The bill S.93, introduced by Senators Chittenden, Beck, Cummings, Mattos, and Ram Hinsdale, seeks to establish the Vermont Data Privacy Act, which aims to enhance data privacy protections for Vermont residents. It introduces a new chapter, 9 V.S.A. chapter 61A, that defines key terms related to data privacy, such as "personal data," "consumer," and "sensitive data." The legislation outlines consumer rights regarding personal data, including the necessity for clear consent before data processing and the conditions under which personal data can be sold or shared. It also sets thresholds for businesses that handle significant amounts of consumer data and emphasizes the protection of sensitive data, particularly health-related information.

Additionally, the bill details the responsibilities of data controllers and processors, mandating compliance with consumer rights and data protection measures. It requires data controllers to limit data collection, obtain consent for processing sensitive data, and implement security measures. The Attorney General is granted exclusive authority to enforce the chapter, with provisions for a notice of violation and a 60-day cure period for compliance. The bill also introduces new definitions and categories under the Securities Exchange Act of 1934, clarifying the scope of the law. The act is set to take effect on July 1, 2026, allowing time for affected entities to prepare for compliance with the new regulations.