.C. §§ 299b-21 through 299b-26;

  (9) information or documents created for the purposes of the Healthcare Quality Improvement Act of 1986, 42 U.S.C. §§ 11101–11152, and regulations adopted to implement that act;

  (10) information processed or maintained solely in connection with, and for the purpose of, enabling notice of an emergency to persons that an individual specifies;

  (11) any activity that involves collecting, maintaining, disclosing, selling, communicating, or using information for the purpose of evaluating a consumer’s creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living if done strictly in accordance with the provisions of the Fair Credit Reporting Act, 15 U.S.C. §§ 1681–1681x, as may be amended, by:

  (A) a consumer reporting agency;

  (B) a person who furnishes information to a consumer reporting agency under 15 U.S.C. § 1681s-2 (responsibilities of furnishers of information to consumer reporting agencies); or

  (C) a person who uses a consumer report as provided in 15 U.S.C. § 1681b(a)(3) (permissible purposes of consumer reports);

  (12) information collected, processed, sold, or disclosed under and in accordance with the following laws and regulations:

  (A) the Driver’s Privacy Protection Act of 1994, 18 U.S.C. §§ 2721– 2725;

  (B) data that is subject to the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g, and regulations adopted to implement that act;

  (C) data that is subject to the Airline Deregulation Act, Pub. L. No. 95-504, only to the extent that an air carrier collects information related to prices, routes, or services, and only to the extent that the provisions of the Airline Deregulation Act preempt this subchapter;

  (D) data that is subject to the Farm Credit Act, Pub. L. No. 92-181, as may be amended; and

  (E) data that is subject to federal policy under 21 U.S.C. § 830 (regulation of listed chemicals and certain machines);

  (13) data subject to Title V of the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, and regulations adopted to implement that act;

  (14) a state- or federally chartered bank or credit union, or an affiliate or subsidiary that is principally engaged in financial activities, as described in 12 U.S.C. § 1843(k);

  (15) an agent, broker-dealer, investment adviser, or investment adviser representative, as those terms are defined in section 5102 of this title, who is regulated by the Department of Financial Regulation or the Securities and Exchange Commission;

  (16) a person regulated pursuant to 8 V.S.A. part 3 (chapters 101–165) other than a person who, alone or in combination with another person, establishes and maintains a self-insurance program and who does not otherwise engage in the business of entering into policies of insurance;

  (17) health care providers and health care facilities, as those terms are defined in 18 V.S.A. § 9402, provided such providers and facilities maintain all protected health information in accordance with the requirements of 18 V.S.A. § 1881 and HIPAA regardless of whether such providers or facilities are covered entities under 45 C.F.R. § 160.103;

  (18) protected health information under HIPAA;

  (19) a third-party administrator, as that term is defined in the Third Party Administrator Rule adopted pursuant to 18 V.S.A. § 9417, provided that the third-party administrator is subject to and in compliance with the Department of Financial Regulation’s Regulation IH-2001-01 (Privacy of Consumer Financial and Health Information);

  (20) personal data of a victim or witness of child abuse, domestic violence, human trafficking, sexual assault, violent felony, or stalking that a victim services organization collects, processes, or maintains in the course of its operation;

  (21) a nonprofit organization that is established to detect and prevent fraudulent acts in connection with insurance;

  (22) information that is processed for purposes of compliance, enrollment or degree verification, or research services by a nonprofit organization that is established to provide enrollment data reporting services on behalf of postsecondary schools as that term is defined in 16 V.S.A. § 176;

  (23) noncommercial activity of:

  (A) a publisher, editor, reporter, or other person who is connected with or employed by a newspaper, magazine, periodical, newsletter, pamphlet, report, or other publication in general circulation;

  (B) a radio or television station that holds a license issued by the Federal Communications Commission;

  (C) a nonprofit organization that provides programming to radio or television networks; or

  (D) a press association or wire service; or

  (24) data processed or maintained:

  (A) in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, consumer health data controller, or third party, to the extent that the data is collected and used within the context of that role;

  (B) as the emergency contact information of a consumer pursuant to this subchapter, used for emergency contact purposes; or

  (C) that is necessary to retain to administer benefits for another individual relating to the individual who is the subject of the information pursuant to subdivision (18) of this subsection (a) and used for the purposes of administering such benefits.

  (b) Controllers, processors, and consumer health data controllers that comply with the verifiable parental consent requirements of COPPA shall be deemed compliant with any obligation to obtain parental consent pursuant to this subchapter. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)

• § 2415d. Consumer personal data rights [Effective January 1, 2028]

  (a) Consumer rights. A consumer shall have the right to:

  (1) confirm whether or not a controller is processing the consumer’s personal data and access such personal data, including any inferences about the consumer derived from such personal data and whether a controller or processor is processing a consumer’s personal data for the purposes of profiling to make a decision that produces any legal or similarly significant effect concerning a consumer, unless such confirmation or access would require the controller to reveal a trade secret or the controller is prohibited from disclosing such personal data under subsection (e) of this section;

  (2) correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data;

  (3) delete personal data provided by, or obtained about, the consumer;

  (4) obtain a copy of the consumer’s personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided the controller shall not be required to reveal any trade secret;

  (5) opt out of the processing of the personal data for purposes of:

  (A) targeted advertising;

  (B) the sale of personal data, except as provided in subsection 2415e(b) of this subchapter; or

  (C) profiling in furtherance of any automated decision that produces any legal or similarly significant effect concerning the consumer;

  (6) if the consumer’s personal data were processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer, and if feasible:

  (A) question the result of such profiling;

  (B) be informed of the reason that such profiling resulted in such decision;

  (C) review the consumer’s personal data that were processed for the purposes of such profiling; and

  (D) if the profiling decision concerned housing, taking into account the nature of the personal data and the purposes for which such personal data were processed, be allowed to correct any incorrect personal data that were processed for the purposes of such profiling and have the profiling decision reevaluated based on the corrected personal data; and

  (7) obtain from the controller a list of the third parties to which such controller has sold the consumer’s personal data or, if such controller does not maintain a list of the third parties to which such controller has sold the consumer’s personal data, a list of all third parties to which such controller has sold personal data, provided the controller shall not be required to reveal any trade secret.

