An act relating to consumer data privacy and online surveillance

New applicability section (Sec. 2416) sets specific thresholds: the law applies to persons who processed personal data of 25,000+ consumers in the prior calendar year, OR 12,500+ consumers with more than 25% of gross revenue from selling personal data. Consumer health data provisions apply to all persons doing business in Vermont with no threshold.

New exemptions section (Sec. 2417) lists 20 specific categories exempt from the law, including government entities, HIPAA-covered information, FCRA-compliant credit reporting, GLBA-covered financial institutions, banks and credit unions, Vermont-regulated insurers, victim services organizations, noncommercial media activity, and human subjects research.

New definition of 'Sensitive data' with 14 categories including government-issued identifiers, racial/ethnic origin, religious beliefs, mental/physical health conditions, pregnancy status, sexual orientation, transgender/nonbinary status, victim of crime status, financial account credentials, biometric/genetic data, minor data, precise geolocation, keystrokes, driving behavior, neural data, and cross-device online activity.

New definitions added for: 'Targeted advertising' (with exclusions for first-party and contextual advertising), 'First party,' 'First-party advertising,' 'First-party data,' 'Contextual advertising,' 'Large data holder' (100,000 consumer threshold), 'Marketing measurement,' 'Unique persistent identifier,' 'Third party,' 'Data broker,' 'Online service, product, or feature,' and 'Victim services organization.'

'Consumer' exclusion narrowed: removed 'employment context' and 'employee' from the list of excluded individuals, so employees are no longer categorically excluded from consumer protections. Changed to 'acting in a commercial capacity or as an owner, director, officer, or contractor.'

'Neural data' redefined from 'information generated by measuring the activity of an individual's central nervous system' to 'information collected through biosensors and that could be processed to infer or predict mental states' - a broader definition focused on inference capability rather than measurement method.

'Precise geolocation data' radius increased from 1,750 feet to 1,850 feet. Added new exclusion for 'a photograph, or metadata associated with a photograph or video, that cannot be linked to an individual.'

'Sale of personal data' changed from exchange 'with a third party' to 'to a third party' (one-directional). Added two new exclusions: disclosure of publicly available information, and transfer of personal data as part of a merger, acquisition, bankruptcy, or similar transaction where the third party assumes control of assets.

'Publicly available information' expanded with two new exclusions: 'information that is made available for sale' (removing it from the publicly available category) and 'any inference made exclusively from multiple independent sources of publicly available information that reveals sensitive data with respect to a consumer.'

'Gender-affirming health data' expanded to explicitly include: precise geolocation data used to determine attempts to acquire such services, efforts to research or obtain such services, and gender-affirming health data derived from nonhealth information.

'Processor' definition expanded to include persons who process personal data on behalf of 'a federal, state, tribal, or local government entity,' not just controllers and other processors.

Removed definitions for 'Institution of higher education,' 'Nonprofit organization' (as a standalone term), and 'Pseudonymous data' from the passed version. The enacted version retains these.

Consent definition significantly strengthened: now requires the request to be in a clear and conspicuous disclosure, include a description of processing purpose, clearly distinguish between acts necessary to fulfill the consumer's request and acts for other purposes, state specific categories of personal data, and be accessible to consumers with disabilities. Also added 'inaction or continued use of a service' as something that does NOT constitute consent.

New consumer right (Sec. 2418(a)(2)) to know whether their personal data is or will be used in any artificial intelligence system and for what purpose - an AI-specific transparency right not present in the enacted version.

Structural reorganization: the enacted version uses a subchapter structure under Chapter 61A with section numbering starting at 2415a, while the passed version is a single chapter titled 'VERMONT DATA PRIVACY AND ONLINE SURVEILLANCE ACT' with sections starting at 2415. The passed version is 122 pages versus 54 pages for the enacted version.

The chapter title changed from 'Vermont Data Privacy Act' to 'Vermont Data Privacy and Online Surveillance Act,' signaling a broader regulatory reach over surveillance practices.

The exemptions section was restructured. Entity-specific exemptions for nonprofits, institutions of higher education, national securities associations, tribal nations, and air carriers were removed from the list. Government entity exemption was broadened to cover any federal, state, tribal, or local government entity 'in the ordinary course of its operation.' New data-level exemptions were added for public health, community health, population health activities, and FDA human subject protections.

Applicability thresholds were lowered significantly: the primary threshold dropped from 100,000 consumers to 25,000, and the secondary threshold (combined with 25% revenue from data sales) dropped from 25,000 to 12,500. This brings many more businesses under the law's coverage.

The definition of 'sensitive data' was dramatically expanded to now include government-issued identifiers, income level or indebtedness, union membership, keystrokes, driving behavior, neural data, financial account credentials, cross-device online activities, and transgender or nonbinary status - in addition to the previously listed categories.

'Biometric data' was redefined from 'personal data generated by automatic measurements' to 'data generated from the technological processing of an individual's unique biological, physical, or physiological characteristics,' with specific examples including iris scans, fingerprints, facial mapping, vein patterns, voice prints, and gait analysis.

Numerous new definitions were added including: genetic data, neural data, first-party advertising, first-party data, contextual advertising, large data holder (100,000 consumer threshold), unique persistent identifier, marketing measurement, minor (under 18), victim services organization, and online service/product/feature.

