H 208

 BILL AS INTRODUCED  H.208
 2025  Page 1 of 65
1H.208
2 Introduced by Representatives Priestley of Bradford, Marcotte of Coventry,
3Arsenault of Williston, Austin of Colchester, Berbeco of
4Winooski, Bos-Lun of Westminster, Bosch of Clarendon,
5Boyden of Cambridge, Brown of Richmond, Burke of
6Brattleboro, Burrows of West Windsor, Campbell of St.
7Johnsbury, Carris-Duncan of Whitingham, Casey of
8Montpelier, Chapin of East Montpelier, Cina of Burlington,
9Cole of Hartford, Cordes of Bristol, Donahue of Northfield,
10Duke of Burlington, Eastes of Guilford, Goldman of
11Rockingham, Graning of Jericho, Greer of Bennington, Harple
12of Glover, Headrick of Burlington, Holcombe of Norwich,
13Krasnow of South Burlington, Lipsky of Stowe, Masland of
14Thetford, McCann of Montpelier, McGill of Bridport, Micklus
15of Milton, Mihaly of Calais, Minier of South Burlington,
16Mrowicki of Putney, Nugent of South Burlington, O’Brien of
17Tunbridge, Ode of Burlington, Olson of Starksboro, Pezzo of
18Colchester, Pouech of Hinesburg, Rachelson of Burlington,
19Satcowitz of Randolph, Sibilia of Dover, Stevens of Waterbury,
20Surprenant of Barnard, Tomlinson of Winooski, Torre of
21Moretown, Waszazak of Barre City, and White of Bethel
                                                                VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 2 of 65
1 Referred to Committee on
2 Date:
3 Subject: Commerce and trade; consumer protection; data privacy
4 Statement of purpose of bill as introduced: This bill proposes to provide data
5 privacy and online surveillance protections to Vermonters.
6    An act relating to consumer data privacy and online surveillance
7 It is hereby enacted by the General Assembly of the State of Vermont:
8 Sec. 1. 9 V.S.A. chapter 61A is added to read:
9CHAPTER 61A. VERMONT DATA PRIVACY AND ONLINE
10SURVEILLANCE ACT
11 § 2415. DEFINITIONS
12    As used in this chapter:
13(1)(A) “Affiliate” means a legal entity that shares common branding
14 with another legal entity or controls, is controlled by, or is under common
15 control with another legal entity.
16(B) As used in subdivision (A) of this subdivision (1), “control” or
17 “controlled” means:
18(i) ownership of, or the power to vote, more than 50 percent of the
19 outstanding shares of any class of voting security of a company;
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 3 of 65
1(ii) control in any manner over the election of a majority of the
2 directors or of individuals exercising similar functions; or
3(iii) the power to exercise controlling influence over the
4 management of a company.
5(2) “Authenticate” means to use reasonable means to determine that a
6 request to exercise any of the rights afforded under subdivisions 2418(a)(1)–
7 (6) of this title is being made by, or on behalf of, the consumer who is entitled
8 to exercise the consumer rights with respect to the personal data at issue.
9(3)(A) “Biometric data” means data generated from the technological
10 processing of an individual’s unique biological, physical, or physiological
11 characteristics that allow or confirm the unique identification of the consumer,
12 including:
13(i) iris or retina scans;
14(ii) fingerprints;
15(iii) facial or hand mapping, geometry, or templates;
16(iv) vein patterns;
17(v) voice prints or vocal biomarkers; and
18(vi) gait or personally identifying physical movement or patterns.
19(B) “Biometric data” does not include:
20(i) a digital or physical photograph;
21(ii) an audio or video recording; or
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 4 of 65
1(iii) any data generated from a digital or physical photograph, or
2 an audio or video recording, unless such data is generated to identify a specific
3 individual.
4(4) “Business associate” has the same meaning as in HIPAA.
5(5) “Child” has the same meaning as in COPPA.
6(6)(A) “Consent” means a clear affirmative act signifying a consumer’s
7 freely given, specific, informed, and unambiguous agreement to allow the
8 processing of personal data relating to the consumer in response to a specific
9 request, provided the request:
10(i) is provided to the consumer in a clear and conspicuous
11 disclosure;
12(ii) includes a description of the processing purpose for which the
13 consumer’s consent is sought;
14(iii) clearly distinguishes between an act or practice that is
15 necessary to fulfill a request of the consumer and an act or practice that is for
16 another purpose;
17(iv) clearly states the specific categories of personal data that the
18 controller intends to collect or process under each act or practice;
19(v) clearly states the specific categories of personal data that the
20 controller intends to collect or process under each act or practice; and
21(vi) is accessible to a consumer with disabilities.
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 5 of 65
1(B) “Consent” may include a written statement, including by
2 electronic means, or any other unambiguous affirmative action.
3(C) “Consent” does not include:
4(i) acceptance of a general or broad terms of use or similar
5 document that contains descriptions of personal data processing along with
6 other, unrelated information;
7(ii) hovering over, muting, pausing, or closing a given piece of
8 content;
9(iii) inaction of the consumer or the consumer’s continued use of a
10 service or product provided by the controller; or
11(iv) an agreement obtained through the use of dark patterns.
12(7)(A) “Consumer” means an individual who is a resident of the State.
13(B) “Consumer” does not include an individual acting in a
14 commercial capacity or as an owner, director, officer, or contractor of a
15 company, partnership, sole proprietorship, nonprofit, or government agency
16 whose communications or transactions with the controller occur solely within
17 the context of that individual’s role with the company, partnership, sole
18 proprietorship, nonprofit, or government agency.
19(8) “Consumer health data” means any personal data that a controller
20 uses to identify a consumer’s physical or mental health condition or diagnosis,
21 including gender-affirming health data and reproductive or sexual health data.
                                                                   VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 6 of 65
1(9) “Consumer health data controller” means any controller that, alone
2 or jointly with others, determines the purpose and means of processing
3 consumer health data.
4(10) “Consumer reporting agency” has the same meaning as in the Fair
5 Credit Reporting Act, 15 U.S.C. § 1681a(f);
6(11) “Contextual advertising” or “contextual advertisement,” as subject
7 to provisions set forth in subsection 2418(g) of this chapter, means displaying
8 or presenting an advertisement that does not vary based on the identity of the
9 individual recipient and is based solely on:
10(A) the immediate content of a web page or online service within
11 which the advertisement appears; or
12(B) a specific request of the consumer for information or feedback.
13(12) “Controller” means a person who, alone or jointly with others,
14 determines the purpose and means of processing personal data.
15(13) “COPPA” means the Children’s Online Privacy Protection Act of
16 1998, 15 U.S.C. § 6501–6506, and any regulations, rules, guidance, and
17 exemptions promulgated pursuant to the act, as the act and regulations, rules,
18 guidance, and exemptions may be amended.
19(14) “Covered entity” has the same meaning as in HIPAA.
20(15) “Credit union” has the same meaning as in 8 V.S.A. § 30101.
                                                                  VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 7 of 65
1(16) “Dark pattern” means a user interface designed or manipulated with
2 the substantial effect of subverting or impairing user autonomy, decision-
3 making, or choice and includes any practice the Federal Trade Commission
4 refers to as a “dark pattern.”
5(17) “Data broker” has the same meaning as in section 2430 of this title.
6(18) “Decisions that produce legal or similarly significant effects
7 concerning the consumer” means decisions that result in or materially affect
8 access to, the provision or denial of, or the terms and conditions of financial or
9 lending services, housing, insurance, education enrollment or opportunity,
10 criminal justice, employment opportunities, health care services, or access to
11 essential goods or services.
12(19) “De-identified data” means data that does not identify and cannot
13 reasonably be used to infer information about, or otherwise be linked to, an
14 identified or identifiable individual, or a device linked to the individual, if the
15 controller that possesses the data:
16(A) takes reasonable physical, technical, or administrative measures
17 to ensure that the data cannot be used to reidentify an identified or identifiable
18 individual or be associated with an individual or device that identifies or is
19 linked or reasonably linkable to an individual or household, provided that such
20 reasonable measures for protected health information covered by HIPAA shall
21 include the de-identification requirements set forth under 45 C.F.R. § 164.514
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 8 of 65
1 (other requirements relating to uses and disclosures of protected health
2 information);
3(B) publicly commits to process the data only in a de-identified
4 fashion and not attempt to reidentify the data; and
5(C) contractually obligates any recipients of the data to satisfy the
6 criteria set forth in subdivisions (A) and (B) of this subdivision (19).
7(20) “Financial institution” as used in subdivision 2417(a)(11) of this
8 title, has the same meaning as in 15 U.S.C. § 6809;
9(21) “First party” means a consumer-facing controller with which the
10 consumer intends or expects to interact.
11(22) “First-party advertising” means processing by a first party of its
12 own first-party data for the purposes of advertising and marketing and is
13 carried out:
14(A) through direct communications with a consumer, such as direct
15 mail, email, or text message communications;
16(B) in a physical location operated by the first party; or
17(C) through display or presentation of an advertisement on the first
18 party’s own website, application, or its other online content.
