S.71 creates and amends Vermont’s consumer data privacy framework, establishing a broad “Vermont Data Privacy and Online Surveillance Act” that gives Vermont residents rights over personal data held by businesses operating in or targeting Vermont. The bill requires covered entities to provide privacy notices, limit collection and use of personal data to what is reasonably necessary, secure consent for certain processing, and honor consumer rights to access, correct, delete, and obtain portable copies of their data. It also gives consumers the right to opt out of targeted advertising, the sale of personal data, and certain profiling that produces legal or similarly significant effects. The bill includes special protections for minors, sensitive data, consumer health data, geolocation data, biometric data, and data related to reproductive or sexual health and gender-affirming care.
The bill also imposes duties on processors and requires data protection assessments for higher-risk processing activities such as targeted advertising, sale of data, profiling, and sensitive-data processing. It restricts the use of geofencing near health care facilities to identify or track consumers for health-data purposes, and it limits the sale and processing of consumer health data. Enforcement is assigned primarily to the Attorney General, with violations treated as unfair and deceptive acts in commerce. The bill does not create a general private right of action; instead, it relies on Attorney General enforcement, although the text includes reporting requirements and, in some versions, a limited private enforcement mechanism for certain data broker or large data holder violations. The bill also phases in applicability thresholds and effective dates over time, with later amendments lowering the size thresholds for covered businesses.
The general sentiment reflected in the available record appears strongly favorable. The bill’s amendment recommendation was adopted unanimously in committee, with 29 yeas and 0 nays, suggesting broad bipartisan or at least unanimous support at that stage. The bill’s stated purpose and the accompanying intent language emphasize protecting Vermonters’ privacy while also giving businesses time and guidance to comply, which indicates an effort to balance consumer protection with implementation concerns.
The main points of contention are structural rather than ideological. The most significant issue is enforcement: the bill expressly rejects a broad private right of action and places enforcement in the Attorney General’s office, while also calling for additional resources and possibly a future privacy unit. Another area of tension is scope and compliance burden, especially for smaller businesses and for sectors that are partially or fully exempt, such as health care, financial services, education, media, and government entities. The bill also contains detailed exceptions and carveouts for research, public health, law enforcement, and certain internal uses of data, reflecting the need to balance privacy protections against operational, regulatory, and constitutional concerns.
The bill would add and amend provisions in Title 9 governing consumer privacy, creating a comprehensive state-level data privacy and online surveillance regime. It would impose new obligations on controllers and processors, require privacy notices and opt-out mechanisms, regulate sensitive and health-related data, and authorize Attorney General enforcement under the Vermont Consumer Protection Act. It also adjusts applicability thresholds over time, expanding or narrowing which businesses are covered, and includes phased effective dates and transition periods that affect when different obligations take effect for businesses and health-data controllers.
The available vote history shows overwhelming support, with the committee amendment adopted 29-0. No opposing testimony or recorded dissent is provided in the materials, and the bill’s structure suggests a consensus approach focused on consumer privacy, online surveillance limits, and health-data protections. The tone of the bill and its accompanying intent language is protective and implementation-oriented rather than punitive, indicating broad support for the policy goal alongside concern for workable enforcement and business compliance.
The biggest policy dispute is enforcement design: the bill rejects a general private right of action and instead relies on the Attorney General, which may be viewed by consumer advocates as limiting remedies but by business interests as reducing litigation risk. A second area of contention is the breadth of the law’s coverage and exemptions, including which businesses are covered, how low the thresholds should be, and how much compliance burden is appropriate for smaller firms. There is also potential tension around sensitive categories such as reproductive health, gender-affirming care, minors’ data, geofencing near health facilities, and profiling for significant decisions, because these provisions impose stricter limits on data use and may affect advertising, analytics, health-tech, and platform businesses.