The Vermont Statutes Online

Title 9 : Commerce and Trade

Chapter 061a : Data Privacy [Effective January 1, 2028]

Subchapter 001 : Vermont Data Privacy and Online Surveillance Act [Effective January 1, 2028]

• § 2415a. Short title and definitions [Effective January 1, 2028]

  (a) Short title. This subchapter shall be known and may be cited as the “Vermont Data Privacy and Online Surveillance Act.”

  (b) Definitions. As used in this subchapter:

  (1)(A) “Affiliate” means a legal entity that shares common branding with another legal entity or controls, is controlled by, or is under common control with another legal entity.

  (B) As used in subdivision (A) of this subdivision (1), “control” or “controlled” means:

  (i) ownership of, or the power to vote, more than 50 percent of the outstanding shares of any class of voting security of a company;

  (ii) control in any manner over the election of a majority of the directors or of individuals exercising similar functions; or

  (iii) the power to exercise controlling influence over the management of a company.

  (2) “Authenticate” means to use reasonable means to determine that a request to exercise any of the rights afforded under subdivisions 2415d(a)(1)–(4) of this subchapter is being made by, or on behalf of, the consumer who is entitled to exercise the consumer rights with respect to the personal data at issue.

  (3)(A) “Biometric data” means data generated from the technological processing of an individual’s unique biological, physical, or physiological characteristics that are collected on or used to identify a specific consumer, including:

  (i) iris or retina scans;

  (ii) fingerprints;

  (iii) facial or hand mapping, geometry, or templates;

  (iv) vein patterns;

  (v) voice prints or vocal biomarkers; and

  (vi) gait or personally identifying physical movement or patterns.

  (B) “Biometric data” does not include:

  (i) a digital or physical photograph;

  (ii) an audio or video recording; or

  (iii) any data generated from a digital or physical photograph or an audio or video recording, unless such data is generated to identify a specific individual.

  (4) “Business associate” has the same meaning as in HIPAA.

  (5) “Child” has the same meaning as in COPPA.

  (6)(A) “Collect,” “collected,” or “collection” means buying, renting, gathering, obtaining, receiving, or accessing any personal data by any means, other than such activities between a controller and a processor or between a processor and its subcontractors.

  (B) “Collect,” “collected,” or “collection” includes receiving data from the consumer, either actively or passively, or by observing the consumer’s behavior.

  (7)(A) “Consent” means a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to allow the processing of personal data relating to the consumer.

  (B) “Consent” may include a written statement, including by electronic means, or any other unambiguous affirmative action.

  (C) “Consent” does not include:

  (i) acceptance of a general or broad terms of use or similar document that contains descriptions of personal data processing along with other, unrelated information;

  (ii) hovering over, muting, pausing, or closing a given piece of content; or

  (iii) agreement obtained through the use of dark patterns.

  (8)(A) “Consumer” means an individual who is a resident of the State.

  (B) “Consumer” does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit organization, or government agency whose communications or transactions with the controller occur solely within the context of that individual’s role with the company, partnership, sole proprietorship, nonprofit organization, or government agency.

  (9) “Consumer health data” means any personal data that a controller uses to identify a consumer’s physical or mental health condition, diagnosis, or status, including gender-affirming health data and reproductive or sexual health data.

  (10) “Consumer health data controller” means any controller that, alone or jointly with others, determines the purpose and means of processing consumer health data.

  (11) “Consumer reporting agency” has the same meaning as in the Fair Credit Reporting Act, 15 U.S.C. § 1681a(f).

  (12) “Controller” means a person who, alone or jointly with others, determines the purpose and means of processing personal data.

  (13) “COPPA” means the Children’s Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501–6506, and any regulations, rules, guidance, and exemptions adopted pursuant to the act, as the act and regulations, rules, guidance, and exemptions may be amended.

  (14) “Covered entity” has the same meaning as in HIPAA.

  (15) “Credit union” has the same meaning as in 8 V.S.A. § 30101.

  (16) “Dark pattern” means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice and includes any practice the Federal Trade Commission refers to as a “dark pattern.”

