Applicability
Reference only: This requirement is not currently tested by the Privisy scanner. It is included for reference. Consult a qualified attorney to assess your compliance posture.
What it requires
As enacted, the applicability thresholds were substantially lowered and restructured from the introduced bill's 100,000/25,000-consumer, revenue-based test: the Act now reaches businesses processing the personal data of at least 35,000 consumers, or the sensitive data of at least 3,000 consumers, or selling the personal data of at least 3,000 consumers. Consumer health data provisions apply regardless of these thresholds.
Legal text (excerpt)
(1) controlled or processed the personal data of not fewer than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; (2) controlled or processed the sensitive data of not fewer than 3,000 consumers ...; or (3) offered for sale in trade or commerce the personal data of not fewer than 3,000 consumers.
Primary source
Vermont Office of the Attorney General: § 2415b: Applicability ↗Legal notice: This page is for informational purposes only and does not constitute legal advice. The legal text excerpt is reproduced from official public sources and is current as of the stated effective date. Laws change: verify against the authoritative source and consult a licensed attorney for compliance guidance.