19(23) “First-party data” means personal data collected directly from a
20 consumer by a first party in compliance with this chapter, including based on a
                                                                       VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 9 of 65
1 visit by the consumer to or use by the consumer of a website, a physical
2 location, or an online service operated by the first party.
3(24) “Gender-affirming health care services” has the same meaning as in
4 1 V.S.A. § 150.
5(25) “Gender-affirming health data” means any personal data
6 concerning a past, present, or future effort made by a consumer to seek, or a
7 consumer’s receipt of, gender-affirming health care services, including:
8(A) precise geolocation data that is used for determining a
9 consumer’s attempt to acquire or receive gender-affirming health care services;
10(B) efforts to research or obtain gender-affirming health care
11 services; and
12(C) any gender-affirming health data that is derived from nonhealth
13 information.
14(26) “Genetic data” means any data, regardless of its format, that results
15 from the analysis of a biological sample of an individual, or from another
16 source enabling equivalent information to be obtained, and concerns genetic
17 material, including deoxyribonucleic acids (DNA), ribonucleic acids (RNA),
18 genes, chromosomes, alleles, genomes, alterations or modifications to DNA or
19 RNA, single nucleotide polymorphisms (SNPs), epigenetic markers,
20 uninterpreted data that results from analysis of the biological sample or other
21 source, and any information extrapolated, derived, or inferred therefrom.
                                                                   VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 10 of 65
1(27) “Geofence” means any technology that uses global positioning
2 coordinates, cell tower connectivity, cellular data, radio frequency
3 identification, wireless fidelity technology data, or any other form of location
4 detection, or any combination of such coordinates, connectivity, data,
5 identification, or other form of location detection, to establish a virtual
6 boundary.
7(28) “Health care component” has the same meaning as in HIPAA.
8(29) “Health care facility” has the same meaning as in 18 V.S.A. § 9432.
9(30) “HIPAA” means the Health Insurance Portability and
10 Accountability Act of 1996, Pub. L. No. 104-191, and any regulations
11 promulgated pursuant to the act, as may be amended.
12(31) “Hybrid entity” has the same meaning as in HIPAA.
13(32) “Identified or identifiable individual” means an individual who can
14 be readily identified, directly or indirectly, including by reference to an
15 identifier such as a name, an identification number, specific or historical
16 pattern of geolocation data, or an online identifier.
17(33) “Independent trust company” has the same meaning as in 8 V.S.A.
18 § 2401.
19(34) “Investment adviser” has the same meaning as in 9 V.S.A. § 5102.
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 11 of 65
1(35) “Large data holder” means a person who during the preceding
2 calendar year processed the personal data of not fewer than 100,000
3 consumers.
4(36) “Marketing measurement” means measuring and reporting on
5 marketing performance or media performance by the controller, including
6 processing personal data for measurement and reporting of frequency,
7 attribution, and performance, provided that such measurement data is not
8 processed or transferred for any other purpose.
9(37) “Mental health facility” means any health care facility in which at
10 least 70 percent of the health care services provided in the facility are mental
11 health services.
12(38) “Minor” means any consumer who is younger than 18 years of age.
13(39) “Neural data” means information that is collected through
14 biosensors and that could be processed to infer or predict mental states.
15(40) “Nonpublic personal information” has the same meaning as in
16 15 U.S.C. § 6809.
17(41)(A) “Online service, product, or feature” means any service,
18 product, or feature that is provided online, except as provided in subdivision
19 (B) of this subdivision (41).
20(B) “Online service, product, or feature” does not include:
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 12 of 65
1(i) telecommunications service, as that term is defined in the
2 Communications Act of 1934, 47 U.S.C. § 153;
3(ii) broadband internet access service, as that term is defined in
4 47 C.F.R. § 54.400 (universal service support); or
5(iii) the delivery or use of a physical product, but not including the
6 provision or use of an online service, product, or feature through use of an
7 internet-connected physical product.
8(42) “Patient identifying information” has the same meaning as in
9 42 C.F.R. § 2.11 (confidentiality of substance use disorder patient records).
10(43) “Patient safety work product” has the same meaning as in 42 C.F.R.
11 § 3.20 (patient safety organizations and patient safety work product).
12(44)(A) “Personal data” means any information, including derived data
13 and unique identifiers, that is linked or reasonably linkable, alone or in
14 combination with other information, to an identified or identifiable individual
15 or to a device that identifies, is linked to, or is reasonably linkable to one or
16 more identified or identifiable individuals in a household.
17(B) “Personal data” does not include de-identified data or publicly
18 available information.
19(45)(A) “Precise geolocation data” means information derived from
20 technology that reveals the past or present physical location of a consumer or
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 13 of 65
1 device that identifies or is linked or reasonably linkable to one or more
2 consumers with precision and accuracy within a radius of 1,850 feet.
3(B) “Precise geolocation data” does not include:
4(i) the content of communications;
5(ii) data generated by or connected to an advanced utility metering
6 infrastructure system;
7(iii) a photograph, or metadata associated with a photograph or
8 video, that cannot be linked to an individual; or
9(iv) data generated by equipment used by a utility company.
10(46) “Process” or “processing” means any operation or set of operations
11 performed, whether by manual or automated means, on personal data or on sets
12 of personal data, such as the collection, use, storage, disclosure, analysis,
13 deletion, or modification of personal data.
14(47) “Processor” means a person who processes personal data on behalf
15 of:
16(A) a controller;
17(B) another processor; or
18(C) a federal, state, tribal, or local government entity.
19(48) “Profiling” means any form of automated processing performed on
20 personal data to evaluate, analyze, or predict personal aspects, including an
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 14 of 65
1 individual’s economic situation, health, personal preferences, interests,
2 reliability, behavior, location, movements, or identifying characteristics.
3(49) “Protected health information” has the same meaning as in HIPAA.
4(50)(A) “Publicly available information” means information that:
5(i) is made available:
6(I) through federal, state, or local government records; or
7(II) to the general public from widely distributed media; or
8(ii) a controller has a reasonable basis to believe that the consumer
9 has lawfully made available to the general public.
10(B) “Publicly available information” does not include:
11(i) biometric data collected by a business about a consumer
12 without the consumer’s knowledge;
13(ii) information that is collated and combined to create a consumer
14 profile that is made available to a user of a publicly available website either in
15 exchange for payment or free of charge;
16(iii) information that is made available for sale;
17(iv) an inference that is generated from the information described
18 in subdivision (ii) or (iii) of this subdivision (50)(B);
19(v) any obscene visual depiction, as defined in 18 U.S.C. § 1460;
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 15 of 65
1(vi) any inference made exclusively from multiple independent
2 sources of publicly available information that reveals sensitive data with
3 respect to a consumer;
4(vii) personal data that is created through the combination of
5 personal data with publicly available information;
6(viii) genetic data, unless otherwise made publicly available by the
7 consumer to whom the information pertains;
8(ix) information provided by a consumer on a website or online
9 service made available to all members of the public, for free or for a fee, where
10 the consumer has maintained a reasonable expectation of privacy in the
11 information, such as by restricting the information to a specific audience; or
12(x) intimate images, authentic or computer-generated, known to be
13 nonconsensual.
14(51) “Qualified service organization” has the same meaning as in
15 42 C.F.R. § 2.11 (confidentiality of substance use disorder patient records).
16(52) “Reproductive or sexual health care” has the same meaning as
17 “reproductive health care services” in 1 V.S.A. § 150(c)(1).
18(53) “Reproductive or sexual health data” means any personal data
19 concerning a past, present, or future effort made by a consumer to seek, or a
20 consumer’s receipt of, reproductive or sexual health care.
                                                                   VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 16 of 65
1(54) “Reproductive or sexual health facility” means any health care
2 facility in which at least 70 percent of the health care-related services or
3 products rendered or provided in the facility are reproductive or sexual health
4 care.
5(55)(A) “Sale of personal data” means the exchange of a consumer’s
6 personal data by the controller to a third party for monetary or other valuable
7 consideration.
8(B) “Sale of personal data” does not include:
9(i) the disclosure of personal data to a processor that processes the
10 personal data on behalf of the controller;
11(ii) the disclosure of personal data to a third party for purposes of
12 providing a product or service requested by the consumer;
13(iii) the disclosure or transfer of personal data to an affiliate of the
14 controller;
15(iv) the disclosure, with the consumer’s consent, of personal data
16 where the consumer directs the controller to disclose the personal data or
17 intentionally uses the controller to interact with a third party;
18(v) the disclosure of publicly available information;
19(vi) the disclosure or transfer of personal data to a third party as an
20 asset that is part of a merger, acquisition, bankruptcy or other transaction, or a
                                                                        VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 17 of 65
1 proposed merger, acquisition, bankruptcy, or other transaction, in which the
2 third party assumes control of all or part of the controller’s assets.