  (b) Exercising consumer rights.

  (1) A consumer may exercise rights under this section by a secure and reliable means established by the controller and described to the consumer in the controller’s privacy notice pursuant to subsection 2415e(c) of this subchapter.

  (2)(A) A consumer may designate another person to serve as the consumer’s authorized agent, and act on the consumer’s behalf, to opt out of the processing of the consumer’s personal data for the purposes specified in subsection (a) of this section.

  (B) The consumer may designate an authorized agent by way of, among other things, a technology, including an internet link or a browser setting, browser extension, or global device setting, indicating the consumer’s intent to opt out of the processing.

  (C) A controller shall comply with an opt-out request received from an authorized agent if the controller is able to verify, with commercially reasonable effort, the identity of the consumer and the authorized agent’s authority to act on the consumer’s behalf.

  (3) In the case of processing personal data of a consumer who:

  (A) a controller has actual knowledge, or willfully disregards, is a child, the parent or legal guardian may exercise the consumer rights on the child’s behalf; and

  (B) is subject to a guardianship, conservatorship, or other protective arrangement, the guardian or the conservator of the consumer may exercise the rights on the consumer’s behalf.

  (c) Controller compliance. Except as otherwise provided in this subchapter, a controller shall comply with a request by a consumer to exercise the consumer rights authorized pursuant to this subchapter as follows:

  (1) Timeline to respond. A controller:

  (A) shall respond to the consumer without undue delay, but not later than 45 days after receipt of the request; and

  (B) may extend the response period by 45 additional days when reasonably necessary, considering the complexity and number of the consumer’s requests, provided the controller informs the consumer of the extension within the initial 45-day response period and of the reason for the extension.

  (2) Declining to take action. If a controller declines to take action regarding the consumer’s request, the controller shall inform the consumer without undue delay, but not later than 45 days after receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision.

  (3) Cost of information.

  (A) Information provided by a controller in response to a consumer request shall be provided by the controller, free of charge, once per consumer during any 12-month period.

  (B) If requests from a consumer are manifestly unfounded, excessive, or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request.

  (C) The controller bears the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request.

  (4) Authentication of request.

  (A) If a controller is unable to authenticate a request to exercise any of the rights afforded under subdivisions (a)(1)–(4) of this section using commercially reasonable efforts, the controller shall not be required to comply with a request to initiate an action pursuant to this section and shall provide notice to the consumer that the controller is unable to authenticate the request to exercise the right or rights until the consumer provides additional information reasonably necessary to authenticate the consumer and the consumer’s request to exercise the right or rights.

  (B) A controller shall not be required to authenticate an opt-out request, but a controller may deny an opt-out request if the controller has a good faith, reasonable, and documented belief that the request is fraudulent.

  (C) If a controller denies an opt-out request because the controller believes the request is fraudulent, the controller shall send a notice to the person who made the request disclosing that the controller believes the request is fraudulent, why the controller believes the request is fraudulent, and that the controller shall not comply with the request.

  (5) Third-party data. A controller that has obtained personal data about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete the consumer’s data pursuant to subdivision (a)(3) of this section by:

  (A) retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal data remains deleted from the controller’s records and not using the retained data for any other purpose pursuant to the provisions of this subchapter; or

  (B) opting the consumer out of the processing of the personal data for any purpose except for those exempted pursuant to the provisions of this subchapter.

  (d) Appeals.

  (1) A controller shall establish a process for a consumer to appeal the controller’s refusal to take action on a request pursuant to this section within a reasonable period of time after the consumer’s receipt of the decision.

  (2) The appeal process shall be conspicuously available and similar to the process for submitting requests to initiate action pursuant to this section.

  (3) Not later than 60 days after receipt of an appeal, a controller shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

  (4) If the controller denies the appeal, the controller shall also provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the Attorney General to submit a complaint.

  (e) Disclosure of certain information. A controller shall not disclose the following personal data in response to a request to exercise the consumer’s rights pursuant to subdivision (a)(1) of this section and shall instead inform the consumer or the person exercising such right on behalf of the consumer, with sufficient particularity, that the controller has collected the consumer’s:

  (1) Social Security number;

  (2) driver’s license number, State identification card number, or other government-issued identification number;

  (3) financial account number;

  (4) health insurance identification number or medical identification number;

  (5) account password;

  (6) security question or answer thereto; or

  (7) biometric data. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)

• § 2415e. Duties of controllers [Effective January 1, 2028]

  (a) Data collection and processing. A controller shall:

  (1) limit the collection of a consumer’s personal data to what is reasonably necessary and proportionate in relation to the purposes for which the data are processed, as disclosed to the consumer;

  (2) not process a consumer’s personal data for any material new purpose that is neither reasonably necessary to, nor compatible with, the purposes for which the data were processed pursuant to subdivision (1) of this subsection, unless the controller receives consent from the consumer;

  (3) establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data at issue;

  (4) regarding the sensitive data of a consumer:

  (A) not process the sensitive data unless the consumer has provided consent and unless the processing is reasonably necessary in relation to the purposes for which the sensitive data are collected;

  (B) not sell the sensitive data unless the consumer has provided consent; and

  (C) if the controller has actual knowledge, or willfully disregards, that the consumer is a child, process the sensitive data in accordance with:

  (i) COPPA; and

  (ii) if applicable, section 2449f of this title;

  (5) not process personal data in violation of any:

  (A) law of this State that prohibits unlawful discrimination against consumers and any evidence, or lack of evidence, concerning proactive antibias testing or any similar proactive effort to avoid processing data in violation of any such law, including any evidence or lack of evidence concerning the quality, efficacy, recency, and scope of any testing or effort, the results of which shall be relevant to any claim available for a violation of such law and any defense available thereto; or

  (B) federal law that prohibits unlawful discrimination against consumers;

  (6) provide an effective mechanism for a consumer to revoke the consumer’s consent under this section that is at least as easy as the mechanism by which the consumer provided the consumer’s consent and, upon revocation of the consent, cease to process the data as soon as practicable, but not later than 15 days after the receipt of the request;

  (7) subject to subdivision (9) of this subsection, if a controller has actual knowledge, and willfully disregards, that a consumer is at least 13 years of age but younger than 18 years of age:

  (A) not process the personal data of the consumer for purposes of targeted advertising; and

  (B) not sell the consumer’s personal data;

  (8) not discriminate against a consumer for exercising any of the consumer rights contained in this subchapter, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods or services to the consumer; and

  (9) if the controller is a covered business and the consumer is a covered minor as both terms are defined in section 2449a of this title, comply with the requirements set forth in chapter 62, subchapter 6 of this title (Vermont Age-Appropriate Design Code Act).

