The Vermont Statutes Online

Title 9 : Commerce and Trade

Chapter 061a : Data Privacy [Effective January 1, 2028]

Subchapter 001 : Vermont Data Privacy and Online Surveillance Act [Effective January 1, 2028]

• § 2415e. Duties of controllers [Effective January 1, 2028]

  (a) Data collection and processing. A controller shall:

  (1) limit the collection of a consumer’s personal data to what is reasonably necessary and proportionate in relation to the purposes for which the data are processed, as disclosed to the consumer;

  (2) not process a consumer’s personal data for any material new purpose that is neither reasonably necessary to, nor compatible with, the purposes for which the data were processed pursuant to subdivision (1) of this subsection, unless the controller receives consent from the consumer;

  (3) establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data at issue;

  (4) regarding the sensitive data of a consumer:

  (A) not process the sensitive data unless the consumer has provided consent and unless the processing is reasonably necessary in relation to the purposes for which the sensitive data are collected;

  (B) not sell the sensitive data unless the consumer has provided consent; and

  (C) if the controller has actual knowledge, or willfully disregards, that the consumer is a child, process the sensitive data in accordance with:

  (i) COPPA; and

  (ii) if applicable, section 2449f of this title;

  (5) not process personal data in violation of any:

  (A) law of this State that prohibits unlawful discrimination against consumers and any evidence, or lack of evidence, concerning proactive antibias testing or any similar proactive effort to avoid processing data in violation of any such law, including any evidence or lack of evidence concerning the quality, efficacy, recency, and scope of any testing or effort, the results of which shall be relevant to any claim available for a violation of such law and any defense available thereto; or

  (B) federal law that prohibits unlawful discrimination against consumers;

  (6) provide an effective mechanism for a consumer to revoke the consumer’s consent under this section that is at least as easy as the mechanism by which the consumer provided the consumer’s consent and, upon revocation of the consent, cease to process the data as soon as practicable, but not later than 15 days after the receipt of the request;

  (7) subject to subdivision (9) of this subsection, if a controller has actual knowledge, and willfully disregards, that a consumer is at least 13 years of age but younger than 18 years of age:

  (A) not process the personal data of the consumer for purposes of targeted advertising; and

  (B) not sell the consumer’s personal data;

  (8) not discriminate against a consumer for exercising any of the consumer rights contained in this subchapter, including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods or services to the consumer; and

  (9) if the controller is a covered business and the consumer is a covered minor as both terms are defined in section 2449a of this title, comply with the requirements set forth in chapter 62, subchapter 6 of this title (Vermont Age-Appropriate Design Code Act).

  (b) Limitations. Subsection (a) of this section shall not be construed to:

  (1) require a controller to provide a product or service that requires the personal data of a consumer that the controller does not collect or maintain; or

  (2) prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the offering is in connection with a consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.

  (c) Privacy notice.

  (1) A controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes:

  (A) the categories of personal data processed by the controller;

  (B) the purpose for processing personal data and a description of the processing, pursuant to subdivision (a)(1) of this section;

  (C) a description of the means, established pursuant to subsection (d) of this section, for consumers to submit requests to exercise their consumer rights pursuant to this subchapter, including a description of how consumers may:

  (i) exercise a consumer’s rights under subsection 2415d(a) of this subchapter; and

  (ii) appeal a controller’s decisions with regard to requests to exercise such rights;

  (D) the categories of personal data that the controller sells to third parties, if any;

  (E) the categories of third parties, if any, to which the controller sells personal data;

  (F) a clear and conspicuous disclosure of any:

  (i) processing of personal data for purposes of targeted advertising; or

  (ii) sale of personal data to a third party for purposes of targeted advertising;

  (G) an active email address or other online mechanism that the consumer may use to contact the controller;

  (H) a statement disclosing whether the controller collects, uses, or sells personal data for the purpose of training large language models; and

  (I) the most recent month and year during which the controller updated the privacy notice.

