Technology

Vermont's S.71, the Vermont Data Privacy Act, creates new rules for businesses handling personal data of Vermont residents. It requires businesses to obtain clear, affirmative consent (not dark patterns or broad terms) before collecting personal data, with special protections for sensitive information like reproductive health, gender-affirming care, and precise location data (within 1,750 feet). The law prohibits using geofencing to track individuals near sensitive locations like abortion clinics or mental health facilities. It directly affects all businesses processing personal data of Vermont residents, including tech companies, retailers, and health services, by mandating transparency and restricting how they can use or share consumer information.

This bill, S 69 (Vermont Age-Appropriate Design Code Act), requires online services popular with minors to redesign their platforms to protect children’s privacy and safety. It directly affects businesses that generate most revenue from online services likely accessed by Vermont minors under 18 and collect their personal data. Key provisions mandate age-assurance methods to identify minors, set default privacy settings to the most protective level, ban features causing "compulsive use" (like addictive content algorithms), and restrict data collection for minors. The law also defines strict rules for handling biometric, genetic, and derived data of minors, ensuring data processing aligns with their developmental needs. It applies broadly to digital products like apps and websites, excluding physical products and basic internet services.