  (b) Limitations. Subsection (a) of this section shall not be construed to:

  (1) require a controller to provide a product or service that requires the personal data of a consumer that the controller does not collect or maintain; or

  (2) prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the offering is in connection with a consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.

  (c) Privacy notice.

  (1) A controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes:

  (A) the categories of personal data processed by the controller;

  (B) the purpose for processing personal data and a description of the processing, pursuant to subdivision (a)(1) of this section;

  (C) a description of the means, established pursuant to subsection (d) of this section, for consumers to submit requests to exercise their consumer rights pursuant to this subchapter, including a description of how consumers may:

  (i) exercise a consumer’s rights under subsection 2415d(a) of this subchapter; and

  (ii) appeal a controller’s decisions with regard to requests to exercise such rights;

  (D) the categories of personal data that the controller sells to third parties, if any;

  (E) the categories of third parties, if any, to which the controller sells personal data;

  (F) a clear and conspicuous disclosure of any:

  (i) processing of personal data for purposes of targeted advertising; or

  (ii) sale of personal data to a third party for purposes of targeted advertising;

  (G) an active email address or other online mechanism that the consumer may use to contact the controller;

  (H) a statement disclosing whether the controller collects, uses, or sells personal data for the purpose of training large language models; and

  (I) the most recent month and year during which the controller updated the privacy notice.

  (2) A controller shall make the privacy notice required under subdivision (1) of this subsection publicly available:

  (A) through a conspicuous hyperlink that includes the word “privacy”:

  (i) on the home page of the controller’s website, if the controller maintains a website;

  (ii) on the application store page or download page of a mobile device, if the controller maintains an application for use on a mobile device; and

  (iii) on the application’s settings menu or in a similarly conspicuous and accessible location, if the controller maintains an application for use on a mobile device or other device used to connect to the internet;

  (B) through a medium in which the controller regularly interacts with consumers, including mail, if the controller does not maintain a website;

  (C) in each language in which the controller:

  (i) provides any product or service that is subject to the privacy notice; or

  (ii) carries out any activity that is related to any product or service described in subdivision (i) of this subdivision (C); and

  (D) in a manner that is reasonably accessible to, and usable by, individuals with disabilities.

  (3) Whenever a controller makes any retroactive material change to the controller’s privacy notice or practices, the controller shall:

  (A) notify the consumers affected by such material change with respect to any personal data to be collected after the effective date of such material change;

  (B) provide a reasonable opportunity for the consumers described in subdivision (A) of this subdivision (3) to withdraw consent to any further and materially different collection, processing, or transfer of previously collected personal data following such material change; and

  (C) take all reasonable electronic measures to provide the notice set forth in this subdivision (3) to the affected consumers, taking into account the technology available to the controller and the nature of the controller’s relationship with such affected consumers.

  (4) Nothing in this subsection shall be construed to require a controller to provide a privacy notice that is specific to this State if the controller provides a generally applicable privacy notice that satisfies the requirements established in this subsection.

  (d) Providing consumers access to exercise rights.

  (1) A controller shall:

  (A) establish and describe in a privacy notice one or more secure and reliable means for consumers to submit a request to exercise their consumer rights pursuant to this subchapter; and

  (B) not require a consumer to create a new account in order to exercise consumer rights but may require a consumer to use an existing account.

  (2) The means pursuant to subdivision (1) of this subsection shall:

  (A) take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of the requests, and the ability of the controller to verify the identity of the consumer making the request;

  (B) provide a clear and conspicuous link on the controller’s website to a web page that enables a consumer, or an agent of the consumer, to opt out of the processing of the consumer’s personal data for purposes of targeted advertising or any sale of the consumer’s personal data; and

  (C) allow a consumer to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising, or any sale of the personal data, through an opt-out preference signal sent to the controller with the consumer’s consent indicating the consumer’s intent to opt out of any of the processing or sale, by a platform, technology, or other mechanism that shall:

  (i) not unfairly disadvantage another controller;

  (ii) not make use of a default setting, but rather require the consumer to make an affirmative, freely given, and unambiguous choice to opt out of any processing of the consumer’s personal data pursuant to this subchapter;

  (iii) be consumer friendly and easy to use by the average consumer;

  (iv) be as consistent as possible with any other similar platform, technology, or mechanism required by any federal or State law or regulation; and

  (v) enable the controller to accurately determine whether the consumer is a resident of this State and whether the consumer has made a legitimate request to opt out of any sale of the consumer’s personal data or targeted advertising.

  (3) If a consumer’s decision to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising, or any sale of the personal data, through an opt-out preference signal sent in accordance with the provisions of subdivision (2)(C) of this subsection conflicts with the consumer’s existing controller-specific privacy setting or voluntary participation in a controller’s bona fide loyalty, rewards, premium features, discounts, or club card program, the controller shall comply with the consumer’s opt-out preference signal but may notify the consumer of the conflict and provide to the consumer the choice to confirm the controller-specific privacy setting or participation in the program.

  (4) If a controller responds to a consumer opt-out request received pursuant to subdivision (2)(C) of this subsection by informing the consumer of a charge for the use of any product or service, the controller shall present the terms of any financial incentive offered pursuant to subdivision (b)(2) of this section for the retention, use, sale, or sharing of the consumer’s personal data. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)

• § 2415f. Processors’ duties; contracts between controllers and processors [Effective January 1, 2028]

  (a) Generally. A processor shall adhere to the instructions of a controller and shall assist the controller in meeting the controller’s obligations under this subchapter, including:

  (1) taking into account the nature of processing and to the extent possible, to fulfill the controller’s obligation to respond to consumer rights requests pursuant to subsection 2415d(a) of this subchapter;

  (2) taking into account the nature of processing and the information available to the processor, by assisting the controller in meeting the controller’s obligations in relation to the security of processing the personal data and in relation to the notification of a data broker security breach or security breach, as defined in section 2430 of this title, of the system of the processor, in order to meet the controller’s obligations; and

  (3) providing necessary information to enable the controller to conduct and document data protection and impact assessments.

