The bill amends Chapter 62 of Title 9 of the Vermont Statutes to enhance the protection of personal information, introducing new definitions such as "Authorized agent" and "Biometric data," while expanding the definition of "Brokered personal information." It clarifies the concept of a "direct relationship" between consumers and businesses, emphasizing intentional interactions for accessing products or services. The legislation also establishes new regulations for the sale of brokered personal information, including exceptions for disclosures made with consumer consent, and aims to strengthen consumer privacy rights and accountability for data brokers.

Additionally, the bill outlines the responsibilities of data brokers in the event of a security breach, including conditions under which they are not required to notify individuals. It introduces a higher registration fee for data brokers and mandates comprehensive disclosures about data collection practices. The bill also establishes a Cybersecurity Advisory Council with expanded membership and amends the timeline for the repeal of the cybersecurity chapter. Furthermore, it sets regulations for educational technology products used in Vermont schools, requiring providers to register and comply with privacy laws, with enforcement authority granted to the Attorney General. The effective dates for various provisions are staggered, with some taking effect in 2026 and others in 2027.

Statutes affected:
As Introduced: 9-62
As Passed By the House -- Official: 9-62
As Passed By the House -- Unofficial: 9-62
As Passed by Both House and Senate -- Official: 9-62, 20-4662, 20-208
As Passed by Both House and Senate -- Unofficial: 9-62, 20-4662, 20-208
As Enacted: 9-62, 20-4662, REPEAL-208