The bill S.93, introduced by Senators Chittenden, Beck, Cummings, Mattos, and Ram Hinsdale, seeks to enhance data privacy protections for Vermont residents through the establishment of the Vermont Data Privacy Act. This legislation introduces a new chapter, 61A, which defines key terms related to data privacy, such as "consumer," "personal data," "sensitive data," and "biometric data." It specifically applies to businesses that control or process the personal data of a significant number of consumers, with thresholds set at 100,000 consumers or 25,000 consumers from whom they derive substantial revenue through data sales. The bill also includes provisions for consumer health data, outlining the responsibilities of data controllers in handling sensitive information and establishing consumer rights regarding their personal data.

Additionally, the bill mandates that data controllers comply with consumer requests, limit data collection, and implement security measures to protect personal data. It introduces regulations for data processors, requiring them to follow the instructions of controllers and maintain confidentiality. The Attorney General is granted exclusive enforcement authority, with a notice of violation process that allows for a 60-day cure period before legal action. The bill also amends the Securities Exchange Act of 1934 to include new definitions and categories of entities subject to its regulations, ensuring accountability across various sectors. The act is set to take effect on July 1, 2026, allowing time for compliance adjustments.