  (b) Contractual terms.

  (1) A contract between a controller and a processor shall govern the processor’s data processing procedures with respect to processing performed on behalf of the controller.

  (2) The contract shall be binding and clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties.

  (3) The contract shall require that the processor:

  (A) ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data;

  (B) at the controller’s direction, delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law;

  (C) upon the reasonable request of the controller, make available to the controller all information in its possession necessary to demonstrate the processor’s compliance with the obligations in this subchapter;

  (D) after providing the controller an opportunity to object, engage any subcontractor pursuant to a written contract that requires the subcontractor to meet the obligations of the processor with respect to the personal data; and

  (E) make available to the controller upon the reasonable request of the controller all information in the processor’s possession necessary to demonstrate the processor’s compliance with this subchapter.

  (4) A processor shall provide a report of an assessment to the controller upon request.

  (c) Liabilities. This section shall not be construed to relieve a controller or processor from the liabilities imposed on the controller or processor by virtue of the controller’s or processor’s role in the processing relationship, as described in this subchapter.

  (d) Processors performing as controllers.

  (1) Determining whether a person is acting as a controller or processor with respect to a specific processing of data is a fact-based determination that depends upon the context in which personal data are to be processed.

  (2) A person who is not limited in the person’s processing of personal data pursuant to a controller’s instructions, or who fails to adhere to the instructions, is a controller and not a processor with respect to a specific processing of data.

  (3) A processor that continues to adhere to a controller’s instructions with respect to a specific processing of personal data remains a processor.

  (4) If a processor begins, alone or jointly with others, determining the purposes and means of the processing of personal data, the processor is a controller with respect to the processing and may be subject to an enforcement action under section 2415j of this subchapter. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)

• § 2415g. Data protection and impact assessments; disclosure to Attorney General [Effective January 1, 2028]

  (a) Generally. A controller shall conduct and document a data protection assessment for each of the controller’s processing activities that presents a heightened risk of harm to a consumer, which for the purposes of this section includes:

  (1) the processing of personal data for the purposes of targeted advertising;

  (2) the sale of personal data;

  (3) the processing of personal data for the purposes of profiling, if the profiling presents a reasonably foreseeable risk of:

  (A) unfair or deceptive treatment of, or unlawful disparate impact on, a consumer;

  (B) financial, physical, or reputational injury to a consumer;

  (C) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of a consumer, if the intrusion would be offensive to a reasonable person; or

  (D) other substantial injury to a consumer; and

  (4) the processing of sensitive data.

  (b) Requirements.

  (1) Data protection assessments conducted pursuant to subsection (a) of this section shall identify and weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with the processing, as mitigated by safeguards that can be employed by the controller to reduce the risks.

  (2) The controller shall factor into each data protection assessment the use of deidentified data and the reasonable expectations of consumers, as well as the context of the processing and the relationship between the controller and the consumer whose personal data will be processed.

  (c) Impact assessments for profiling. Each controller that engages in any profiling for the purposes of making a decision that produces any legal or similarly significant effect concerning a consumer shall conduct an impact assessment for the profiling. The impact assessment shall include, to the extent reasonably known by or available to the controller, as applicable:

  (1) a statement by the controller disclosing the purpose, intended use cases, and deployment context of, and benefits afforded by, the profiling;

  (2) an analysis of whether the profiling poses any known or reasonably foreseeable heightened risk of harm to a consumer, and, if so:

  (A) the nature of such heightened risk of harm to a consumer; and

  (B) the steps that have been taken to mitigate such heightened risk of harm to a consumer;

  (3) a description of:

  (A) the main categories of personal data processed as inputs for the purposes of such profiling; and

  (B) the outputs such profiling produces;

  (4) an overview of the main categories of personal data the controller used to customize the profiling, if the controller used data to customize the profiling;

  (5) any metrics used to evaluate the performance and known limitations of the profiling;

  (6) a description of any transparency measures taken concerning the profiling, including any measures taken to disclose to consumers that the controller is engaged in profiling while the controller is engaged in the profiling; and

  (7) a description of the postdeployment monitoring and user safeguards provided concerning such profiling, including the oversight, use, and learning processes established by the controller to address issues arising from such profiling.

  (d) Disclosure to Attorney General.

  (1) The Attorney General may require that a controller disclose any data protection or impact assessment that is relevant to an investigation conducted by the Attorney General, and the controller shall make the data protection or impact assessment available to the Attorney General.

  (2) The Attorney General may evaluate the data protection or impact assessment for compliance with the responsibilities set forth in this subchapter.

  (3) Data protection and impact assessments shall be confidential and shall be exempt from disclosure and copying under the Public Records Act.

  (4) To the extent any information contained in a data protection or impact assessment disclosed to the Attorney General includes information subject to attorney-client privilege or work product protection, the disclosure shall not constitute a waiver of the privilege or protection.

  (e) Assessment efficiency and applicability.

  (1) A single data protection or impact assessment may address a comparable set of processing operations that include similar activities.

  (2) If a controller conducts a data protection or impact assessment for the purpose of complying with another applicable law or regulation, the data protection or impact assessment shall be deemed to satisfy the requirements established in this section if the data protection or impact assessment is reasonably similar in scope and effect to the data or impact protection assessment that would otherwise be conducted pursuant to this section.

  (3) Data protection and impact assessment requirements shall apply to processing activities created or generated after January 1, 2028, and are not retroactive. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)

• § 2415h. Deidentified data [Effective January 1, 2028]

  (a) Requirements. A controller in possession of deidentified data shall:

  (1) take reasonable measures to ensure that the data cannot be associated with an individual;

  (2) publicly commit to maintaining and using deidentified data without attempting to reidentify the data; and

  (3) contractually obligate any recipients of the deidentified data to comply with the provisions of this subchapter.

