Duties of Controllers
Reference only: This requirement is not currently tested by the Privisy scanner. It is included for reference. Consult a qualified attorney to assess your compliance posture.
What it requires
Requires data minimization, consent for sensitive-data processing and sale, non-discrimination, and a detailed privacy notice, now including a required disclosure of whether the controller uses or sells personal data to train large language models. Extends the ban on targeted advertising and sale to any consumer known to be under 18 (up from under 16 in the introduced bill), cross-references the Vermont Age-Appropriate Design Code Act for covered minors, and requires a non-default opt-out preference signal mechanism.
Legal text (excerpt)
if a controller ... willfully disregards ... that a consumer is ... younger than 18 years of age: (A) not process the personal data ... for purposes of targeted advertising; and (B) not sell the consumer's personal data; ... (H) a statement disclosing whether the controller ... sells personal data for ... training large language models ....
Primary source
Vermont Office of the Attorney General: § 2415e: Duties of Controllers ↗Legal notice: This page is for informational purposes only and does not constitute legal advice. The legal text excerpt is reproduced from official public sources and is current as of the stated effective date. Laws change: verify against the authoritative source and consult a licensed attorney for compliance guidance.