The Vermont Statutes Online

Title 9 : Commerce and Trade

Chapter 061a : Data Privacy [Effective January 1, 2028]

Subchapter 001 : Vermont Data Privacy and Online Surveillance Act [Effective January 1, 2028]

• § 2415d. Consumer personal data rights [Effective January 1, 2028]

  (a) Consumer rights. A consumer shall have the right to:

  (1) confirm whether or not a controller is processing the consumer’s personal data and access such personal data, including any inferences about the consumer derived from such personal data and whether a controller or processor is processing a consumer’s personal data for the purposes of profiling to make a decision that produces any legal or similarly significant effect concerning a consumer, unless such confirmation or access would require the controller to reveal a trade secret or the controller is prohibited from disclosing such personal data under subsection (e) of this section;

  (2) correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data;

  (3) delete personal data provided by, or obtained about, the consumer;

  (4) obtain a copy of the consumer’s personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided the controller shall not be required to reveal any trade secret;

  (5) opt out of the processing of the personal data for purposes of:

  (A) targeted advertising;

  (B) the sale of personal data, except as provided in subsection 2415e(b) of this subchapter; or

  (C) profiling in furtherance of any automated decision that produces any legal or similarly significant effect concerning the consumer;

  (6) if the consumer’s personal data were processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer, and if feasible:

  (A) question the result of such profiling;

  (B) be informed of the reason that such profiling resulted in such decision;

  (C) review the consumer’s personal data that were processed for the purposes of such profiling; and

  (D) if the profiling decision concerned housing, taking into account the nature of the personal data and the purposes for which such personal data were processed, be allowed to correct any incorrect personal data that were processed for the purposes of such profiling and have the profiling decision reevaluated based on the corrected personal data; and

  (7) obtain from the controller a list of the third parties to which such controller has sold the consumer’s personal data or, if such controller does not maintain a list of the third parties to which such controller has sold the consumer’s personal data, a list of all third parties to which such controller has sold personal data, provided the controller shall not be required to reveal any trade secret.

  (b) Exercising consumer rights.

  (1) A consumer may exercise rights under this section by a secure and reliable means established by the controller and described to the consumer in the controller’s privacy notice pursuant to subsection 2415e(c) of this subchapter.

  (2)(A) A consumer may designate another person to serve as the consumer’s authorized agent, and act on the consumer’s behalf, to opt out of the processing of the consumer’s personal data for the purposes specified in subsection (a) of this section.

  (B) The consumer may designate an authorized agent by way of, among other things, a technology, including an internet link or a browser setting, browser extension, or global device setting, indicating the consumer’s intent to opt out of the processing.

  (C) A controller shall comply with an opt-out request received from an authorized agent if the controller is able to verify, with commercially reasonable effort, the identity of the consumer and the authorized agent’s authority to act on the consumer’s behalf.

  (3) In the case of processing personal data of a consumer who:

  (A) a controller has actual knowledge, or willfully disregards, is a child, the parent or legal guardian may exercise the consumer rights on the child’s behalf; and

  (B) is subject to a guardianship, conservatorship, or other protective arrangement, the guardian or the conservator of the consumer may exercise the rights on the consumer’s behalf.

  (c) Controller compliance. Except as otherwise provided in this subchapter, a controller shall comply with a request by a consumer to exercise the consumer rights authorized pursuant to this subchapter as follows:

  (1) Timeline to respond. A controller:

  (A) shall respond to the consumer without undue delay, but not later than 45 days after receipt of the request; and

  (B) may extend the response period by 45 additional days when reasonably necessary, considering the complexity and number of the consumer’s requests, provided the controller informs the consumer of the extension within the initial 45-day response period and of the reason for the extension.

  (2) Declining to take action. If a controller declines to take action regarding the consumer’s request, the controller shall inform the consumer without undue delay, but not later than 45 days after receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision.

  (3) Cost of information.

  (A) Information provided by a controller in response to a consumer request shall be provided by the controller, free of charge, once per consumer during any 12-month period.

  (B) If requests from a consumer are manifestly unfounded, excessive, or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request.

  (C) The controller bears the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request.

  (4) Authentication of request.

  (A) If a controller is unable to authenticate a request to exercise any of the rights afforded under subdivisions (a)(1)–(4) of this section using commercially reasonable efforts, the controller shall not be required to comply with a request to initiate an action pursuant to this section and shall provide notice to the consumer that the controller is unable to authenticate the request to exercise the right or rights until the consumer provides additional information reasonably necessary to authenticate the consumer and the consumer’s request to exercise the right or rights.

  (B) A controller shall not be required to authenticate an opt-out request, but a controller may deny an opt-out request if the controller has a good faith, reasonable, and documented belief that the request is fraudulent.

  (C) If a controller denies an opt-out request because the controller believes the request is fraudulent, the controller shall send a notice to the person who made the request disclosing that the controller believes the request is fraudulent, why the controller believes the request is fraudulent, and that the controller shall not comply with the request.

  (5) Third-party data. A controller that has obtained personal data about a consumer from a source other than the consumer shall be deemed in compliance with a consumer’s request to delete the consumer’s data pursuant to subdivision (a)(3) of this section by:

  (A) retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal data remains deleted from the controller’s records and not using the retained data for any other purpose pursuant to the provisions of this subchapter; or

  (B) opting the consumer out of the processing of the personal data for any purpose except for those exempted pursuant to the provisions of this subchapter.

  (d) Appeals.

  (1) A controller shall establish a process for a consumer to appeal the controller’s refusal to take action on a request pursuant to this section within a reasonable period of time after the consumer’s receipt of the decision.

  (2) The appeal process shall be conspicuously available and similar to the process for submitting requests to initiate action pursuant to this section.

  (3) Not later than 60 days after receipt of an appeal, a controller shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

  (4) If the controller denies the appeal, the controller shall also provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the Attorney General to submit a complaint.

  (e) Disclosure of certain information. A controller shall not disclose the following personal data in response to a request to exercise the consumer’s rights pursuant to subdivision (a)(1) of this section and shall instead inform the consumer or the person exercising such right on behalf of the consumer, with sufficient particularity, that the controller has collected the consumer’s:

  (1) Social Security number;

  (2) driver’s license number, State identification card number, or other government-issued identification number;

  (3) financial account number;

  (4) health insurance identification number or medical identification number;

  (5) account password;

  (6) security question or answer thereto; or

  (7) biometric data. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)