  (b) Limitations. This subchapter shall not be construed to:

  (1) require a controller or processor to reidentify deidentified data or pseudonymous data;

  (2) maintain data in identifiable form, or collect, obtain, retain, or access any data or technology, in order to be capable of associating an authenticated consumer request with personal data; or

  (3) require a controller or processor to comply with an authenticated consumer rights request if the controller:

  (A) is not reasonably capable of associating the request with the personal data or it would be unreasonably burdensome for the controller to associate the request with the personal data;

  (B) does not use the personal data to recognize or respond to the specific consumer who is the subject of the personal data, or associate the personal data with other personal data about the same specific consumer; and

  (C) does not sell the personal data to any third party or otherwise voluntarily disclose the personal data to any third party other than a processor, except as otherwise permitted in this section.

  (c) Pseudonymous data. The rights afforded under subdivisions 2415d(a)(1)–(4) of this subchapter shall not apply to pseudonymous data in cases in which the controller is able to demonstrate that any information necessary to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing the information.

  (d) Oversight when disclosing. A controller that discloses pseudonymous data or deidentified data shall exercise reasonable oversight to monitor compliance with any contractual commitments to which the pseudonymous data or deidentified data is subject and shall take appropriate steps to address any breaches of those contractual commitments. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)

• § 2415i. Construction of duties [Effective January 1, 2028]

  (a) Generally. This subchapter shall not be construed to restrict a controller’s, processor’s, or consumer health data controller’s ability to:

  (1) comply with federal, state, or municipal laws, ordinances, or regulations, except as prohibited by 1 V.S.A. § 150;

  (2) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, municipal, or other governmental authorities;

  (3) cooperate with law enforcement agencies concerning conduct or activity that the controller, processor, or consumer health data controller reasonably and in good faith believes may violate federal, state, or municipal laws, ordinances, or regulations;

  (4) investigate, establish, exercise, prepare for, or defend legal claims;

  (5) provide a product or service specifically requested by a consumer;

  (6) perform under a contract to which a consumer is a party, including fulfilling the terms of a written warranty;

  (7) take steps at the request of a consumer prior to entering into a contract;

  (8) take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another individual, and if the processing cannot be manifestly based on another legal basis;

  (9) prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for the action;

  (10) engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board that determines, or similar independent oversight entities that determine:

  (A) whether the deletion of the information is likely to provide substantial benefits that do not exclusively accrue to the controller;

  (B) the expected benefits of the research outweigh the privacy risks; and

  (C) whether the controller or consumer health data controller has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with reidentification;

  (11) assist another controller, processor, consumer health data controller, or third party with any of the obligations under this subchapter; or

  (12) process personal data for reasons of public interest in the area of public health, community health, or population health, but solely to the extent that the processing is:

  (A) subject to suitable and specific measures to safeguard the rights of the consumer whose personal data are being processed; and

  (B) under the responsibility of a professional subject to confidentiality obligations under federal, state, or local law.

  (b) Internal use of data. The obligations imposed on controllers, processors, or consumer health data controllers under this subchapter shall not restrict a controller’s, processor’s, or consumer health data controller’s ability to collect, use, or retain data for internal use to:

  (1) conduct internal research to develop, improve, or repair products, services, or technology;

  (2) effectuate a product recall;

  (3) identify and repair technical errors that impair existing or intended functionality;

  (4) process personal data for the purposes of profiling in furtherance of any automated decision that may produce any legal or similarly significant effect concerning a consumer, provided the personal data are:

  (A) processed only to the extent necessary to detect or correct any bias that may result from processing the data for such purposes, the bias cannot effectively be detected or corrected without processing the data, and the data are deleted once the processing has been completed;

  (B) processed subject to appropriate safeguards to protect the rights of consumers secured by the Constitution or laws of this State or of the United States;

  (C) subject to technical restrictions concerning the reuse of the data and industry-standard security and privacy measures, including pseudonymization;

  (D) subject to measures to ensure that the data are secure, protected, and subject to suitable safeguards, including strict controls concerning, and documentation of, access to the data, to avoid misuse and ensure that only authorized persons may access the data while preserving the confidentiality of the data; and

  (E) not transmitted, transferred, or otherwise accessed by any third party;

  (5) perform internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer’s existing relationship with the controller or consumer health data controller, or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party; or

  (6) perform internal operations in accordance with the internal operations exception established in COPPA if the controller, processor, or consumer health data controller is processing data in accordance with the exception.

  (c) Evidentiary privilege.

  (1) The obligations imposed on controllers, processors, or consumer health data controllers under this subchapter shall not apply if compliance by the controller, processor, or consumer health data controller with this subchapter would violate an evidentiary privilege under the laws of this State.

  (2) This subchapter shall not be construed to prevent a controller, processor, or consumer health data controller from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of this State as part of a privileged communication.

  (3) Nothing in this subchapter modifies 2020 Acts and Resolves No. 166, Sec. 14 or authorizes the use of facial recognition technology by law enforcement.

  (d) Third parties.

  (1) A controller, processor, or consumer health data controller that discloses personal data to a processor or third-party controller pursuant to this subchapter shall not be deemed to have violated this subchapter if the processor or third-party controller that receives and processes the personal data violates this subchapter, provided, at the time the disclosing controller, processor, or consumer health data controller disclosed the personal data, the disclosing controller, processor, or consumer health data controller did not have actual knowledge that the receiving processor or third-party controller would violate this subchapter.

  (2) A third-party controller or processor receiving personal data from a controller, processor, or consumer health data controller in compliance with this subchapter is not in violation of this subchapter for the transgressions of the controller, processor, or consumer health data controller from which the third-party controller or processor receives the personal data.

  (e) Clarifications. This subchapter shall not be construed to:

  (1) impose any obligation on a controller or processor that adversely affects the rights or freedoms of any person, including the rights of any person:

  (A) to freedom of speech or freedom of the press guaranteed in the First Amendment to the U.S. Constitution; or

  (B) under 12 V.S.A. § 1615;

  (2) apply to any person’s processing of personal data in the course of the person’s purely personal or household activities; or

  (3) require an independent school as defined in 16 V.S.A. § 11(a)(8) or a private institution of higher education, as defined in 20 U.S.C. § 1001 et seq., to delete personal data or opt out of processing of personal data that would unreasonably interfere with the provision of education services by or the ordinary operation of the school or institution.

  (f) Personal data processing.

