An act relating to consumer data privacy and online surveillance

H.208 creates Vermont's first comprehensive data privacy law, giving residents specific rights over their personal data. It requires businesses to obtain clear, affirmative consent for data collection (prohibiting "dark patterns" like deceptive pop-ups), bans the sale of biometric data and sensitive health information (including gender-affirming and reproductive health data), and restricts online tracking. The law directly affects Vermont residents and any business collecting their data, including data brokers and companies using contextual advertising. Key provisions include mandatory opt-in consent for data processing, requirements for transparent privacy notices, and new protections against automated decisions affecting housing, employment, or healthcare access.