3(56) “Sensitive data” means personal data that:
4(A) reveals a consumer’s government-issued identifier, such as a
5 Social Security number, passport number, state identification card, or driver’s
6 license number, that is not required by law to be publicly displayed;
7(B) reveals a consumer’s racial or ethnic origin, national origin,
8 citizenship or immigration status, religious or philosophical beliefs, a mental or
9 physical health condition, diagnosis, disability or treatment, status as pregnant,
10 income level or indebtedness, or union membership;
11(C) reveals a consumer’s sexual orientation, sex life, sexuality, or
12 status as transgender or nonbinary;
13(D) reveals a consumer’s status as a victim of a crime;
14(E) is a consumer’s tax return and account number, financial account
15 log-in, financial account, debit card number, or credit card number in
16 combination with any required security or access code, password, or
17 credentials allowing access to an account;
18(F) is consumer health data;
19(G) is collected and analyzed concerning consumer health data that
20 describes or reveals a past, present, or future mental or physical health
21 condition, treatment, disability, or diagnosis, including pregnancy, to the extent
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 18 of 65
1 the personal data is used by the controller for a purpose other than to identify a
2 specific consumer’s physical or mental health condition or diagnosis;
3(H) is biometric or genetic data;
4(I) is collected from a consumer that a controller knew or should have
5 known is a minor;
6(J) is precise geolocation data;
7(K) are keystrokes;
8(L) is driving behavior;
9(M) is neural data; or
10(N) are the online activities of a consumer over time and across
11 devices, websites, online applications, and mobile applications, that do not
12 share common branding, or data generated by, profiling performed on such
13 data.
14(57)(A) “Targeted advertising” means displaying or presenting an online
15 advertisement to a consumer or to a device identified by a unique persistent
16 identifier, if the advertisement is selected based, in whole or in part, on known
17 or predicted preferences, characteristics, behavior, or interests associated with
18 the consumer or a device identified by a unique persistent identifier. “Targeted
19 advertising” includes displaying or presenting an online advertisement for a
20 product or service based on the previous interaction of a consumer or a device
21 identified by a unique persistent identifier with such product or service on a
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 19 of 65
1 website or online service that does not share common branding with the
2 website or online service displaying or presenting the advertisement, and
3 marketing measurement related to such advertisements.
4(B) “Targeted advertising” does not include:
5(i) first-party advertising; or
6(ii) contextual advertising.
7(58) “Third party” means a person who collects personal data from
8 another person who is not the consumer to whom the data pertains and is not a
9 processor with respect to such data. “Third party” does not include a person
10 who collects personal data from another entity if the entities are affiliates.
11(59) “Trade secret” has the same meaning as in section 4601 of this title.
12(60)(A) “Unique persistent identifier” means a technologically created
13 identifier to the extent that such identifier is reasonably linkable to a consumer
14 or a device that identifies or is linked or reasonably linkable to one or more
15 consumers, including device identifiers, internet protocol addresses, cookies,
16 beacons, pixel tags, mobile ad identifiers or similar technology customer
17 numbers, unique pseudonyms, user aliases, telephone numbers, or other forms
18 of persistent or probabilistic identifiers that are linked or reasonably linkable to
19 one or more consumers or devices.
20(B) “Unique persistent identifier” does not include an identifier
21 assigned by a controller for the sole purpose of giving effect to the exercise of
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 20 of 65
1 affirmative consent or opt out by a consumer with respect to the collection or
2 processing of personal data or otherwise limiting the collection or processing
3 of personal data.
4(61) “Victim services organization” means a nonprofit organization that
5 is established to provide services to victims or witnesses of child abuse,
6 domestic violence, human trafficking, sexual assault, violent felony, or
7 stalking.
8 § 2416. APPLICABILITY
9    (a) Except as provided in subsection (b) of this section, this chapter applies
10 to a person who conducts business in this State or a person who produces
11 products or services that are targeted to residents of this State and that during
12 the preceding calendar year:
13(1) controlled or processed the personal data of not fewer than 25,000
14 consumers, excluding personal data controlled or processed solely for the
15 purpose of completing a payment transaction; or
16(2) controlled or processed the personal data of not fewer than 12,500
17 consumers and derived more than 25 percent of the person’s gross revenue
18 from the sale of personal data.
19    (b) Section 2425 of this chapter and the provisions of this chapter
20 concerning consumer health data and consumer health data controllers apply to
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 21 of 65
1 a person who conducts business in this State or a person who produces
2 products or services that are targeted to residents of this State.
3 § 2417. EXEMPTIONS
4    (a) This chapter does not apply to:
5(1) a federal, state, tribal, or local government entity in the ordinary
6 course of its operation;
7(2) protected health information under HIPAA;
8(3) patient–identifying information, for purposes of 42 U.S.C.
9 § 290DD–2;
10(4)(A) information to the extent it is used for public health, community
11 health, or population health activities and purposes, as authorized by HIPAA,
12 when provided by or to a covered entity or when provided by or to a business
13 associate in accordance with the business associate agreement with a covered
14 entity;
15(B) information that is a health care record, as that term is defined in
16 18 V.S.A. § 9419, if the information is held by an entity that is a covered entity
17 or business associate under HIPAA because it collects, uses, or discloses
18 protected health information;
19(C) information that is de-identified in accordance with the
20 requirements for de-identification set forth in 45 C.F.R. 164.514 and that is
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 22 of 65
1 derived from individually identifiable health information as described in
2 HIPAA; and
3(D) personal information consistent with the human subject
4 protection requirements of the U.S. Food and Drug Administration;
5(5) information used only for public health activities and purposes
6 described in 45 C.F.R. § 164.512 (disclosure of protected health information
7 without authorization);
8(6) information that identifies a consumer in connection with:
9(A) activities that are subject to the Federal Policy for the Protection
10 of Human Subjects, codified as 45 C.F.R. Part 46 (HHS protection of human
11 subjects) and in various other federal regulations;
12(B) activities that are subject to the protections provided in 21 C.F.R.
13 Parts 50 (FDA clinical investigations protection of human subjects) and
14 56 (FDA clinical investigations institutional review boards); or
15(C) research conducted in accordance with the requirements set forth
16 in subdivisions (A) and (B) of this subdivision (a)(6) or otherwise in
17 accordance with applicable law;
18(7) patient identifying information that is collected and processed in
19 accordance with 42 C.F.R. Part 2 (confidentiality of substance use disorder
20 patient records);
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 23 of 65
1(8) patient safety work product that is created and used for purposes of
2 patient safety improvement in accordance with 42 C.F.R. § 3, established in
3 accordance with 42 U.S.C. §§ 299b–21 through 299b–26;
4(9) information or documents created for the purposes of the Healthcare
5 Quality Improvement Act of 1986, 42 U.S.C. § 11101–11152, and regulations
6 adopted to implement that act;
7(10) information processed or maintained solely in connection with, and
8 for the purpose of, enabling notice of an emergency to persons that an
9 individual specifies;
10(11) any activity that involves collecting, maintaining, disclosing,
11 selling, communicating, or using information for the purpose of evaluating a
12 consumer’s creditworthiness, credit standing, credit capacity, character,
13 general reputation, personal characteristics, or mode of living if done strictly in
14 accordance with the provisions of the Fair Credit Reporting Act, 15 U.S.C.
15 § 1681–1681x, as may be amended, by:
16(A) a consumer reporting agency;
17(B) a person who furnishes information to a consumer reporting
18 agency under 15 U.S.C. § 1681s-2 (responsibilities of furnishers of
19 information to consumer reporting agencies); or
20(C) a person who uses a consumer report as provided in 15 U.S.C.
21 § 1681b(a)(3) (permissible purposes of consumer reports);
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 24 of 65
1(12) information collected, processed, sold, or disclosed under and in
2 accordance with the following laws and regulations:
3(A) the Driver’s Privacy Protection Act of 1994, 18 U.S.C. § 2721–
4 2725;
5(B) data that is subject to the Family Educational Rights and Privacy
6 Act, 20 U.S.C. § 1232g, and regulations adopted to implement that act;
7(C) data that is subject to the Airline Deregulation Act, Pub. L. No.
