VT S0071

Creates the Vermont Data Privacy Act establishing consumer rights to access, correct, delete, and obtain copies of personal data, plus opt-out rights for targeted advertising, data sales, and automated profiling decisions

Applies to businesses processing personal data of 100,000+ Vermont consumers, or 25,000+ consumers if deriving more than 25% of gross revenue from data sales

Requires controllers to obtain consent before processing sensitive data (racial/ethnic origin, health conditions, biometric/genetic data, geolocation, data from known children) and prohibits selling consumer health data without consent

Prohibits using geofences within 1,750 feet of health care facilities to track consumers, and bars targeted advertising or data sales involving minors (ages 13-16) without consent

Enforced exclusively by the Attorney General as unfair/deceptive trade practices, with a mandatory 60-day cure period for violations through December 31, 2026; effective date July 1, 2026