  (17) “Decision that produces any legal or similarly significant effect” means any decision made by the controller, or on behalf of the controller, that results in the provision or denial by the controller of any financial or lending service, any housing, any insurance, any education enrollment or opportunity, any criminal justice, any employment opportunity, or any health care service.

  (18) “Deidentified data” means data that does not identify and cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to the individual, if the controller that possesses the data:

  (A)(i) takes reasonable measures to ensure that the data cannot be used to reidentify an identified or identifiable individual or be associated with an individual or device that identifies or is linked or reasonably linkable to an individual; and

  (ii) for purposes of this subdivision (A), “reasonable measures” includes the deidentification requirements set forth under 45 C.F.R § 164.514 (other requirements relating to uses and disclosures of protected health information);

  (B) publicly commits to process the data only in a deidentified fashion and not attempt to reidentify the data; and

  (C) contractually obligates any recipients of the data to comply with all provisions of this subchapter.

  (19) “Derived data” means data that is created by the derivation of information, data, assumptions, correlations, inferences, predictions, or conclusions from facts, evidence, or another source of information or data about a consumer’s device.

  (20) “Gender-affirming health care services” has the same meaning as in 1 V.S.A. § 150.

  (21) “Gender-affirming health data” means any personal data concerning a past, present, or future effort made by a consumer to seek, or a consumer’s receipt of, gender-affirming health care services.

  (22) “Genetic data” means any data, regardless of its format, that results from the analysis of a biological sample of an individual, or from another source enabling equivalent information to be obtained, and concerns genetic material, including deoxyribonucleic acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes, alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs), epigenetic markers, uninterpreted data that results from analysis of the biological sample or other source, and any information extrapolated, derived, or inferred therefrom.

  (23) “Geofence” means any technology that uses global positioning coordinates, cell tower connectivity, cellular data, radio frequency identification, wireless fidelity technology data, or any other form of location detection, or any combination of such coordinates, connectivity, data, identification, or other form of location detection, to establish a virtual boundary.

  (24) “Health care facility” has the same meaning as in 18 V.S.A. § 9432.

  (25) “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, as may be amended.

  (26) “Hybrid entity” has the same meaning as in HIPAA.

  (27) “Identified or identifiable individual” means an individual who can be readily identified, directly or indirectly, including by reference to an identifier such as a name, an identification number, precise geolocation data, or an online identifier.

  (28) “Institution of higher education” means any individual who, or school, board, association, limited liability company, or corporation that, is licensed or accredited to offer one or more programs of higher learning leading to one or more degrees.

  (29) “Mental health facility” means any health care facility in which at least 70 percent of the health care services provided in the facility are mental health services.

  (30) “Minor” means any consumer who is younger than 18 years of age.

  (31) “Neural data” means any information that is generated by measuring the activity of an individual’s central nervous system.

  (32) “Nonprofit organization” means any organization that is qualified for tax exempt status under I.R.C. § 501(c)(3), 501(c)(4), 501(c)(6), or 501(c)(12), or any corresponding internal revenue code of the United States, as may be amended.

  (33) “Patient-identifying information” has the same meaning as in 42 C.F.R. § 2.11 (confidentiality of substance use disorder patient records).

  (34) “Person” means an individual, association, company, limited liability company, corporation, partnership, sole proprietorship, trust, or other legal entity.

  (35)(A) “Personal data” means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals.

  (B) “Personal data” does not include deidentified data or publicly available information.

  (36)(A) “Precise geolocation data” means information derived from technology, including global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet.

  (B) “Precise geolocation data” does not include:

  (i) the content of communications;

  (ii) data generated by or connected to an advanced utility metering infrastructure system; or

  (iii) data generated by equipment used by a utility company.

  (37) “Process” or “processing” means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.

  (38) “Processor” means a person who collects or processes personal data on behalf of:

  (A) a controller; or

  (B) another processor.

  (39) “Profiling” means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects, including an individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, movements, or identifying characteristics.

  (40) “Protected health information” has the same meaning as in HIPAA.

  (41) “Pseudonymous data” means personal data that cannot be attributed to a specific individual without the use of additional information, provided the additional information is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable individual.