8 95-504, only to the extent that an air carrier collects information related to
9 prices, routes, or services, and only to the extent that the provisions of the
10 Airline Deregulation Act preempt this chapter;
11(D) data that is subject to the Farm Credit Act, Pub. L. No. 92-181, as
12 may be amended;
13(E) data that is subject to federal policy under 21 U.S.C. § 830
14 (regulation of listed chemicals and certain machines);
15(13) nonpublic personal information that is processed by a financial
16 institution subject to the Gramm-Leach-Bliley Act, Pub. L. No. 106-102, and
17 regulations adopted to implement that act;
18(14) a state or federally chartered bank or credit union, or an affiliate or
19 subsidiary that is principally engaged in financial activities, as described in
20 18 U.S.C. § 1843(k);
                                                                       VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 25 of 65
1(15) a person regulated pursuant to 8 V.S.A. part 3 (chapters 101–165)
2 other than a person who, alone or in combination with another person,
3 establishes and maintains a self-insurance program and who does not otherwise
4 engage in the business of entering into policies of insurance;
5(16) a third-party administrator, as that term is defined in the Third Party
6 Administrator Rule adopted pursuant to 18 V.S.A. § 9417;
7(17) personal data of a victim or witness of child abuse, domestic
8 violence, human trafficking, sexual assault, violent felony, or stalking that a
9 victim services organization collects, processes, or maintains in the course of
10 its operation;
11(18) a nonprofit organization that is established to detect and prevent
12 fraudulent acts in connection with insurance;
13(19) information that is processed for purposes of compliance,
14 enrollment or degree verification, or research services by a nonprofit
15 organization that is established to provide enrollment data reporting services
16 on behalf of postsecondary schools as that term is defined in 16 V.S.A. § 176;
17 or
18(20) noncommercial activity of:
19(A) a publisher, editor, reporter, or other person who is connected
20 with or employed by a newspaper, magazine, periodical, newsletter, pamphlet,
21 report, or other publication in general circulation;
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 26 of 65
1(B) a radio or television station that holds a license issued by the
2 Federal Communications Commission;
3(C) a nonprofit organization that provides programming to radio or
4 television networks; or
5(D) a press association or wire service.
6    (b) Controllers, processors, and consumer health data controllers that
7 comply with the verifiable parental consent requirements of COPPA shall be
8 deemed compliant with any obligation to obtain parental consent pursuant to
9 this chapter.
10 § 2418. CONSUMER PERSONAL DATA RIGHTS
11    (a) A consumer shall have the right to:
12(1) confirm whether a controller is processing the consumer’s personal
13 data and, if a controller is processing the consumer’s personal data, access the
14 personal data;
15(2) know whether a consumer’s personal data is or will be used in any
16 artificial intelligence system and for what purpose;
17(3) obtain from a controller a list of third parties to which the controller
18 has disclosed the consumer’s personal data or, if the controller does not
19 maintain this information in a format specific to the consumer, a list of third
20 parties to which the controller has disclosed personal data;
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 27 of 65
1(4) correct inaccuracies in the consumer’s personal data, taking into
2 account the nature of the personal data and the purposes of the processing of
3 the consumer’s personal data;
4(5) delete personal data, including derived data, provided by, or obtained
5 about, the consumer unless retention of the personal data is required by law;
6(6) obtain a copy of the consumer’s personal data processed by the
7 controller in a portable and, to the extent technically feasible, readily usable
8 format that allows the consumer to transmit the data to another controller
9 without hindrance; and
10(7) opt out of the processing of personal data for purposes of:
11(A) targeted advertising;
12(B) the sale of personal data; or
13(C) profiling in furtherance of automated decisions that produce legal
14 or similarly significant effects concerning the consumer.
15    (b)(1) A consumer may exercise rights under this section by submitting a
16 request to a controller using the method that the controller specifies in the
17 privacy notice under section 2419 of this title.
18(2) A controller shall not require a consumer to create an account for the
19 purpose described in subdivision (1) of this subsection, but the controller may
20 require the consumer to use an account the consumer previously created.
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 28 of 65
1(3) A parent or legal guardian may exercise rights under this section on
2 behalf of the parent’s child or on behalf of a child for whom the guardian has
3 legal responsibility. A guardian or conservator may exercise the rights under
4 this section on behalf of a consumer that is subject to a guardianship,
5 conservatorship, or other protective arrangement.
6(4)(A) A consumer may designate another person to act on the
7 consumer’s behalf as the consumer’s authorized agent for the purpose of
8 exercising the consumer’s rights under subdivision (a)(5) or (a)(7) of this
9 section.
10(B) The consumer may designate an authorized agent by means of an
11 internet link, browser setting, browser extension, global device setting, or other
12 technology that enables the consumer to exercise the consumer’s rights under
13 subdivision (a)(5) or (a)(7) of this section.
14    (c) Except as otherwise provided in this chapter, a controller shall comply
15 with a request by a consumer to exercise the consumer rights authorized
16 pursuant to this chapter as follows:
17(1)(A) A controller shall respond to the consumer without undue delay,
18 but not later than 45 days after receipt of the request.
19(B) The controller may extend the response period by 45 additional
20 days when reasonably necessary, considering the complexity and number of
21 the consumer’s requests, provided the controller informs the consumer of the
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 29 of 65
1 extension within the initial 45-day response period and of the reason for the
2 extension.
3(C) If the consumer appointed an agent, the controller shall interact
4 with the agent throughout the process and, with the exclusion of a data access
5 request, not require the consumer to be involved in the fulfillment of the
6 request.
7(2) If a controller declines to take action regarding the consumer’s
8 request, the controller shall inform the consumer without undue delay, but not
9 later than 45 days after receipt of the request, of the justification for declining
10 to take action and instructions for how to appeal the decision.
11(3)(A) Information provided in response to a consumer request shall be
12 provided by a controller, free of charge, once per consumer during any 12-
13 month period or after every time the controller makes material changes to its
14 personal data practices and policies.
15(B) If requests from a consumer are manifestly unfounded, excessive,
16 or repetitive, the controller may charge the consumer a reasonable fee to cover
17 the administrative costs of complying with the request or decline to act on the
18 request.
19(C) The controller bears the burden of demonstrating the manifestly
20 unfounded, excessive, or repetitive nature of the request.
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 30 of 65
1(D) When a controller determines a consumer request is manifestly
2 unfounded, excessive, or repetitive, the controller shall inform the consumer
3 and share the controller’s justification prior to disregarding the request or
4 charging the consumer a processing fee. That notice shall include instructions
5 for appealing the decision.
6(4)(A) If a controller is unable to authenticate a request to exercise any
7 of the rights afforded under subdivisions (a)(1)–(6) of this section, the
8 controller shall not be required to comply with a request to initiate an action
9 pursuant to this section and shall provide notice to the consumer or the
10 consumer’s agent that the controller is unable to authenticate the request to
11 exercise the right or rights until the consumer provides additional information
12 reasonably necessary to authenticate the consumer and the consumer’s request
13 to exercise the right or rights.
14(B) A controller shall not require authentication to exercise an opt-
15 out request, but a controller may deny an opt-out request if the controller has a
16 good faith, reasonable, and documented belief that the request is fraudulent.
17(C) If a controller denies an opt-out request because the controller
18 believes the request is fraudulent, the controller shall send a notice to the
19 person who made the request disclosing that the controller believes the request
20 is fraudulent, why the controller believes the request is fraudulent, and that the
21 controller shall not comply with the request. If the request was placed through
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 31 of 65
1 an agent, both the agent and the person who appointed the agent shall receive
2 that notice.
3(5) A controller shall not condition the exercise of a right under this
4 section through:
5(A) the use of any false, fictitious, fraudulent, or materially
6 misleading statement or representation; or
7(B) the employment of any dark pattern.
8    (d) A controller shall establish a process by means of which a consumer
9 may appeal the controller’s refusal to take action on a request under
10 subsection (b) of this section. The controller’s process shall:
11(1) Allow a reasonable period of time after the consumer receives the
12 controller’s refusal within which to appeal.
13(2) Be conspicuously available to the consumer.
14(3) Be similar to the manner in which a consumer must submit a request
15 under subsection (b) of this section.
16(4) Require the controller to approve or deny the appeal within 45 days
17 after the date on which the controller received the appeal and to notify the
18 consumer in writing of the controller’s decision and the reasons for the
19 decision. If the controller denies the appeal, the notice must provide or specify
20 information that enables the consumer to contact the Attorney General to
21 submit a complaint.
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 32 of 65
1    (e) Nothing in this section shall be construed to require a controller to
2 reveal a trade secret.
3    (f) In response to a consumer request under subdivision (a)(1) of this
4 section, a controller shall not disclose the following information about a
5 consumer, but shall instead inform the consumer with sufficient particularity
6 that the controller has collected that type of information:
7(1) Social Security number;
8(2) driver’s license number or other government-issued identification
9 number;
10(3) financial account number;
11(4) health insurance account number or medical identification number;
12(5) account password, security questions, or answers; or
13(6) biometric data.
14    (g)(1) A controller may use the following types of information to display a
15 contextual advertisement:
16(A) technical specifications as are necessary for the ad to be
17 delivered and displayed properly on a given device;
18(B) a consumer’s immediate presence in a geographic area with a
19 radius not smaller than 10 miles, or an area reasonably estimated to include
20 online activity from at least 5,000 users, but not including precise geolocation
21 data; and
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 33 of 65
1(C) the consumer’s language preferences, as inferred from context,
2 browser settings, or user settings.
3(2) A controller using information pursuant to subdivision (1) of this
4 subsection to display a contextual advertisement shall not use that information
5 to make inferences about a consumer, profile a consumer, or for any other
6 purpose, and the controller shall not prohibit a consumer from using technical
7 means to obfuscate or change a consumer’s physical location to specify a
8 language preference.