  (1) Personal data processed by a controller or consumer health data controller pursuant to this section may be processed to the extent that the processing is:

  (A) reasonably necessary and proportionate to the purposes listed in this section; and

  (B) adequate, relevant, and limited to what is necessary in relation to the specific purposes listed in this section.

  (2)(A) The collection, use, or retention of personal data pursuant to subsection (b) of this section shall, where applicable, take into account the nature and purpose or purposes of the collection, use, or retention.

  (B) The data shall be subject to reasonable administrative, technical, and physical measures to protect the confidentiality, integrity, and accessibility of the personal data and to reduce reasonably foreseeable risks of harm to consumers relating to the collection, use, or retention of personal data.

  (3) If a controller or consumer health data controller processes personal data pursuant to an exemption in this section, the controller or consumer health data controller bears the burden of demonstrating that the processing qualifies for the exemption and complies with the requirements of this subsection.

  (4) Processing personal data for the purposes expressly identified in this section shall not solely make a legal entity a controller or consumer health data controller with respect to the processing. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)

• § 2415j. Attorney General enforcement; reporting [Effective January 1, 2028]

  (a) Consumer Protection Act. A violation of this subchapter shall be deemed a violation of the Vermont Consumer Protection Act, pursuant to chapter 63 of this title. The Attorney General has the same authority to enforce this subchapter as provided under chapter 63, subchapter 1 of this title. This subchapter shall not be construed as providing the basis for, or be subject to, a private right of action for violations of this subchapter or any other law.

  (b) Reporting. Annually, on or before December 1, the Attorney General shall submit a report to the General Assembly disclosing:

  (1) the number of notices of violation pursuant to this subchapter that the Attorney General has issued;

  (2) the nature of each violation;

  (3) the number of violations that resulted in an enforcement action being taken;

  (4) the number of enforcement actions that proceeded to trial;

  (5) whether and to what extent the Attorney General has offered an opportunity for a controller or processor to cure a violation; and

  (6) any other matter the Attorney General deems relevant for the purposes of the report.

  (c) Guidance. The Attorney General shall provide, and update as necessary, guidance to controllers and processors for compliance with the terms of the Vermont Data Privacy and Online Surveillance Act. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)

• § 2415k. Consumer health data privacy [Effective January 1, 2028]

  A person shall not:

  (1) provide any employee or contractor with access to consumer health data unless the employee or contractor is subject to a contractual or statutory duty of confidentiality;

  (2) provide any processor with access to consumer health data unless the person and processor comply with section 2415f of this subchapter;

  (3) use a geofence to establish a virtual boundary that is within 1,850 feet of any health care facility, including any mental health facility or reproductive or sexual health facility, for the purpose of identifying, tracking, collecting data from, or sending any notification to a consumer regarding the consumer’s consumer health data; or

  (4) sell, or offer to sell, consumer health data without first obtaining the consumer’s consent. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)

• Subchapter 002: Genetic Information Privacy

• § 2421a. Short title and definitions

  (a) This subchapter shall be known, and may be cited, as the “Genetic Information Privacy Act.”

  (b) As used in this subchapter:

  (1) “Affirmative authorization” means an action that demonstrates an intentional decision by a consumer.

  (2) “Biological sample” means any material part of the human, discharge therefrom, or derivative thereof, such as tissue, blood, urine, or saliva, known to contain deoxyribonucleic acid (DNA).

  (3)(A) “Biometric data” means data generated from the technological processing of a consumer’s unique biological, physical, or physiological characteristics that allow or confirm the unique identification of the consumer, including:

  (i) iris or retina scans;

  (ii) fingerprints;

  (iii) facial or hand mapping, geometry, or templates;

  (iv) vein patterns;

  (v) voice prints or vocal biomarkers; and

  (vi) gait or personally identifying physical movement or patterns.

  (B) “Biometric data” does not include:

  (i) a digital or physical photograph;

  (ii) an audio or video recording; or

  (iii) any data generated from a digital or physical photograph, or an audio or video recording, unless such data is generated to identify a specific consumer.

  (4) “Consumer” means an individual who is a Vermont resident.

  (5) “Dark pattern” means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice.

  (6) “Direct-to-consumer genetic testing company” means an entity that:

  (A) sells, markets, interprets, or otherwise offers consumer-initiated genetic testing products or services directly to consumers;

  (B) analyzes genetic data obtained from a consumer, except to the extent that the analysis is performed by a person licensed in the healing arts for diagnosis or treatment of a medical condition; or

  (C) collects, uses, maintains, or discloses genetic data that is:

  (i) collected or derived from a direct-to-consumer genetic testing product or service; or

  (ii) directly provided by a consumer.

  (7) “Disclose,” “disclosing,” or “disclosure” means to solicit, sell, assign, transfer, give, provide, or trade, whether or not for valuable consideration.

  (8) “Express consent” means a consumer’s affirmative authorization to grant permission in response to a clear, meaningful, and prominent notice regarding the collection, use, maintenance, or disclosure of genetic data for a specific purpose. Express consent cannot be inferred from inaction. Agreement obtained through the use of dark patterns does not constitute express consent.

  (9)(A) “Genetic data” means any data, regardless of its format, that results from the analysis of a biological sample from a consumer, or from another element enabling equivalent information to be obtained, and concerns genetic material. Genetic material includes deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), uninterpreted data that results from the analysis of the biological sample, and any information extrapolated, derived, or inferred therefrom.

  (B) “Genetic data” does not include deidentified data. For purposes of this subdivision (B), “deidentified data” means data that cannot be used to infer information about, or otherwise be linked to, a particular individual, provided that the business that possesses the information:

  (i) takes reasonable measures to ensure that the information cannot be associated with a consumer or household;

  (ii) publicly commits to maintain and use the information only in deidentified form and not to attempt to reidentify the information, except that the business may periodically attempt to reidentify the information solely for the purpose of determining whether its deidentification processes satisfy the requirements of this subdivision (B), on the express condition that the business does not use or disclose any information reidentified in this process and destroys the reidentified information upon completion of that periodic assessment; and

  (iii) contractually obligates any recipients of the information to take reasonable measures to ensure that the information cannot be associated with a consumer or household and to commit to maintaining and using the information only in deidentified form and not to reidentify the information.