  (2) A controller shall make the privacy notice required under subdivision (1) of this subsection publicly available:

  (A) through a conspicuous hyperlink that includes the word “privacy”:

  (i) on the home page of the controller’s website, if the controller maintains a website;

  (ii) on the application store page or download page of a mobile device, if the controller maintains an application for use on a mobile device; and

  (iii) on the application’s settings menu or in a similarly conspicuous and accessible location, if the controller maintains an application for use on a mobile device or other device used to connect to the internet;

  (B) through a medium in which the controller regularly interacts with consumers, including mail, if the controller does not maintain a website;

  (C) in each language in which the controller:

  (i) provides any product or service that is subject to the privacy notice; or

  (ii) carries out any activity that is related to any product or service described in subdivision (i) of this subdivision (C); and

  (D) in a manner that is reasonably accessible to, and usable by, individuals with disabilities.

  (3) Whenever a controller makes any retroactive material change to the controller’s privacy notice or practices, the controller shall:

  (A) notify the consumers affected by such material change with respect to any personal data to be collected after the effective date of such material change;

  (B) provide a reasonable opportunity for the consumers described in subdivision (A) of this subdivision (3) to withdraw consent to any further and materially different collection, processing, or transfer of previously collected personal data following such material change; and

  (C) take all reasonable electronic measures to provide the notice set forth in this subdivision (3) to the affected consumers, taking into account the technology available to the controller and the nature of the controller’s relationship with such affected consumers.

  (4) Nothing in this subsection shall be construed to require a controller to provide a privacy notice that is specific to this State if the controller provides a generally applicable privacy notice that satisfies the requirements established in this subsection.

  (d) Providing consumers access to exercise rights.

  (1) A controller shall:

  (A) establish and describe in a privacy notice one or more secure and reliable means for consumers to submit a request to exercise their consumer rights pursuant to this subchapter; and

  (B) not require a consumer to create a new account in order to exercise consumer rights but may require a consumer to use an existing account.

  (2) The means pursuant to subdivision (1) of this subsection shall:

  (A) take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of the requests, and the ability of the controller to verify the identity of the consumer making the request;

  (B) provide a clear and conspicuous link on the controller’s website to a web page that enables a consumer, or an agent of the consumer, to opt out of the processing of the consumer’s personal data for purposes of targeted advertising or any sale of the consumer’s personal data; and

  (C) allow a consumer to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising, or any sale of the personal data, through an opt-out preference signal sent to the controller with the consumer’s consent indicating the consumer’s intent to opt out of any of the processing or sale, by a platform, technology, or other mechanism that shall:

  (i) not unfairly disadvantage another controller;

  (ii) not make use of a default setting, but rather require the consumer to make an affirmative, freely given, and unambiguous choice to opt out of any processing of the consumer’s personal data pursuant to this subchapter;

  (iii) be consumer friendly and easy to use by the average consumer;

  (iv) be as consistent as possible with any other similar platform, technology, or mechanism required by any federal or State law or regulation; and

  (v) enable the controller to accurately determine whether the consumer is a resident of this State and whether the consumer has made a legitimate request to opt out of any sale of the consumer’s personal data or targeted advertising.

  (3) If a consumer’s decision to opt out of any processing of the consumer’s personal data for the purposes of targeted advertising, or any sale of the personal data, through an opt-out preference signal sent in accordance with the provisions of subdivision (2)(C) of this subsection conflicts with the consumer’s existing controller-specific privacy setting or voluntary participation in a controller’s bona fide loyalty, rewards, premium features, discounts, or club card program, the controller shall comply with the consumer’s opt-out preference signal but may notify the consumer of the conflict and provide to the consumer the choice to confirm the controller-specific privacy setting or participation in the program.

  (4) If a controller responds to a consumer opt-out request received pursuant to subdivision (2)(C) of this subsection by informing the consumer of a charge for the use of any product or service, the controller shall present the terms of any financial incentive offered pursuant to subdivision (b)(2) of this section for the retention, use, sale, or sharing of the consumer’s personal data. (Added 2025, No. 145 (Adj. Sess.), § 1, eff. January 1, 2028.)