VT H0812

Establishes the "Vermont Duty of Data Loyalty Act" requiring covered entities to owe a duty of loyalty to consumers, prohibiting data collection, processing, or transfer that conflicts with consumers' best interests

Imposes strict data minimization requirements, limiting collection to what is strictly necessary for providing requested products/services or pursuing legitimate business interests, and bans cross-context behavioral advertising

Grants consumers rights to access, correct, delete, and export their personal data, with covered entities required to respond within 45-60 days depending on company size

Requires "large data holders" (entities with $250 million+ annual revenue handling data of 5,000+ individuals) to conduct biennial data loyalty assessments, designate privacy protection officers, and have executives certify compliance annually

Prohibits discriminatory data practices based on race, religion, sex, disability, and national origin; mandates algorithmic impact assessments for covered algorithms posing consequential harm risks; effective January 1, 2027