9 § 2419. DUTIES OF CONTROLLERS
10    (a) A controller shall:
11(1) limit the collection and processing of personal data to what is
12 reasonably necessary and proportionate to provide or maintain:
13(A) a specific product or service requested by the consumer to whom
14 the data pertains; and
15(B) a communication, that is not an advertisement, by the controller
16 to the consumer that is reasonably anticipated within the context of the
17 relationship between the controller and the consumer;
18(2) establish, implement, and maintain reasonable administrative,
19 technical, and physical data security practices to protect the confidentiality,
20 integrity, and accessibility of personal data appropriate to the volume and
21 nature of the personal data at issue, including disposing of personal data in
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 34 of 65
1 accordance with a retention schedule that requires the deletion of personal data
2 when the data is required to be deleted by law or is no longer necessary for the
3 purpose for which the data was collected or processed; and
4(3) provide an effective mechanism for a consumer to withdraw consent
5 provided pursuant to this chapter that is at least as easy as the mechanism by
6 which the consumer provided the consent.
7    (b)(1) A controller that offers any online service, product, or feature to a
8 consumer whom the controller knows is a minor shall:
9(A) use reasonable care to avoid any heightened risk of harm to
10 minors caused by processing of personal data in the course of providing the
11 online service, product, or feature;
12(B) provide to the minor a conspicuous signal indicating that the
13 controller is collecting the minor’s precise geolocation data and make the
14 signal available to the minor for the entire duration of the collection of the
15 minor’s precise geolocation data; and
16(C) not process the personal data of a minor for the purposes of
17 targeted advertising or sell the personal data of a minor.
18(2) For purposes of this subsection, “knows” means a controller knew or
19 should have known the consumer is a minor, including based on:
20(A) information collected about the age of the consumer; or
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 35 of 65
1(B) any age or closely related proxy the business knows or has
2 inferred, derived, attributed to, or associated with the consumer for any
3 purpose, including marketing, advertising, or product development.
4(3) Nothing in this chapter shall be construed to require:
5(A) the affirmative collection of any personal data with respect to the
6 age of users that a controller is not already collecting in the normal course of
7 business; or
8(B) a controller to implement an age gating or age verification
9 functionality.
10    (c) A controller shall not:
11(1) process sensitive data concerning a consumer except when the
12 processing is strictly necessary to provide or maintain a specific product or
13 service requested by the consumer to whom the sensitive data pertains;
14(2) sell sensitive data;
15(3) discriminate or retaliate against a consumer who exercises a right
16 provided to the consumer under this chapter or refuses to consent to the
17 processing of personal data for a separate product or service, including by:
18(A) denying goods or services;
19(B) charging different prices or rates for goods or services; or
20(C) providing a different level of quality or selection of goods or
21 services to the consumer;
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 36 of 65
1(4) process personal data in violation of State or federal laws that
2 prohibit unlawful discrimination; or
3(5)(A) except as provided in subdivision (B) of this subdivision (5),
4 process a consumer’s personal data in a manner that discriminates against
5 individuals or otherwise makes unavailable the equal enjoyment of goods or
6 services on the basis of an individual’s actual or perceived race, color, sex,
7 sexual orientation or gender identity, physical or mental disability, religion,
8 ancestry, or national origin;
9(B) subdivision (A) of this subdivision (5) shall not apply to:
10(i) a private establishment, as that term is used in 42 U.S.C.
11 § 2000a(e) (prohibition against discrimination or segregation in places of
12 public accommodation);
13(ii) processing for the purpose of a controller’s or processor’s self-
14 testing to prevent or mitigate unlawful discrimination or otherwise to ensure
15 compliance with State or federal law; or
16(iii) processing for the purpose of diversifying an applicant,
17 participant, or consumer pool.
18      (d) Subsections (a)–(c) of this section shall not be construed to:
19(1) require a controller to provide a good or service that requires
20 personal data from a consumer that the controller does not collect or maintain;
21 or
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 37 of 65
1(2) prohibit a controller from offering a different price, rate, level of
2 quality, or selection of goods or services to a consumer, including an offer for
3 no fee or charge, in connection with a consumer’s participation, with consent,
4 in a financial incentive program, such as a bona fide loyalty, rewards, premium
5 features, discount, or club card program, provided that the controller may not
6 transfer personal data to a third party as part of the program unless:
7(A) the transfer is necessary to enable the third party to provide a
8 benefit to which the consumer is entitled; and
9(B)(i) the terms of the program clearly disclose that personal data
10 will be transferred to the third party or to a category of third parties of which
11 the third party belongs; and
12(ii) the third party uses the personal data only for purposes of
13 facilitating a benefit to which the consumer is entitled and does not process or
14 transfer the personal data for any other purpose.
15    (e) The sale of personal data shall not be considered functionally necessary
16 to provide a financial incentive program. A controller shall not use financial
17 incentive practices that are unjust, unreasonable, coercive, or usurious in
18 nature.
19    (f)(1) A controller shall provide to consumers a reasonably accessible,
20 clear, and meaningful privacy notice that:
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 38 of 65
1(A) lists the categories of personal data, including the categories of
2 sensitive data, that the controller processes with a clear description of what
3 data each category includes;
4(B) describes the controller’s purposes for processing each category
5 of personal data the controller processes in a way that gives consumers a
6 meaningful understanding of how each category of their personal data will be
7 used;
8(C) describes how a consumer may exercise the consumer’s rights
9 under this chapter, including how a consumer may appeal a controller’s denial
10 of a consumer’s request under section 2418 of this title;
11(D) lists all categories of personal data, including the categories of
12 sensitive data, that the controller sells or shares with third parties;
13(E) describes all categories of third parties with which the controller
14 sells or shares personal data at a level of detail that enables the consumer to
15 understand what type of entity each third party is and, to the extent possible,
16 how each third party may process personal data;
17(F) describes the length of time the controller intends to retain each
18 category of personal data or, if it is not possible to identify the length of time,
19 the criteria used to determine the length of time the controller intends to retain
20 categories of personal data;
                                                                       VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 39 of 65
1(G) specifies an email address or other online method by which a
2 consumer can contact the controller that the controller actively monitors;
3(H) identifies the controller, including any business name under
4 which the controller registered with the Secretary of State and any assumed
5 business name that the controller uses in this State;
6(I) describes any collection, processing, selling, or sharing of
7 personal data for training or use of artificial intelligence systems, if applicable;
8(J) provides a clear and conspicuous description of any processing of
9 personal data in which the controller engages for the purposes of targeted
10 advertising, sale of personal data to third parties, or profiling the consumer in
11 furtherance of decisions that produce legal or similarly significant effects
12 concerning the consumer, and a procedure by which the consumer may opt out
13 of this type of processing; and
14(K) describes the method or methods the controller has established
15 for a consumer to submit a request under subdivision 2418(b)(1) of this title.
16(2) The privacy notice shall adhere to the accessibility and usability
17 guidelines recommended under 42 U.S.C. chapter 126 (the Americans with
18 Disabilities Act) and 29 U.S.C. § 794d (section 508 of the Rehabilitation Act
19 of 1973), including ensuring readability for individuals with disabilities across
20 various screen resolutions and devices and employing design practices that
21 facilitate easy comprehension and navigation for all users.
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 40 of 65
1(3) Whenever a controller makes a material change to the controller’s
2 privacy notice or practices, the controller must notify consumers affected by
3 the material change with respect to any prospectively collected personal data
4 and provide a reasonable opportunity for consumers to withdraw consent to
5 any further materially different transfer of previously collected personal data
6 under the changed policy. The controller shall take all reasonable electronic
7 measures to provide notification regarding material changes to affected
8 consumers, taking into account available technology and the nature of the
9 relationship.
10(4) A controller is not required to provide a separate Vermont-specific
11 privacy notice or section of a privacy notice if the controller’s general privacy
12 notice contains all the information required by this subsection.
13(5) The privacy notice must be posted online through a conspicuous
14 hyperlink using the word “privacy” or “surveillance,” or both words if
15 applicable, on the controller’s website home page or on a mobile application’s
16 app store page or download page. A controller that maintains an application
17 on a mobile or other device shall also include a hyperlink to the privacy notice
18 in the application’s settings menu or in a similarly conspicuous and accessible
19 location. A controller that does not operate a website shall make the privacy
20 notice conspicuously available to consumers through a medium regularly used
21 by the controller to interact with consumers, including email.