'Publicly available information' was significantly narrowed with new exclusions: biometric data collected without consumer knowledge, consumer profiles created from collated data, information made available for sale, inferences revealing sensitive data, genetic data (unless consumer-published), information where the consumer maintained a reasonable expectation of privacy, and nonconsensual intimate images.

'Personal data' was expanded to include 'derived data and unique identifiers' and now covers data linked to 'a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household.'

'Targeted advertising' was redefined to cover ads displayed to a consumer or a device identified by a unique persistent identifier, and now includes marketing measurement. The old four-part exclusion list was replaced with just two exclusions: first-party advertising and contextual advertising.

'Consent' requirements were strengthened: consent must now be in response to a specific request, provided via clear and conspicuous disclosure, describe the processing purpose, distinguish between necessary and other purposes, state specific data categories, and be accessible to consumers with disabilities. Inaction or continued use of a service was explicitly added as not constituting consent.

'Precise geolocation data' radius threshold changed from 1,750 feet to 1,850 feet, and the definition now covers 'past or present physical location' rather than just current location. A new exclusion was added for photographs or metadata that cannot be linked to an individual.

'Third party' was redefined from a broad exclusion-based definition to one focused on who collects personal data from another person. It now specifically excludes affiliates, whereas the old version excluded affiliates of both the controller and processor.

'Processor' was expanded to include processing on behalf of 'another processor' or 'a federal, state, tribal, or local government entity,' not just a controller.

The standalone definition of 'Abortion' (terminating a pregnancy for any purpose other than producing a live birth) was removed. The reproductive health definitions were simplified to reference 1 V.S.A. section 150(c)(1) instead of listing specific services.

'Gender-affirming health data' was expanded to explicitly include precise geolocation data used to determine attempts to acquire such services, efforts to research or obtain services, and data derived from nonhealth information.

The 'sale of personal data' exclusion for consumer-directed disclosures now requires 'the consumer's consent' in addition to the consumer directing the disclosure. The old detailed exclusion for publicly available information (mass media without audience restriction) was replaced with a simpler reference to 'publicly available information' as defined elsewhere.

The consumer threshold for a business to be covered by the law was raised from 25,000 consumers to 100,000 consumers (or from 12,500 to 25,000 under the revenue-based test), dramatically reducing the number of businesses subject to the law.

The bill title was changed from 'Vermont Data Privacy and Online Surveillance Act' to 'Vermont Data Privacy Act,' removing the online surveillance component from the title.

Exemptions were substantially expanded to include nonprofit organizations, institutions of higher education, national securities associations, tribal nation governments, and air carriers - categories not exempt in the introduced version.

A new definition of 'abortion' was added ('terminating a pregnancy for any purpose other than producing a live birth'), and the definition of 'reproductive or sexual health care' was expanded to explicitly include abortion services, products, diagnostics, counseling, and follow-up.

The definition of 'sensitive data' was narrowed from 14 categories (including government-issued identifiers, financial account credentials, keystrokes, driving behavior, neural data, and cross-device online activity) to just 6 categories (racial/ethnic origin, religious beliefs, health condition, sex life, citizenship status, consumer health data, genetic/biometric for identification, known child data, victim of crime status, and precise geolocation).

The 'targeted advertising' definition was narrowed. The introduced version covered ads selected based on 'known or predicted preferences, characteristics, behavior, or interests' and included marketing measurement. The passed version limits it to ads selected based on data 'obtained or inferred from that consumer's activities over time and across nonaffiliated websites or online applications.'

The consent definition was simplified by removing detailed requirements about what consent requests must include (clear disclosure, description of processing purpose, distinction between necessary and other purposes, specific data categories). The passed version uses a simpler standard: 'a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.'

The biometric data definition was simplified from a detailed list of examples (iris scans, fingerprints, facial mapping, vein patterns, voice prints, gait) to a general standard: 'personal data generated by automatic measurements of an individual's unique biological patterns or characteristics that are used to identify a specific individual.'

The precise geolocation data radius was changed from 1,850 feet to 1,750 feet.

Multiple definitions were removed entirely, including 'data broker,' 'first party,' 'first-party advertising,' 'first-party data,' 'genetic data' (standalone), 'large data holder,' 'marketing measurement,' 'minor,' 'neural data,' 'nonpublic personal information,' 'online service, product, or feature,' 'patient identifying information,' 'patient safety work product,' 'qualified service organization,' 'unique persistent identifier,' and 'victim services organization.'

The 'consumer' exclusion was broadened to include individuals acting in an 'employment context' and as an 'employee,' not just those acting in a commercial capacity.

The 'processor' definition was narrowed to only cover processing on behalf of a controller, removing the ability to process on behalf of another processor or a government entity.

New definitions were added for 'institution of higher education,' 'nonprofit organization,' 'person,' and 'pseudonymous data.'

The 'publicly available information' definition was significantly simplified, removing numerous exclusions that existed in the introduced version (such as biometric data collected without knowledge, consumer profiles created from collated data, obscene depictions, intimate images, and inferences from multiple independent sources).

Senate version formatting removed: headers reading 'BILL AS INTRODUCED AND PASSED BY SENATE,' page numbers, and line numbering throughout the document were stripped for the enacted version.