The Vermont Data Privacy and Online Surveillance Act establishes a new framework for data privacy in the state, introducing Chapter 61A to regulate the handling of personal data. The bill defines key terms such as "consumer," "personal data," and "sensitive data," and emphasizes the need for clear consumer consent before data processing. It mandates that businesses authenticate consumer requests to exercise their rights, outlines conditions for the sale and processing of personal data, and categorizes sensitive data and targeted advertising. The legislation also sets applicability thresholds for businesses and includes exemptions for certain entities, ensuring that consumers are informed and have control over their personal information.

Additionally, the bill outlines specific consumer rights, including the ability to confirm data processing, correct inaccuracies, delete data, and opt out of targeted advertising. It requires data controllers to provide clear privacy notices, conduct data protection assessments, and maintain data security. The Attorney General is granted enforcement authority, with the ability to request assessments during investigations and a focus on protecting consumer health data. The act prohibits the sale of health data without consent and establishes a notice of violation period before enforcement actions can be taken. The legislation is set to take effect on January 1, 2028, and emphasizes the importance of educational resources for compliance.

Statutes affected:
As Introduced: 9-2416(a), 9-2416
As Passed By the Senate -- Official: 9-2416(a), 9-2416
As Passed by Both House and Senate -- Official: 9-2416(a), 9-2416