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 41 of 65
1    (g) The method or methods under subdivision (f)(1)(J) of this section for
2 submitting a consumer’s request to a controller must:
3(1) take into account the ways in which consumers normally interact
4 with the controller, the need for security and reliability in communications
5 related to the request, and the controller’s ability to authenticate the identity of
6 the consumer that makes the request;
7(2) provide a clear and conspicuous link to a website where the
8 consumer or an authorized agent may opt out from a controller’s processing of
9 the consumer’s personal data pursuant to subdivision 2418(a)(7) of this title or,
10 solely if the controller does not have a capacity needed for linking to a web
11 page, provide another method the consumer can use to opt out, which may
12 include an internet hyperlink clearly labeled “Your Opt-Out Rights” or “Your
13 Privacy Rights” that directly effectuates the opt-out request or takes consumers
14 to a web page where the consumer can make the opt-out request; and
15(3) allow a consumer or authorized agent to send a signal to the
16 controller that indicates the consumer’s preference to opt out of the sale of
17 personal data or targeted advertising pursuant to subdivision 2418(a)(7) of this
18 title by means of a platform, technology, or mechanism that:
19(A) is consumer friendly and easy for an average consumer to use;
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 42 of 65
1(B)(i) enables the controller to reasonably determine whether the
2 consumer has made a legitimate request pursuant to subsection 2418(b) of this
3 title to opt out pursuant to subdivision 2418(a)(7) of this title; and
4(ii) for purposes of subdivision (i) of this subdivision (B), use of
5 an internet protocol address to estimate the consumer’s location may be
6 considered sufficient to accurately determine residency.
7    (h) If a consumer or authorized agent uses a method under subdivision
8 (f)(1)(J) of this section to opt out of a controller’s processing of the consumer’s
9 personal data pursuant to subdivision 2418(a)(7) of this title and the decision
10 conflicts with a consumer’s existing controller-specific privacy setting or
11 voluntary participation in a bona fide reward, club card, or loyalty program or
12 a program that provides premium features or discounts, the controller shall
13 comply with the consumer’s opt-out preference signal but may notify the
14 consumer of the conflict and provide to the consumer the choice to confirm the
15 controller-specific privacy setting or participation in the program.
16 § 2420. DUTIES OF PROCESSORS
17    (a) A processor shall adhere to a controller’s instructions and shall assist
18 the controller in meeting the controller’s obligations under this chapter. In
19 assisting the controller, the processor must:
20(1) enable the controller to respond to requests from consumers pursuant
21 to subsection 2418(b) of this title by means that:
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 43 of 65
1(A) take into account how the processor processes personal data and
2 the information available to the processor; and
3(B) use appropriate technical and organizational measures to the
4 extent reasonably practicable;
5(2) adopt administrative, technical, and physical safeguards that are
6 reasonably designed to protect the security and confidentiality of the personal
7 data the processor processes, taking into account how the processor processes
8 the personal data and the information available to the processor; and
9(3) provide information reasonably necessary for the controller to
10 conduct and document data protection assessments.
11    (b) Processing by a processor must be governed by a contract between the
12 controller and the processor. The contract must:
13(1) be valid and binding on both parties;
14(2) set forth clear instructions for processing data, the nature and
15 purpose of the processing, the type of data that is subject to processing,
16 limitations, and the duration of the processing;
17(3) specify the rights and obligations of both parties with respect to the
18 subject matter of the contract;
19(4) ensure that each person that processes personal data is subject to a
20 duty of confidentiality with respect to the personal data;
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 44 of 65
1(5) require the processor to delete the personal data or return the
2 personal data to the controller at the controller’s direction or at the end of the
3 provision of services, unless a law requires the processor to retain the personal
4 data;
5(6) require the processor to make available to the controller, at the
6 controller’s request, all information the controller needs to verify that the
7 processor has complied with all obligations the processor has under this
8 chapter;
9(7) require the processor to enter into a subcontract with a person the
10 processor engages to assist with processing personal data on the controller’s
11 behalf and in the subcontract require the subcontractor to meet the processor’s
12 obligations concerning personal data;
13(8)(A) allow the controller, the controller’s designee, or a qualified and
14 independent person the processor engages, in accordance with an appropriate
15 and accepted control standard, framework, or procedure, to assess the
16 processor’s policies and technical and organizational measures for complying
17 with the processor’s obligations under this chapter;
18(B) require the processor to cooperate with the assessment; and
19(C) at the controller’s request, report the results of the assessment to
20 the controller;
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 45 of 65
1(9) prohibit the processor from combining personal data obtained from
2 the controller with personal data that the processor:
3(A) receives from or on behalf of another controller or person; or
4(B) collects directly from an individual; and
5(10) require the processor to adhere to equivalent or greater de-
6 identification standards.
7    (c) This section does not relieve a controller or processor from any liability
8 that accrues under this chapter as a result of the controller’s or processor’s
9 actions in processing personal data.
10    (d)(1) For purposes of determining obligations under this chapter, a person
11 is a controller with respect to processing a set of personal data and is subject to
12 an action under section 2424 of this title to punish a violation of this chapter, if
13 the person:
14(A) does not adhere to a controller’s instructions to process the
15 personal data; or
16(B) begins at any point to determine the purposes and means for
17 processing the personal data, alone or in concert with another person.
18(2) A determination under this subsection is a fact-based determination
19 that must take account of the context in which a set of personal data is
20 processed.
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 46 of 65
1(3) A processor that adheres to a controller’s instructions with respect to
2 a specific processing of personal data remains a processor.
3 § 2421. DATA PROTECTION ASSESSMENTS FOR PROCESSING
4ACTIVITIES THAT PRESENT A HEIGHTENED RISK OF HARM
5TO A CONSUMER
6    (a) A controller shall conduct and document a data protection assessment
7 for each of the controller’s processing activities that presents a heightened risk
8 of harm to a consumer, which, for the purposes of this section, includes:
9(1) the processing of personal data for the purposes of targeted
10 advertising;
11(2) the sale of personal data;
12(3) the processing of personal data for the purposes of profiling, where
13 the profiling presents a reasonably foreseeable risk of:
14(A) unfair or deceptive treatment of, or unlawful disparate impact on,
15 consumers;
16(B) financial, physical, or reputational injury to consumers;
17(C) a physical or other intrusion upon the solitude or seclusion, or the
18 private affairs or concerns, of consumers, where the intrusion would be
19 offensive to a reasonable person; or
20(D) other substantial injury to consumers; and
21(4) the processing of sensitive data.
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 47 of 65
1    (b)(1) Data protection assessments conducted pursuant to subsection (a) of
2 this section shall:
3(A) identify the categories of personal data processed, the purposes
4 for processing the personal data, and whether the personal data is being
5 transferred to third parties; and
6(B) identify and weigh the benefits that may flow, directly and
7 indirectly, from the processing to the controller, the consumer, other
8 stakeholders, and the public against the potential risks to the consumer
9 associated with the processing, as mitigated by safeguards that can be
10 employed by the controller to reduce the risks.
11(2) The controller shall factor into any data protection assessment the
12 use of de-identified data and the reasonable expectations of consumers, as well
13 as the context of the processing and the relationship between the controller and
14 the consumer whose personal data will be processed.
15    (c)(1) The Attorney General may require that a controller disclose any data
16 protection assessment that is relevant to an investigation conducted by the
17 Attorney General pursuant to section 2424 of this title, and the controller shall
18 make the data protection assessment available to the Attorney General.
19(2) The Attorney General may evaluate the data protection assessment
20 for compliance with the responsibilities set forth in this chapter.
                                                                       VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 48 of 65
1(3) Data protection assessments shall be confidential and shall be
2 exempt from disclosure and copying under the Public Records Act.
3(4) To the extent any information contained in a data protection
4 assessment disclosed to the Attorney General includes information subject to
5 attorney-client privilege or work product protection, the disclosure shall not
6 constitute a waiver of the privilege or protection.
7    (d) A single data protection assessment may address a comparable set of
8 processing operations that present a similar heightened risk of harm.
9    (e) If a controller conducts a data protection assessment for the purpose of
10 complying with another applicable law or regulation, the data protection
11 assessment shall be deemed to satisfy the requirements established in this
12 section if the data protection assessment is reasonably similar in scope and
13 effect to the data protection assessment that would otherwise be conducted
14 pursuant to this section.
15    (f) A controller shall update the data protection assessment as often as
16 appropriate considering the type, amount, and sensitivity of personal data
17 collected or processed and level of risk presented by the processing throughout
18 the processing activity’s lifecycle in order to:
19(1) monitor for harm caused by the processing and adjust safeguards
20 accordingly; and
                                                                   VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 49 of 65
1(2) ensure that data protection and privacy are considered as the
2 controller makes new decisions with respect to the processing.
3(g) A controller shall retain for at least three years all data protection
4 assessments the controller conducts under this section.
5 § 2422. DE-IDENTIFIED DATA
6(a) A controller in possession of de-identified data shall:
7(1) take reasonable measures to ensure that the data cannot be used to
8 reidentify an identified or identifiable individual or be associated with an
9 individual or device that identifies or is linked or reasonably linkable to an
10 individual or household;
11(2) publicly commit to maintaining and using de-identified data without
12 attempting to reidentify the data; and
13(3) contractually obligate any recipients of the de-identified data to
14 comply with the provisions of this chapter.
15(b) This section does not prohibit a controller from attempting to reidentify
16 de-identified data solely for the purpose of testing the controller’s methods for
17 de-identifying data.
