Technology

Vermont's S.71, the Vermont Data Privacy Act, creates new rules for businesses handling personal data of Vermont residents. It requires businesses to obtain clear, affirmative consent (not dark patterns or broad terms) before collecting personal data, with special protections for sensitive information like reproductive health, gender-affirming care, and precise location data (within 1,750 feet). The law prohibits using geofencing to track individuals near sensitive locations like abortion clinics or mental health facilities. It directly affects all businesses processing personal data of Vermont residents, including tech companies, retailers, and health services, by mandating transparency and restricting how they can use or share consumer information.

H.489 adjusts the Vermont state budget for fiscal year 2025 by modifying funding allocations across multiple agencies. It increases total funding for the Judiciary by $2.56 million (primarily through General Fund) and shifts $786,000 from Operating Expenses to Personal Services for the Agency of Digital Services. The bill also raises Human Services funding by $841,000, including a $4.3 million increase in the Global Commitment fund, while reducing Public Safety Criminal Justice Services funding by $681,000. These changes directly affect state agencies managing digital infrastructure, courts, public safety, and human services programs. The bill was vetoed by the Governor on April 4, 2025, and did not become law.

H 342 protects the personal information of specific Vermont public servants and their families by restricting data brokers from disclosing certain details. It applies to judges, law enforcement officers, prosecutors, public defenders, parole/probation officers, and related staff (including their immediate families), prohibiting brokers from sharing home addresses, phone numbers, email addresses, Social Security numbers, driver's license numbers, and vehicle identifiers. Covered individuals can request brokers stop sharing their protected information within 15 days, with violations subject to $10,000 civil penalties. The law excludes government agencies from being classified as "data brokers" under this provision.