What's Happening?
Vermont has passed the Vermont Data Privacy and Online Surveillance Act, a comprehensive consumer privacy law set to take effect on January 1, 2028. The law applies to businesses that handle personal data of at least 35,000 consumers or sensitive data of 3,000
consumers. It includes stringent data security measures, especially for health data, and prohibits geofencing near healthcare facilities. The law also mandates clear privacy notices and grants consumers rights to access, delete, and correct their data. The Attorney General will have exclusive enforcement authority, with a right to cure for businesses during the first 18 months.
Why It's Important?
Vermont's new privacy law represents a significant step in consumer data protection, setting some of the lowest thresholds for applicability among state privacy laws. It emphasizes the protection of health data and restricts certain data practices like geofencing. This law could influence other states to adopt similar measures, potentially leading to a more unified approach to data privacy in the U.S. Businesses operating in Vermont will need to adjust their data handling practices to comply with these new regulations, impacting their operational and legal strategies.