18(c) This chapter shall not be construed to require a controller or processor
19 to:
20(1) reidentify de-identified data; or
                                                                         VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 50 of 65
1(2) maintain data in identifiable form, or collect, obtain, retain, or access
2 any data or technology, in order to associate a consumer with personal data in
3 order to authenticate the consumer’s request under subsection 2418(b) of this
4 title; or
5(3) comply with an authenticated consumer rights request if the
6 controller:
7(A) is not reasonably capable of associating the request with the
8 personal data or it would be unreasonably burdensome for the controller to
9 associate the request with the personal data; and
10(B) does not use the personal data to recognize or respond to the
11 specific consumer who is the subject of the personal data or associate the
12 personal data with other personal data about the same specific consumer.
13    (d) A controller that discloses or transfers de-identified data shall exercise
14 reasonable oversight to monitor compliance with any contractual commitments
15 to which the de-identified data is subject and shall take appropriate steps to
16 address any breaches of those contractual commitments.
17 § 2423. CONSTRUCTION OF DUTIES OF CONTROLLERS AND
18PROCESSORS
19    (a) This chapter shall not be construed to restrict a controller’s, processor’s,
20 or consumer health data controller’s ability to:
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 51 of 65
1(1) comply with federal, state, or municipal laws, ordinances, or
2 regulations, except as prohibited by 1 V.S.A. § 150;
3(2) comply with a civil, criminal, or regulatory inquiry, investigation,
4 subpoena, or summons by federal, state, municipal, or other governmental
5 authorities;
6(3) cooperate with law enforcement agencies concerning conduct or
7 activity that the controller, processor, or consumer health data controller
8 reasonably and in good faith believes may violate federal, state, or municipal
9 laws, ordinances, or regulations;
10(4) carry out obligations under a contract under subsection 2420(b) of
11 this title for a federal or State agency or local unit of government;
12(5) investigate, establish, exercise, prepare for, or defend legal claims;
13(6) provide a product or service specifically requested by the consumer
14 to whom the personal data pertains consistent with section 2419 of this title;
15(7) perform under a contract to which a consumer is a party, including
16 fulfilling the terms of a written warranty;
17(8) take steps at the request of a consumer prior to entering into a
18 contract;
19(9) take immediate steps to protect an interest that is essential for the life
20 or physical safety of the consumer or another individual, and where the
21 processing cannot be manifestly based on another legal basis;
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 52 of 65
1(10) prevent, detect, protect against, or respond to a network security or
2 physical security incident, including an intrusion or trespass, medical alert, or
3 fire alarm;
4(11) prevent, detect, protect against, or respond to identity theft, fraud,
5 harassment, malicious or deceptive activity, or any criminal activity targeted at
6 or involving the controller or processor or its services, preserve the integrity or
7 security of systems, or investigate, report, or prosecute those responsible for
8 the action;
9(12) assist another controller, processor, consumer health data
10 controller, or third party with any of the obligations under this chapter;
11(13) process personal data for reasons of public interest in the area of
12 public health, community health, or population health, but solely to the extent
13 that the processing is:
14(A) subject to suitable and specific measures to safeguard the rights
15 of the consumer whose personal data is being processed; and
16(B) under the responsibility of a professional subject to
17 confidentiality obligations under federal, state, or local law;
18(14) effectuate a product recall; or
19(15) process personal data previously collected in accordance with this
20 chapter such that the personal data becomes de-identified data, including to:
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 53 of 65
1(A) conduct internal research to develop, improve, or repair products,
2 services, or technology;
3(B) identify and repair technical errors that impair existing or
4 intended functionality;
5(C) perform internal operations that are reasonably aligned with the
6 expectations of the consumer or reasonably anticipated based on the
7 consumer’s existing relationship with the controller, or are otherwise
8 compatible with processing data in furtherance of the provision of a product or
9 service specifically requested by a consumer or the performance of a contract
10 to which the consumer is a party; or
11(D) conduct a public or peer-reviewed scientific, historical, or
12 statistical research project that is in the public interest and adheres to all
13 relevant laws and regulations governing such research, including regulations
14 for the protection of human subjects.
15    (b)(1) The obligations imposed on controllers, processors, or consumer
16 health data controllers under this chapter shall not apply where compliance by
17 the controller, processor, or consumer health data controller with this chapter
18 would violate an evidentiary privilege under the laws of this State.
19(2) This chapter shall not be construed to prevent a controller, processor,
20 or consumer health data controller from providing personal data concerning a
                                                                       VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 54 of 65
1 consumer to a person covered by an evidentiary privilege under the laws of the
2 State as part of a privileged communication.
3(3) Nothing in this chapter modifies 2020 Acts and Resolves No. 166,
4 Sec. 14 or authorizes the use of facial recognition technology by law
5 enforcement.
6    (c)(1) A controller, processor, or consumer health data controller that
7 discloses personal data to a processor or third-party controller pursuant to this
8 chapter shall not be deemed to have violated this chapter if the processor or
9 third-party controller that receives and processes the personal data violates this
10 chapter, provided that at the time the disclosing controller, processor, or
11 consumer health data controller disclosed the personal data, the disclosing
12 controller, processor, or consumer health data controller did not have actual
13 knowledge that the receiving processor or third-party controller would violate
14 this chapter.
15(2) A third-party controller or processor receiving personal data from a
16 controller, processor, or consumer health data controller in compliance with
17 this chapter is not in violation of this chapter for the transgressions of the
18 controller, processor, or consumer health data controller from which the third-
19 party controller or processor receives the personal data.
20    (d) This chapter shall not be construed to:
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 55 of 65
1(1) impose any obligation on a controller, processor, or consumer health
2 data controller that adversely affects the rights or freedoms of any person,
3 including the rights of any person:
4(A) to freedom of speech or freedom of the press guaranteed in the
5 First Amendment to the U.S. Constitution; or
6(B) under 12 V.S.A. § 1615;
7(2) apply to any person’s processing of personal data in the course of the
8 person’s solely personal or household activities;
9(3) require an independent school as defined in 16 V.S.A. § 11(a)(8) or a
10 private institution of higher education, as defined in 20 U.S.C. § 1001 et seq.,
11 to delete personal data or opt out of processing of personal data that would
12 unreasonably interfere with the provision of education services by or the
13 ordinary operation of the school or institution;
14(4) require, for employee data, deletion of personal data that would
15 unreasonably interfere with the ordinary business operations of the controller
16 or unreasonably adversely affect the rights of another employee, including
17 under this chapter or pursuant to the protections set forth in 21 V.S.A
18 chapter 5; or
19(5) require, for processors acting on the behalf of a federal, State, tribal,
20 or local government entity, deletion of personal data or opt out of the
21 processing of personal data that would unreasonably interfere with the
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 56 of 65
1 provision of government services by or the ordinary operation of a government
2 entity.
3    (e)(1) Personal data processed by a controller or consumer health data
4 controller pursuant to this section may be processed to the extent that the
5 processing is:
6(A)(i) reasonably necessary and proportionate to the purposes listed
7 in this section; or
8(ii) in the case of sensitive data, strictly necessary to the purposes
9 listed in this section;
10(B) adequate, relevant, and limited to what is necessary in relation to
11 the specific purposes listed in this section; and
12(C) compliant with the antidiscrimination provisions set forth in
13 subdivision 2419(c)(5) of this title.
14(2)(A) Personal data collected, used, or retained pursuant to subsection
15 (b) of this section shall, where applicable, take into account the nature and
16 purpose or purposes of the collection, use, or retention.
17(B) Personal data collected, used, or retained pursuant to subsection
18 (b) of this section shall be subject to reasonable administrative, technical, and
19 physical measures to protect the confidentiality, integrity, and accessibility of
20 the personal data and to reduce reasonably foreseeable risks of harm to
21 consumers relating to the collection, use, or retention of personal data.
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 57 of 65
1    (f) If a controller or consumer health data controller processes personal data
2 pursuant to an exemption in this section, the controller or consumer health data
3 controller bears the burden of demonstrating that the processing qualifies for
4 the exemption and complies with the requirements in subsection (e) of this
5 section.
6    (g) This chapter shall not be construed to require a controller, processor, or
7 consumer health data controller to implement an age-verification or age-gating
8 system or otherwise affirmatively collect the age of consumers.
9 § 2424. ENFORCEMENT; ATTORNEY GENERAL’S POWERS
10    (a) A person who violates this chapter or rules adopted pursuant to this
11 chapter commits an unfair and deceptive act in commerce in violation of
12 section 2453 of this title, and the Attorney General shall have exclusive
13 authority to enforce such violations except as provided in subsection (d) of this
14 section.
15    (b) The Attorney General has the same authority to adopt rules to
16 implement the provisions of this section and to conduct civil investigations,
17 enter into assurances of discontinuance, bring civil actions, and take other
18 enforcement actions as provided under chapter 63, subchapter 1 of this title.
