VT H0208

Creates the Vermont Data Privacy and Online Surveillance Act, giving consumers rights to access, correct, delete, and obtain copies of their personal data, plus the right to opt out of targeted advertising, data sales, and profiling

Applies initially to businesses processing data of 25,000+ Vermont consumers (or 12,500+ if deriving 25%+ revenue from data sales), with thresholds lowering over subsequent years to eventually cover businesses with 6,250+ consumers

Prohibits selling sensitive data and restricts processing of sensitive categories including biometric data, health information, precise geolocation, data from minors, and information revealing race, religion, sexual orientation, or immigration status

Requires controllers to maintain privacy notices, conduct data protection assessments for high-risk processing activities, and respond to consumer requests within 45 days

Enforcement primarily through Attorney General with civil penalties as unfair/deceptive trade practices; limited private right of action against data brokers and large data holders (100,000+ consumers) for violations involving discrimination or consumer health data confidentiality, with damages of $5,000 or actual damages