H.630 requires businesses selling connected devices (like smart home gadgets or wearables) in Vermont to meet specific security standards. Key provisions include mandating encrypted communications, automatic security updates enabled by default, strong password requirements with no default passwords, vulnerability management systems, and clear privacy policies with consumer data deletion options. The bill directly affects device manufacturers and sellers operating in Vermont, prohibiting sales of non-compliant products. Violations would be treated as unfair trade practices under Vermont law, with the requirements taking effect July 1, 2026.
This bill, H.639 (Genetic Information Privacy Act), requires direct-to-consumer genetic testing companies to protect the genetic data of Vermont residents. It mandates that companies obtain clear "express consent" from consumers before collecting or sharing their genetic data (defined as information from DNA analysis, including SNPs and inferred data), prohibits using "dark patterns" to manipulate consent, and limits data sharing without permission. Consumers gain the right to access their own genetic data and must actively authorize its use. The law applies specifically to companies offering genetic testing directly to Vermont residents, excluding deidentified data and research conducted under federal human subjects protections.
Vermont's S.259 allows the classroom portion of driver education to be completed through approved online courses. It directly affects Vermont students aged 15+ enrolled in public or independent high schools. The bill requires online courses to meet specific standards: using rotating exams, verifying student identity, tracking study time, ensuring data security, and providing technical support. Courses must align with the state's Novice Teen Driver Education standards and will be approved by the Agency of Education and DMV. The law takes effect July 1, 2026.
H 706 requires internet browser developers (like companies that make Chrome or Firefox) to include a simple, easily accessible setting in their browsers. This setting lets users send a clear signal to websites that they do not want their personal data sold. The bill directly affects browser companies and aims to give consumers control over how their data is used by requiring browsers to support this opt-out functionality. It defines "personal data" broadly to include information linked to individuals or devices, and includes enforcement through the Attorney General. The law takes effect January 1, 2027.
H.791 establishes the "Vermont Government Data Practices Act," setting privacy standards for how state agencies handle personal information. It requires all Vermont state agencies (including departments, boards, and commissions) to only collect and store necessary personal data - such as health records, biometrics, location data, or financial details - directly from individuals when possible, and to maintain accuracy and relevance. The bill prohibits agencies from disclosing personal information without justification and mandates that contractors handling state data follow the same rules. This directly affects how Vermont's government manages citizen data across all executive branch operations.
This bill, S.248 (Genetic Information Privacy Act), requires direct-to-consumer genetic testing companies operating in Vermont to protect the genetic data of Vermont residents. Companies must obtain explicit consumer consent before sharing data (prohibiting "dark patterns" like deceptive interfaces), allow consumers to access their own genetic data, and limit data sharing without permission. The law defines "genetic data" broadly to include DNA, RNA, SNPs, and derived information, but excludes de-identified data and data used in federally compliant research. It directly affects Vermont residents using genetic testing services and the companies providing those services within the state.
Vermont's H.812, the "Vermont Duty of Data Loyalty Act," requires businesses (called "covered entities") to handle consumer personal data responsibly by limiting how they store, share, or sell it. It directly affects Vermont consumers and businesses that collect personal data, excluding small businesses, government agencies, and employee data from its scope. Key provisions define "covered data" (information identifying individuals), prohibit selling data for cross-context behavioral advertising without consent, and create a "duty of data loyalty" for covered entities. The law aims to strengthen privacy protections by regulating data practices while specifying what data types and business types are excluded from coverage.
H 824 requires app publishers of smartphone-connected vehicle applications (like those controlling car features or tracking location) to include a simple in-vehicle process allowing occupants to see who is connected to the vehicle and disconnect any user. The process must be as easy as connecting, work inside the vehicle without special tools, and disconnect users within 30 minutes. This directly affects app developers and vehicle app providers, ensuring drivers or passengers can quickly sever remote connections. The law takes effect July 1, 2026, and aligns with consumer protection standards for vehicle technology.
This Vermont bill (S.207) prohibits businesses from using "surveillance pricing" to set different prices for consumer products based on data collected through electronic surveillance technology (like AI or tracking tools). It directly affects retailers, online sellers, and service providers in Vermont that sell consumer products (e.g., groceries, electronics, subscriptions). The law bans price discrimination using personally identifiable or aggregated consumer data, except for price differences based solely on actual costs, equal discounts for all customers (with clear notice and consent if personal data is used), or licensed insurance companies following existing rate rules. The bill takes effect July 1, 2026.
This bill requires chatbot providers operating in Vermont to protect users' data privacy and security, clearly disclose when users are interacting with an AI (not a human), and allow users to access their own chat logs. It defines key terms like "chatbot" (AI systems simulating conversation) and "affirmative consent" (clear permission, not hidden terms of use), and prohibits deceptive "dark patterns." The law applies to all chatbot providers within Vermont, directly affecting users who interact with these services. Key provisions mandate transparent data handling, user access to their input/output data, and strict rules against misleading consent practices.