19    (c)(1) If the Attorney General determines that a violation of this chapter or
20 rules adopted pursuant to this chapter may be cured, the Attorney General may,
21 prior to initiating any action for the violation, issue a notice of violation
                                                                      VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 58 of 65
1 extending a 60-day cure period to the controller, processor, or consumer health
2 data controller alleged to have violated this chapter or rules adopted pursuant
3 to this chapter.
4(2) The Attorney General may, in determining whether to grant a
5 controller, processor, or consumer health data controller the opportunity to
6 cure an alleged violation described in subdivision (1) of this subsection,
7 consider:
8(A) the number of violations;
9(B) the size and complexity of the controller, processor, or consumer
10 health data controller;
11(C) the nature and extent of the controller’s, processor’s, or consumer
12 health data controller’s processing activities;
13(D) the substantial likelihood of injury to the public;
14(E) the safety of persons or property;
15(F) whether the alleged violation was likely caused by human or
16 technical error; and
17(G) the sensitivity of the data.
18    (d)(1) The private right of action available to a consumer for violations of
19 this chapter or rules adopted pursuant to this chapter shall be exclusively as
20 provided under this subsection.
                                                                    VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 59 of 65
1(2)(A) Subject to the requirements of subdivisions (3) and (4) of this
2 subsection (d), a consumer who is harmed by a data broker’s or large data
3 holder’s violation of subsection 2419(c) of this title or section 2425 of this title
4 may bring an action under subsection 2461(b) of this title in Superior Court
5 for:
6(i) the greater of $5,000.00 or actual damages;
7(ii) injunctive relief;
8(iii) punitive damages, in the case of an intentional violation;
9(iv) reasonable costs and attorney’s fees; and
10(v) any other relief the court deems proper.
11(B) No action may be taken under subsection 2461(b) of this title:
12(i) for a violation of any provision of this chapter or rules adopted
13 pursuant to this chapter other than what is specifically permitted in subdivision
14 (A) of this subdivision (2); or
15(ii) against a controller that is registered in the State and that
16 earned less than $25 million in revenue in the previous calendar year.
17(3) At least 65 days prior to the filing of any action pursuant to
18 subdivision (2)(A) of this subsection, the consumer shall:
19(A) only once notify the Attorney General of the alleged harm in a
20 form and manner prescribed by the Attorney General, which, at minimum,
                                                                       VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 60 of 65
1 shall require the name of the consumer and a reasonable description of the
2 alleged violation and the harm suffered; and
3(B) mail to the alleged violator a written demand letter that identifies
4 the consumer and reasonably describes the alleged violation and the harm
5 suffered, unless the alleged violator does not maintain a place of business in
6 Vermont or does not keep assets in Vermont.
7(4) Within 65 days after receiving the notice required by subdivision
8 (3)(A) of this subsection, the Attorney General shall review the alleged harm to
9 determine whether the claim is frivolous or nonfrivolous.
10(A) If the Attorney General determines that the claim is frivolous, the
11 Attorney General shall notify the consumer in writing, and the consumer is
12 prohibited from proceeding with an action under subsection 2461(b) of this
13 title for the alleged harm.
14(B) If the Attorney General determines that the claim is nonfrivolous
15 or does not issue a determination within 65 days after receiving notice, the
16 consumer may proceed with an action pursuant to subdivision (2)(A) of this
17 subsection (d).
18    (e) Annually, on or before February 1, the Attorney General shall submit a
19 report to the General Assembly disclosing:
20(1) the number of notices of violation the Attorney General has issued;
21(2) the nature of each violation;
                                                                   VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 61 of 65
1(3) the number of violations that were cured during the available cure
2 period;
3(4) the number of actions brought under subsection (d) of this section;
4(5) the proportion of actions brought under subsection (d) of this section
5 that proceed to trial;
6(6) the data brokers or large data holders most frequently sued under
7 subsection (d) of this section; and
8(7) any other matter the Attorney General deems relevant for the
9 purposes of the report.
10 § 2425. CONFIDENTIALITY OF CONSUMER HEALTH DATA
11    Except as provided in subsections 2417(a) and (b) of this title and section
12 2423 of this title, no person shall:
13(1) provide any employee or contractor with access to consumer health
14 data unless the employee or contractor is subject to a contractual or statutory
15 duty of confidentiality;
16(2) provide any processor with access to consumer health data unless the
17 person and processor comply with section 2420 of this title; or
18(3) use a geofence to establish a virtual boundary that is within 1,850
19 feet of any health care facility, including any mental health facility or
20 reproductive or sexual health facility, for the purpose of identifying, tracking,
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 62 of 65
1 collecting data from, or sending any notification to a consumer regarding the
2 consumer’s consumer health data.
3 Sec. 2. PUBLIC EDUCATION AND OUTREACH; ATTORNEY GENERAL
4STUDY
5    (a) The Attorney General shall implement a comprehensive public
6 education, outreach, and assistance program for controllers and processors as
7 those terms are defined in 9 V.S.A. § 2415. The program shall focus on:
8(1) the requirements and obligations of controllers and processors under
9 the Vermont Data Privacy and Online Surveillance Act;
10(2) data protection assessments under 9 V.S.A. § 2421;
11(3) enhanced protections that apply to children, minors, sensitive data,
12 or consumer health data as those terms are defined in 9 V.S.A. § 2415;
13(4) a controller’s obligations to law enforcement agencies and the
14 Attorney General’s office;
15(5) methods for conducting data inventories; and
16(6) any other matters the Attorney General deems appropriate.
17    (b) The Attorney General shall provide guidance to controllers for
18 establishing data privacy notices and opt-out mechanisms, which may be in the
19 form of templates.
                                                                  VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 63 of 65
1    (c) The Attorney General shall implement a comprehensive public
2 education, outreach, and assistance program for consumers as that term is
3 defined in 9 V.S.A. § 2415. The program shall focus on:
4(1) the rights afforded consumers under the Vermont Data Privacy and
5 Online Surveillance Act, including:
6(A) the methods available for exercising data privacy rights; and
7(B) the opt-out mechanism available to consumers;
8(2) the obligations controllers have to consumers;
9(3) different treatment of children, minors, and other consumers under
10 the Act, including the different consent mechanisms in place for children and
11 other consumers;
12(4) understanding a privacy notice provided under the Act;
13(5) the different enforcement mechanisms available under the Act,
14 including the consumer’s private right of action; and
15(6) any other matters the Attorney General deems appropriate.
16    (d) The Attorney General shall cooperate with states with comparable data
17 privacy regimes to develop any outreach, assistance, and education programs,
18 where appropriate.
19    (e) The Attorney General may have the assistance of the Vermont Law and
20 Graduate School in developing education, outreach, and assistance programs
21 under this section.
                                                                 VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 64 of 65
1    (f) On or before December 15, 2027, the Attorney General shall assess the
2 effectiveness of the implementation of the Act and submit a report to the
3 House Committee on Commerce and Economic Development, the House
4 Committee on Energy and Digital Infrastructure, the Senate Committee on
5 Economic Development, Housing and General Affairs, and the Senate
6 Committee on Institutions with its findings and recommendations, including
7 any proposed draft legislation to address issues that have arisen since
8 implementation.
9 Sec. 3. 9 V.S.A. § 2416(a) is amended to read:
10    (a) Except as provided in subsection (b) of this section, this chapter applies
11 to a person that conducts business in this State or a person that produces
12 products or services that are targeted to residents of this State and that during
13 the preceding calendar year:
14(1) controlled or processed the personal data of not fewer than 25,000
15 12,500 consumers, excluding personal data controlled or processed solely for
16 the purpose of completing a payment transaction; or
17(2) controlled or processed the personal data of not fewer than 12,500
18 6,250 consumers and derived more than 25 20 percent of the person’s gross
19 revenue from the sale of personal data.
                                                                     VT LEG #378938 v.1
 BILL AS INTRODUCED  H.208
 2025  Page 65 of 65
1 Sec. 4. 9 V.S.A. § 2416(a) is amended to read:
2    (a) Except as provided in subsection (b) of this section, this chapter applies
3 to a person that conducts business in this State or a person that produces
4 products or services that are targeted to residents of this State and that during
5 the preceding calendar year:
6(1) controlled or processed the personal data of not fewer than 12,500
7 6,250 consumers, excluding personal data controlled or processed solely for
8 the purpose of completing a payment transaction; or
9(2) controlled or processed the personal data of not fewer than 6,250
10 3,125 consumers and derived more than 20 percent of the person’s gross
11 revenue from the sale of personal data.
12 Sec. 5. EFFECTIVE DATES
13    (a) This section and Sec. 2 (public education and outreach) shall take effect
14 on July 1, 2025.
15    (b) Sec. 1 (Vermont Data Privacy and Online Surveillance Act) shall take
16 effect on July 1, 2026.
17    (c) Sec. 3 (Vermont Data Privacy Online Surveillance Act middle
18 applicability threshold) shall take effect on July 1, 2027.
19    (d) Sec. 4 (Vermont Data Privacy Online Surveillance Act low
20 applicability threshold) shall take effect on July 1, 2028.
                                                                     VT LEG #378938 v.1