Technology (Data Privacy)

Vermont's S.71, the Vermont Data Privacy Act, creates new rules for businesses handling personal data of Vermont residents. It requires businesses to obtain clear, affirmative consent (not dark patterns or broad terms) before collecting personal data, with special protections for sensitive information like reproductive health, gender-affirming care, and precise location data (within 1,750 feet). The law prohibits using geofencing to track individuals near sensitive locations like abortion clinics or mental health facilities. It directly affects all businesses processing personal data of Vermont residents, including tech companies, retailers, and health services, by mandating transparency and restricting how they can use or share consumer information.

H.208 creates Vermont's first comprehensive data privacy law, giving residents specific rights over their personal data. It requires businesses to obtain clear, affirmative consent for data collection (prohibiting "dark patterns" like deceptive pop-ups), bans the sale of biometric data and sensitive health information (including gender-affirming and reproductive health data), and restricts online tracking. The law directly affects Vermont residents and any business collecting their data, including data brokers and companies using contextual advertising. Key provisions include mandatory opt-in consent for data processing, requirements for transparent privacy notices, and new protections against automated decisions affecting housing, employment, or healthcare access.