This Vermont bill regulates developers and deployers of automated decision systems (ADS) used in consequential decisions - such as hiring, housing, loan approvals, or healthcare access - to prevent algorithmic discrimination. It requires businesses to clearly inform consumers before using ADS in such decisions, explaining what data is measured, how it is used, and how it influences outcomes. The bill prohibits the use of ADS that result in discriminatory treatment based on protected characteristics like race, gender, age, or disability. These requirements apply to businesses operating in Vermont that deploy or develop ADS for decisions materially affecting residents' rights, liberties, or welfare.
H 387 would require businesses and individuals to obtain an individual's consent before using their name, likeness, voice, portrait, or picture for commercial purposes. The bill creates a legal right that gives people control over how their personal characteristics are used in advertising, marketing, or promotional materials. It directly affects businesses that market products or services and individuals whose image or voice might be used without permission. This law aims to protect personal privacy by preventing unauthorized commercial exploitation of an individual's identity.
H 520 is a bill that proposes to enhance individual users' control over their data on social media platforms. It aims to require social media companies to provide users with the ability to delete their personal data. Additionally, the bill mandates that companies allow users to obtain their data in a portable format and transfer it to other social media platforms.
H 342 protects the personal information of specific Vermont public servants and their families by restricting data brokers from disclosing certain details. It applies to judges, law enforcement officers, prosecutors, public defenders, parole/probation officers, and related staff (including their immediate families), prohibiting brokers from sharing home addresses, phone numbers, email addresses, Social Security numbers, driver's license numbers, and vehicle identifiers. Covered individuals can request brokers stop sharing their protected information within 15 days, with violations subject to $10,000 civil penalties. The law excludes government agencies from being classified as "data brokers" under this provision.
S 74, the Vermont My Health My Data Act, regulates how businesses collect, share, and sell Vermont residents' health data. It directly affects Vermont residents and any company handling their health information within the state. Key provisions require clear consumer consent before collecting or sharing data (prohibiting deceptive "dark patterns" in terms of use), grant consumers the right to delete their data, and ban selling health data without explicit authorization. The law specifically protects sensitive health information - including reproductive care, gender-affirming treatment, and biometric data - and prohibits tracking near healthcare facilities through geofencing.
S 93, the Vermont Data Privacy Act, would give Vermont residents new rights over their personal data, including the ability to access, correct, delete, and opt out of certain uses by businesses. It specifically strengthens protections for sensitive health data like reproductive, sexual, and gender-affirming health information, requiring businesses to obtain clear, affirmative consent without deceptive "dark patterns." The bill prohibits companies from using precise geolocation data or biometric information without explicit permission and sets strict rules for how businesses must handle personal data. These provisions would directly affect Vermont residents and all businesses collecting their data within the state.
This bill sets rules for when companies can use digital replicas (like AI-generated versions of a person) in service contracts. It requires clear consent from individuals and specific terms about how these digital replicas can be used. The law directly affects people whose digital likeness might be replicated and the businesses creating or using such replicas.
This bill (H 211) requires data brokers in Vermont to notify consumers if their personal information is involved in a security breach, certify that data is used for legitimate purposes, and provide an accessible way for consumers to request deletion of their information. It directly affects Vermont residents whose personal data is collected and sold by businesses without a direct customer relationship (e.g., companies selling addresses, phone numbers, or biometric data). Key provisions define "data brokers" narrowly to exclude businesses with direct customer ties (like retailers or employers) and clarify that publicly available business information isn’t covered. The bill aims to strengthen protections for consumer data by adding specific obligations for brokers handling sensitive information like Social Security numbers or biometric identifiers.
This Vermont bill (S 70) requires data brokers - businesses that collect and sell personal information about consumers without a direct relationship (like a customer or employee) - to take specific steps to protect residents' privacy. It mandates that data brokers notify consumers of security breaches involving personal data, certify that data is used for legitimate purposes, and provide an accessible way for consumers to request deletion of their information. The bill directly affects Vermont residents whose personal data is collected by these brokers and sets clear rules for how brokers must handle and protect that information. It does not apply to businesses sharing publicly available business or professional information or those maintaining directory services.
H.360 establishes privacy protections for Vermont residents using mobile identification, such as digital driver's licenses or nonmobile credentials. It requires mobile ID systems to let users share only necessary information (e.g., age verification without revealing full birthdate) and obtain explicit consent before disclosing any data. The bill prohibits businesses from forcing mobile ID use for services unless legally required (like age checks for alcohol sales) and mandates that verification systems cannot store, link, or share data about ID checks. These rules apply to the Department of Motor Vehicles and all entities using mobile ID verification.
