Starting January 1, 2028, Vermont organizations meeting the law's data-handling thresholds must follow consumer privacy rules enforced by the Attorney General.
Covered consumers can ask to correct or delete their data, get a copy, and opt out of targeted ads or data sales.
Covered organizations must limit the data they collect, explain how they use it, and get consent before processing or selling sensitive data.
Covered organizations must assess consumer risks when they use data in high-risk ways or profile people, and share those assessments with the Attorney General upon request.
The law lets consumers ask whether an organization uses their data, correct or delete it, get a copy, and opt out of targeted ads or data sales. The law generally covers organizations that handle data for at least 35,000 consumers, handle sensitive data for at least 3,000 consumers, or sell data for at least 3,000 consumers. Some organizations and data are exempt. A consumer may name an agent to opt out for them. Organizations must answer requests within a set time, but this summary does not give the length of that time. The law takes effect January 1, 2028.
The law requires covered organizations to limit data collection, explain their data practices, and get consent before processing or selling sensitive data. The law generally covers organizations that handle data for at least 35,000 consumers, handle sensitive data for at least 3,000 consumers, or sell data for at least 3,000 consumers. Some organizations and data are exempt. Organizations may collect only data reasonably needed for its purpose and may not use it for a new purpose that conflicts with that purpose. They may not treat consumers unfairly for using their rights under the law. The law takes effect January 1, 2028.
The law requires organizations to assess risks when they use data in ways that pose a heightened risk of harm or when they profile people. These duties apply to organizations covered by the law that engage in the specified high-risk data use or profiling. The assessment must weigh benefits to the organization against risks to consumers. The organization must provide the assessment to the Attorney General upon request during an investigation. The Attorney General enforces the law through Vermont's consumer protection law. The law takes effect January 1, 2028.
No hearings or votes scheduled.