Law / United States / 
Vermont
Vermont Data Privacy and Online Surveillance Act, sensitive data and biometric data definitions
9 V.S.A. sec. 2415a(b)(3), (47)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force in 465 days, effective 1 January 2028.
A sensitive categories rule binding private bodies.
As of 27 August 2026.
What it requires
- This provision does not bind anyone yet; it takes effect January 1, 2028.
- Once in force, treat any genetic or biometric data you collect about a Vermont consumer as sensitive data requiring opt-in consent, without needing to show the data was collected to identify that person.
- Treat a voiceprint, faceprint, vein pattern, or gait pattern you deliberately extract from a photograph, video, or audio recording to identify a specific individual as covered biometric data once the Act takes effect. Vermont's exclusion for recording-derived data does not reach data generated for that purpose.
What it reaches
Excludes recording-derived identifiersNo
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
This provision does not currently bind anyone; it takes effect January 1, 2028. As enacted, any genetic or biometric data (as defined) will be sensitive data, with no unique-identification qualifier, unlike New Hampshire's, Kentucky's, and Rhode Island's sensitive-data clauses.
"Biometric data" will list more enumerated modalities than those three states, including iris or retina scans, fingerprints, facial or hand geometry, vein patterns, voiceprints, and gait, and will exclude a photograph or recording, or data generated from one, only until that data is generated to identify a specific individual, the same clawback structure New Hampshire, Kentucky, and Rhode Island each use.
When LexLint raises it
processes_biometricsprocesses_voicecrawls_webtrains_models
Read the law
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.