What's Happening?
Vermont has passed Senate Bill 71, a comprehensive privacy law set to take effect on January 1, 2028. This legislation regulates how businesses collect, use, disclose, sell, and protect personal data. The law applies to entities conducting business in Vermont or
targeting Vermont residents, provided they meet certain thresholds, such as controlling or processing the personal data of at least 35,000 consumers. The law includes specific provisions for consumer health data, aligning with efforts in other states to address gaps left by HIPAA. It also offers heightened protections for children and minors, particularly concerning targeted advertising and the sale of personal data. The law defines 'personal data' broadly, covering information linked to an individual or their device, while excluding deidentified data and publicly available information. Sensitive data, which includes racial, ethnic, and health information, receives additional protections.
Why It's Important?
The enactment of Vermont's privacy law is significant as it reflects a growing trend among states to enhance data protection and privacy rights for consumers. This law could influence other states to adopt similar measures, potentially leading to a more uniform approach to data privacy across the U.S. Businesses operating in Vermont will need to adjust their data handling practices to comply with the new requirements, which may involve significant changes to their data management systems. The law's focus on consumer rights, such as the ability to opt out of data processing for targeted advertising, underscores a shift towards greater consumer control over personal information. This could impact how companies engage with consumers and use data for marketing purposes.
What's Next?
As the law is set to take effect in 2028, businesses have time to prepare for compliance. The Vermont Attorney General will be responsible for enforcing the law and providing guidance to businesses. During the initial enforcement period, the Attorney General must offer a 60-day opportunity to cure potential violations before taking action. This period allows businesses to adjust their practices and ensure compliance. The law does not create a private right of action, meaning consumers cannot directly sue for violations, which may limit the immediate legal risks for businesses. However, companies will need to stay informed about any additional guidance or amendments to the law as the implementation date approaches.
