Short Title and Definitions

What it requires

Establishes the short title, "Vermont Data Privacy and Online Surveillance Act," and defines key terms. "Sensitive data" covers data revealing racial or ethnic origin, religious beliefs, sex life, sexual orientation, status as nonbinary or transgender, citizenship or immigration status, or a mental or physical health condition, diagnosis, disability, or treatment; consumer health data; genetic or biometric data and information derived from it; personal data collected from someone the controller actually knows, or willfully disregards, is a child (as defined in COPPA); precise geolocation data; neural data; financial account or card numbers or logins that would allow account access; and government-issued ID numbers the law does not require to be publicly displayed. Compared with the Senate-passed version, which already covered consumer health data, the enacted list adds nonbinary or transgender status, disability and treatment, neural data, financial credentials, and government ID numbers, reaches genetic and biometric data generally rather than only when processed to identify someone, and drops crime-victim status. The bill as introduced reached further: it also covered data from any consumer the controller knew or should have known was a minor (under 18), keystrokes, driving behavior, cross-context online activity, income or indebtedness, union membership, and crime-victim status.

Statute text

This subchapter shall be known and may be cited as the "Vermont Data Privacy and Online Surveillance Act." ... "Sensitive data" means personal data that includes: (A) data revealing: (i) racial or ethnic origin, religious beliefs, sex life, sexual orientation, status as nonbinary or transgender, or citizenship or immigration status; ... (C) genetic or biometric data ...; ... (F) neural data;

Vermont Data Privacy and Online Surveillance Act, § 2415aRead the full section from Vermont Office of the Attorney General