  (C) “Genetic data” does not include data or a biological sample to the extent that data or a biological sample is collected, used, maintained, and disclosed:

  (i) exclusively for scientific research conducted by an investigator with an institution that holds an assurance with the U.S. Department of Health and Human Services pursuant to 45 C.F.R. Part 46; or

  (ii) in compliance with all applicable federal and State laws and regulations for the protection of human subjects in research, including the:

  (I) Common Rule, 45 C.F.R. Part 46;

  (II) U.S. Food and Drug Administration regulations pursuant to 21 C.F.R. Parts 50 and 56; and

  (III) Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g.

  (10) “Genetic testing” means any laboratory test of a biological sample from a consumer for the purpose of determining information concerning genetic material contained within the biological sample, or any information extrapolated, derived, or inferred therefrom.

  (11) “Person” means an individual, partnership, corporation, association, business, business trust, or legal representative of an organization.

  (12)(A) “Publicly available information” means information that is made available through federal, state, or local government records or to the general public from widely distributed media.

  (B) “Publicly available information” does not include:

  (i) biometric data collected by a business about a consumer without the consumer’s knowledge;

  (ii) information that is collated and combined to create a consumer profile that is made available to a user of a publicly available website either in exchange for payment or free of charge;

  (iii) information that is made available for sale;

  (iv) an inference that is generated from the information described in subdivision (ii) or (iii) of this subdivision (12)(B);

  (v) any obscene visual depiction, as defined in 18 U.S.C. § 1460;

  (vi) personal data that is created through the combination of personal data with publicly available information;

  (vii) genetic data, unless otherwise made publicly available by the consumer to whom the information pertains;

  (viii) information provided by a consumer on a website or online service made available to all members of the public, for free or for a fee, where the consumer has maintained a reasonable expectation of privacy in the information, such as by restricting the information to a specific audience; or

  (ix) intimate images, authentic or computer generated, known to be nonconsensual.

  (13) “Service provider” means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is involved in the collection, transportation, or analysis of the consumer’s biological sample or extracted genetic material:

  (A) on behalf of a direct-to-consumer genetic testing company;

  (B) on behalf of any other company that collects, uses, maintains, or discloses genetic data collected or derived from a direct-to-consumer genetic testing product or service; or

  (C) that is directly provided by a consumer. (Added 2025, No. 135 (Adj. Sess.), § 1, eff. July 1, 2026.)

• § 2421b. Requirements

  (a) Privacy terms and consent. To safeguard the privacy, confidentiality, security, and integrity of a consumer’s genetic data, a direct-to-consumer genetic testing company shall:

  (1) provide clear and complete information regarding the company’s policies and procedures for the collection, use, maintenance, and disclosure, as applicable, of genetic data by making available to a consumer all of the following:

  (A) a summary of its privacy practices, written in plain language, that includes information about the company’s collection, use, maintenance, and disclosure, as applicable, of genetic data;

  (B) a prominent and easily accessible privacy notice that includes, at a minimum, complete information about the company’s data collection, consent, use, access, disclosure, maintenance, transfer, security, and retention and deletion practices; and

  (C) a notice that the consumer’s deidentified genetic or phenotypic information may be shared with or disclosed to third parties for research purposes in accordance with 45 C.F.R. Part 46; and

  (2) obtain a consumer’s express consent for the collection, use, and disclosure of the consumer’s genetic data, including, at a minimum, separate and express consent for each of the following:

  (A) the use of the genetic data collected through the genetic testing product or service offered to the consumer, including:

  (i) who has access to genetic data;

  (ii) how genetic data may be shared; and

  (iii) the specific purposes for which the data will be collected, used, and disclosed;

  (B) the storage of a consumer’s biological sample after the initial testing requested by the consumer has been fulfilled;

  (C) each use of genetic data or the biological sample beyond the primary purpose of the genetic testing or service;

  (D) each transfer or disclosure of the consumer’s genetic data or biological sample to a third party other than a service provider, including the name of the third party to which the consumer’s genetic data or biological sample will be transferred or disclosed and the intended purpose of said transfer, except that a company shall not require a consumer to expressly consent to the actions in this subdivision (D) in order to receive the services ordered from the company by the consumer; and

  (E) the marketing or facilitation of marketing to a consumer based on the consumer’s genetic data or the marketing or facilitation of marketing by a third party based upon the consumer having ordered, purchased, received, or used a genetic testing product or service.

  (b) Marketing exception.

  (1) Subdivision (a)(2)(E) of this section does not require a direct-to-consumer genetic testing company to obtain a consumer’s express consent to market to the consumer on the company’s own website or mobile application based upon the consumer having ordered, purchased, received, or used a genetic testing product or service from that company if the content of the advertisement does not depend upon any information specific to that consumer. Nothing in this subdivision alters, limits, or negates the requirements of any other antidiscrimination law or targeted advertising law.

  (2) Any advertisement of a third-party product or service presented to a consumer pursuant to subdivision (1) of this subsection or subdivision (a)(2)(E) of this section shall be prominently labeled as advertising content and be accompanied by the name of any third party that has contributed to the placement of the advertising. If applicable, the advertisement also shall clearly indicate that the advertised product or service, and any associated claims, have not been vetted or endorsed by the direct-to-consumer genetic testing company.

  (c) Revoking consent.

  (1) A direct-to-consumer genetic testing company that is subject to the requirements in subdivision (a)(2) of this section shall provide effective mechanisms for a consumer to withdraw consent provided pursuant to this subchapter that is at least as easy as the mechanism by which the consumer provided the consent, at least one of which utilizes the primary medium through which the company communicates with consumers.

  (2) If a consumer revokes consent pursuant to subdivision (1) of this subsection, the direct-to-consumer genetic testing company shall:

  (A) honor the consumer’s consent revocation as soon as practicable, but not later than 30 days after the individual revokes consent; and

  (B) if the revocation is related to the storage or use of a consumer’s biological sample, destroy the consumer’s biological sample not later than 30 days after receipt of the revocation of consent.

  (d) Data security and access.

