Applicability

What it requires

Applies to a person that conducts business in Vermont, or produces products or services targeted to Vermont residents, and that during the preceding calendar year controlled or processed the personal data of at least 35,000 consumers, controlled or processed the sensitive data of at least 3,000 consumers (both tests exclude data processed solely to complete a payment transaction), or offered for sale the personal data of at least 3,000 consumers. Section 2415k and the other consumer health data provisions apply regardless of these thresholds. The Senate-passed version used a 100,000-consumer test, or 25,000 consumers plus more than 25% of gross revenue from selling personal data. The bill as introduced used 25,000 consumers, or 12,500 plus more than 25% of revenue, stepping down to 12,500 and 6,250 (with a 20% revenue share) on July 1, 2027 and to 6,250 and 3,125 on July 1, 2028.

Statute text

(1) controlled or processed the personal data of not fewer than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; (2) controlled or processed the sensitive data of not fewer than 3,000 consumers ...; or (3) offered for sale in trade or commerce the personal data of not fewer than 3,000 consumers.

Vermont Data Privacy and Online Surveillance Act, § 2415bRead the full section from Vermont Office of the Attorney General