Vermont Enacts Comprehensive Privacy Law Affecting Data Collection and Protection
Vermont has passed Senate Bill 71, a comprehensive privacy law set to take effect on January 1, 2028. This legislation regulates how businesses collect, use, disclose, sell, and protect personal data. The law applies to entities conducting business in Vermont or targeting Vermont residents, provided they meet certain thresholds, such as controlling or processing the personal data of at least 35,000 consumers. The law includes specific provisions for consumer health data, aligning with efforts in other states to address gaps left by HIPAA. It also offers heightened protections for children and minors, particularly concerning targeted advertising and the sale of personal data. The law defines 'personal data' broadly, covering information linked to an individual or their device, while excluding deidentified data and publicly available information. Sensitive data, which includes racial, ethnic, and health information, receives additional protections. 