  (1) A direct-to-consumer genetic testing company shall:

  (A) implement and maintain reasonable security procedures and practices to protect a consumer’s genetic data against unauthorized access, destruction, use, modification, or disclosure;

  (B) develop procedures and practices to enable a consumer to easily:

  (i) access the consumer’s genetic data;

  (ii) delete the consumer’s account and genetic data, except for genetic data that is required to be retained by the company to comply with applicable legal and regulatory requirements; and

  (iii) request to have and have the consumer’s biological sample destroyed; and

  (C) upon a request from a consumer to delete the consumer’s genetic data or to destroy the consumer’s biological sample pursuant to subdivision (B)(ii) or (iii) of this subdivision (d)(1), notify any third party, including service providers, that have received the consumer’s data or sample from the company to delete the consumer’s data or destroy the consumer’s sample not later than 30 days after the consumer makes the request.

  (2) Genetic data and biological samples of consumers shall:

  (A) not be stored within the territorial boundaries of any country currently sanctioned in any way by the U.S. Office of Foreign Assets Control or designated as a foreign adversary under 15 C.F.R. § 7.4(a); and

  (B) only be transferred or stored outside the United States with the express consent of the consumer.

  (e) Contracts.

  (1) A contract between a direct-to-consumer genetic testing company and a service provider shall prohibit the service provider from:

  (A) retaining, using, or disclosing the biological sample, genetic data, or any information regarding the identity of the consumer, including whether that consumer has solicited or received genetic testing, for a commercial purpose other than providing the services specified in the contract with the business; and

  (B) associating or combining the biological sample, genetic data, or any information regarding the identity of the consumer, including whether that consumer has solicited or received genetic testing, with information the service provider has received from or on behalf of another person or persons, or has collected from its own interaction with consumers or as required by law.

  (2) Upon the termination of a contract between a direct-to-consumer genetic testing company and a service provider, the service provider shall:

  (A) immediately destroy all genetic data the service provider retained during the contractual period with the testing company pursuant to subdivision (1)(A) of this subsection (e); and

  (B) not disclose, transfer, or sell genetic data to a third party before it destroys the genetic data pursuant to subdivision (A) of this subdivision (2).

  (f) Discrimination. A person or public entity shall not discriminate against a consumer because the consumer exercised any of the consumer’s rights under this subchapter by:

  (1) denying goods, services, or benefits to the consumer;

  (2) charging different prices or rates for goods or services, including through the use of discounts or other incentives, or imposing penalties;

  (3) providing a different level or quality of goods, services, or benefits to the consumer;

  (4) suggesting that the consumer will receive a different price or rate for goods, services, or benefits, or a different level or quality of goods, services, or benefits; and

  (5) considering the consumer’s exercise of rights under this subchapter as a basis for suspicion of criminal wrongdoing or unlawful conduct.

  (g) Nondisclosure and warrant requirement. Notwithstanding any other provision in this section, a direct-to-consumer genetic testing company shall not disclose:

  (1) a consumer’s genetic data to any entity that is responsible for administering or making decisions regarding health insurance, life insurance, long-term care insurance, disability insurance, or employment, or to any entity that provides advice to an entity that is responsible for performing those functions; or

  (2) any information about a consumer to a government entity, including the consumer’s genetic data or name:

  (A) without a search warrant issued by a court on a finding of probable cause; or

  (B) unless the consumer whose information is sought provides express consent to the disclosure upon being notified by the direct-to-consumer genetic testing company. (Added 2025, No. 135 (Adj. Sess.), § 1, eff. July 1, 2026.)

• § 2421c. Enforcement

  (a) A direct-to-consumer genetic testing company or service provider that violates this subchapter or rules adopted pursuant to this subchapter commits an unfair and deceptive act in commerce in violation of section 2453 of this title.

  (b) The Attorney General shall have the same authority under this subchapter to make rules, conduct civil investigations, bring civil actions, and enter into assurances of discontinuance against any person as provided under chapter 63 of this title. (Added 2025, No. 135 (Adj. Sess.), § 1, eff. July 1, 2026.)

• § 2421d. Applicability

  (a) The provisions of this subchapter shall not reduce a direct-to-consumer genetic testing company’s duties, obligations, requirements, or standards under any applicable State and federal laws for the protection of privacy and security.

  (b) In the event of a conflict between the provisions of this subchapter and any other law, the provisions of the law that afford the greatest protection for the right of privacy for consumers shall control.

  (c) This subchapter shall not apply to any of the following:

  (1) protected health information that is collected, maintained, used, or disclosed by a covered entity or business associate governed by the privacy, security, and breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and the Health Information Technology for Economic and Clinical Health Act, Pub. L. No. 111-5;

  (2) a covered entity governed by the privacy, security, and breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and the Health Information Technology for Economic and Clinical Health Act, Title XIII of the American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5, to the extent that the provider or covered entity maintains, uses, and discloses genetic information in the same manner as medical information or protected health information, as described in subdivision (1) of this subsection;

  (3) a business associate of a covered entity governed by the privacy, security, and data breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established pursuant to the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, and the Health Information Technology for Economic and Clinical Health Act, Title XIII of the American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5, to the extent that the business associate maintains, uses, and discloses genetic information in the same manner as medical information or protected health information, as described in subdivision (1) of this subsection;

  (4) scientific research or educational activities conducted by a public or private nonprofit postsecondary educational institution that holds an assurance with the U.S. Department of Health and Human Services pursuant to 45 C.F.R. Part 46, to the extent that the scientific research and educational activities conducted by that institution comply with all applicable federal and State laws and regulations for the protection of human subjects in research, including the Common Rule pursuant to 45 C.F.R. Part 46, U.S. Food and Drug Administration regulations pursuant to 21 C.F.R. Parts 50 and 56, and the Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g;

  (5) tests conducted exclusively to diagnose whether an individual has a specific disease, to the extent that all persons involved in the conduct of the test maintain, use, and disclose genetic information in the same manner as medical information or protected health information, as described in subdivision (1) of this subsection; and

  (6) genetic data used or maintained by an employer, or disclosed by an employee to an employer, to the extent that the use, maintenance, or disclosure of that data is necessary to comply with a local, State, or federal workplace health and safety ordinance, law, or regulation.

  (d) Nothing in this subchapter shall be construed to affect access to publicly available information. (Added 2025, No. 135 (Adj. Sess.), § 1, eff. July 1, 2026.)