Bill
H 208
The bill creates Vermont’s Data Privacy Act establishing a consent-based framework, bans dark patterns, protects biometric and health data, and clarifies rights for Vermont residen
Status: Introduced Feb. 11, 2025; read first time and referred to the House Committee on Commerce and Economic Development. Primary sponsors: Rep. Monique Priestley and Rep. Michael Marcotte (many cosponsors).
Purpose
- Establishes a new Vermont Data Privacy and Online Surveillance Act by adding Chapter 61A to Title 9 (9 V.S.A. chapter 61A).
- Creates a statutory framework defining key terms, setting consent and transparency standards, and regulating online advertising, biometric and health-related data, and practices that impair consumer choice (e.g., “dark patterns”).
Key provisions (based on available text)
- New chapter and definitions: The bill defines foundational terms used throughout the act, including “consumer” (a Vermont resident), “controller,” “affiliate,” “data broker,” “contextual advertising,” “biometric data,” “consumer health data,” “dark pattern,” and others.
- Consent standard: “Consent” is defined as a clear, affirmative, freely given, specific, informed, and unambiguous agreement. The bill specifies required elements of a valid consent request (clear disclosure of purpose, categories of personal data, distinction between necessary processing and optional uses, accessibility for consumers with disabilities). The definition explicitly excludes consent obtained by dark patterns, broad online terms-of-use, or by inaction.
- Biometric data: Broadly defined to include iris/retina scans, fingerprints, facial/hand mapping, voice prints, gait, etc. The bill excludes ordinary photos or recordings unless data derived from them is used to identify an individual.
- Consumer health data: Defined separately (explicitly includes gender‑affirming, reproductive, and sexual health data) and a “consumer health data controller” is identified, suggesting special treatment for this category.
- Contextual advertising: Defined and distinguished from identity‑based targeted advertising. The bill references provisions that treat contextual ads differently (see §2418(g) referenced in definition).
- Dark patterns: Prohibits or calls out user interfaces that subvert or impair user autonomy or consent (aligns with FTC descriptions).
- Rights and authentication: The bill references consumer rights (subdivisions 2418(a)(1)–(6)) and requires controllers to “authenticate” requests to exercise rights—authentication means reasonable measures to ensure the requester is the consumer (text of the rights is not fully present in the excerpt).
Who would be affected
- Consumers: Vermont residents gain protections and more detailed consent/transparency expectations.
- Businesses that determine purposes/means of processing personal data (“controllers”), data brokers, advertisers, and any entity offering goods/services to Vermont residents.
- Entities handling biometric or consumer health data would face particular scrutiny and likely higher consent/transparency obligations.
- Entities covered by HIPAA and COPPA are referenced; the bill recognizes those regimes (some definitions mirror HIPAA/COPPA language), which may affect overlap/exemptions.
Procedural / timeline notes
- Current status (per provided metadata): introduced and referred to committee (Commerce & Economic Development). Committee review, hearings, and possible amendments will follow before any floor votes.
- The provided excerpt is truncated: the full bill contains additional substantive sections (e.g., §2418 and enforcement/penalty provisions) not included in the materials supplied. Those sections will determine the specific consumer rights, controller obligations, permitted sensitive-data processing rules, enforcement mechanism (e.g., Attorney General civil enforcement, private right of action), and effective dates.
Recommended next steps for readers
- Review the full text of 9 V.S.A. chapter 61A (complete bill) to confirm the specific consumer rights in §2418, the compliance obligations for controllers/processors, exemptions, enforcement provisions, and any effective dates or phase‑in schedules.
Compiled from official sources — confirm details with the bill’s official record.
Sign in to ask a question.