  (42)(A) “Publicly available information” means information that:

  (i) is made available through federal, state, or local government records or to the general public from widely distributed media; or

  (ii) a controller has a reasonable basis to believe that the consumer has lawfully made available to the general public.

  (B) “Publicly available information” does not include:

  (i) biometric data collected by a business about a consumer without the consumer’s knowledge;

  (ii) information that is collated and combined to create a consumer profile that is made available to a user of a publicly available website either in exchange for payment or free of charge;

  (iii) an inference that is generated from the information described in subdivision (ii) of this subdivision (42)(B);

  (iv) solely for the purposes set forth in subdivisions 2415d(a)(1), (2), and (4) of this subchapter, information that is made available for sale;

  (v) any obscene visual depiction, as defined in 18 U.S.C. § 1460;

  (vi) personal data that is created through the combination of personal data with publicly available information;

  (vii) genetic data, unless otherwise made publicly available by the consumer to whom the information pertains;

  (viii) information provided by a consumer on a website or online service made available to all members of the public, for free or for a fee, where the consumer has maintained a reasonable expectation of privacy in the information, such as by restricting the information to a specific audience; or

  (ix) intimate images, authentic or computer generated, known to be nonconsensual.

  (43) “Reproductive or sexual health care” has the same meaning as “reproductive health care services” in 1 V.S.A. § 150(c).

  (44) “Reproductive or sexual health data” means any personal data concerning an effort made by a consumer to seek, or a consumer’s receipt of, reproductive or sexual health care.

  (45) “Reproductive or sexual health facility” means any health care facility in which at least 70 percent of the health care–related services or products rendered or provided in the facility are reproductive or sexual health care.

  (46)(A) “Sale of personal data” means the exchange of a consumer’s personal data by the controller with a third party for monetary or other valuable consideration.

  (B) “Sale of personal data” does not include:

  (i) the disclosure of personal data to a processor that processes the personal data on behalf of the controller;

  (ii) the disclosure of personal data to a third party for purposes of providing a product or service requested by the consumer;

  (iii) the disclosure or transfer of personal data to an affiliate of the controller;

  (iv) the disclosure of personal data when the consumer directs the controller to disclose the personal data or intentionally uses the controller to interact with a third party;

  (v) the disclosure of personal data that the consumer:

  (I) intentionally made available to the general public via a channel of mass media; and

  (II) did not restrict to a specific audience; or

  (vi) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction, or a proposed merger, acquisition, bankruptcy, or other transaction, in which the third party assumes control of all or part of the controller’s assets.

  (47) “Sensitive data” means personal data that includes:

  (A) data revealing:

  (i) racial or ethnic origin, religious beliefs, sex life, sexual orientation, status as nonbinary or transgender, or citizenship or immigration status; or

  (ii) a mental or physical health condition, diagnosis, disability, or treatment;

  (B) consumer health data;

  (C) genetic or biometric data or information derived therefrom;

  (D) personal data collected from an individual the controller has actual knowledge, or willfully disregards, is a child;

  (E) precise geolocation data;

  (F) neural data;

  (G) a consumer’s financial account number, financial account login information, or credit card or debit card number that, in combination with any required access or security code, password, or credential, would allow access to a consumer’s financial account; or

  (H) a government-issued identification number, including, but not limited to, Social Security number, passport number, State identification card number, or driver’s license number, that applicable law does not require to be publicly displayed.

  (48)(A) “Targeted advertising” means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred from that consumer’s activities over time and across nonaffiliated websites or online applications to predict the consumer’s preferences or interests.

  (B) “Targeted advertising” does not include:

  (i) an advertisement based on activities within the controller’s own website or online application;

  (ii) an advertisement based on the context of a consumer’s current search query or visit to a website or online application;

  (iii) an advertisement directed to a consumer in response to the consumer’s request for information or feedback; or

  (iv) processing of personal data solely to measure or report advertising frequency, performance, or reach.

  (49) “Third party” means a person, public authority, agency, or body, other than the consumer, controller, or processor or an affiliate of the processor or the controller.

  (50) “Trade secret” has the same meaning as in section 4601 of this title. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)