Duties of Controllers

What it requires

Requires data minimization, consent for sensitive-data processing and sale, non-discrimination, and a detailed privacy notice, including a statement of whether the controller collects, uses, or sells personal data to train large language models. Bars targeted advertising to, and sale of the personal data of, a consumer the controller has actual knowledge, and willfully disregards, is at least 13 but younger than 18, with no consent exception. The Senate-passed version covered only ages 13 to 15 and allowed both with consent; the bill as introduced barred a controller offering an online service, product, or feature from doing either for any minor under 18 it knew or should have known was a minor. A known child's data is sensitive data, which may be processed or sold only with consent and must be processed in accordance with COPPA. Covered businesses must also follow the Vermont Age-Appropriate Design Code Act for covered minors, and controllers must accept opt-outs sent by an opt-out preference signal whose mechanism does not rely on a default setting.

Statute text

(a) Data collection and processing. A controller shall: [...] (7) subject to subdivision (9) of this subsection, if a controller has actual knowledge, and willfully disregards, that a consumer is at least 13 years of age but younger than 18 years of age: (A) not process the personal data of the consumer for purposes of targeted advertising; and (B) not sell the consumer’s personal data; [...] (c) Privacy notice. (1) A controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes: [...] (H) a statement disclosing whether the controller collects, uses, or sells personal data for the purpose of training large language models; [...]

Vermont Data Privacy and Online Surveillance Act, § 2415eRead the full section from Vermont Office of the Attorney General