Vermont

Section 2606 makes it a crime to knowingly disclose a visual image of an identifiable person who is nude or engaged in sexual conduct, without that person's consent, with intent to harm, harass, or intimidate them, where the disclosure would cause a reasonable person to suffer harm; a second, higher tier applies where the disclosure is made with intent to profit financially.

"Visual image" expressly includes an image created or altered by digitization, and "digitization" is defined as altering an image in a realistic manner using an image or images of a person, including images of a person other than the one depicted, or computer-generated images, so the statute reaches a realistic nonconsensual sexual deepfake of an identifiable person and not only an authentic recording.

Consent to the recording of an image does not by itself constitute consent to disclose it, and a website or app operator may not accept payment to remove or refrain from posting such an image on the depicted person's request.

The section carries statutory exceptions for voluntary public or commercial nudity, disclosures in the public interest (including reporting unlawful conduct), matters of public concern, and a Communications Decency Act section 230 style carve-out for interactive computer services hosting another person's content.

The section was added in 2015 (Act No. 62), amended by 2023 Act No. 161 (adjourned session), section 45, effective June 6, 2024, and amended again by 2025 Act No. 89 (adjourned session), section 2, effective July 1, 2026; whether the digitization definition specifically originated in the 2015 enactment or was introduced by the 2023 amendment is not confirmed against the uncodified session laws, so the 2023 amendment's effective date is used here as the date the digitization provisions bind.

Act No. 156 of 2026 (H.816) adds 18 V.S.A. § 7115, which provides that a corporation or entity shall not provide, advertise, or otherwise offer mental health services, including through the use of artificial intelligence, to the public unless the mental health services meet one of two conditions. The first condition is that a mental health professional provides the mental health services.

The second condition is that the mental health services are part of an approved institutional review board or privacy board study. Mental health services are services provided to diagnose, treat, or address an individual's mental health or behavioral health through therapeutic communications and therapeutic decisions.

Artificial intelligence means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments. A violation of the section by a corporation or entity is deemed a violation of the Consumer Protection Act, 9 V.S.A. chapter 63.

The Attorney General has the same authority, and private parties have the same rights and remedies, as provided under 9 V.S.A. chapter 63, subchapter 1. A mental health professional operating within the professional's scope of practice may use artificial intelligence tools that comply with the Health Insurance Portability and Accountability Act of 1996, provided that the professional reviews and approves any mental health services.

Engaging in the prohibited use of artificial intelligence under 18 V.S.A. § 7115 is unprofessional conduct for any mental health professional under 3 V.S.A. § 129a. The act states its purpose as safeguarding individuals seeking mental health services in Vermont from psychological harm, including death by suicide, by ensuring that mental health professionals deliver these services and not artificial intelligence systems independently. The Governor signed the act on June 17, 2026. The act takes effect on passage.

Enacted as 2026 Act No. 75 (S.23), this act adds a new subchapter to Title 17's elections law defining "synthetic media" as an image, audio recording, or video recording of a person's appearance, speech, or conduct created or intentionally manipulated using digital technology, including artificial intelligence, and "deceptive and fraudulent synthetic media" as synthetic media that appears realistic and either injures a candidate's reputation or provides materially false information to influence an election.

Within 90 days before a Vermont election, a person may not publish, communicate, or distribute synthetic media it knows is deceptive and fraudulent unless the media carries a specified disclosure stating that it has been manipulated or generated by digital technology and depicts speech or conduct that did not occur, shown for the full duration of a video or read at set intervals for an audio recording.

The act exempts a bona fide newscast or news broadcast that acknowledges questions about authenticity, a periodical of general circulation that states the media does not accurately represent the person, satire or parody, and a telecommunications or interactive computer service that only carries another person's content.

A knowing and intentional violation is a civil fine of not more than $1,000.00, escalating to $5,000.00 with intent to cause violence or bodily harm, $10,000.00 for a repeat violation within five years, or $15,000.00 where both aggravating factors apply; a misrepresented candidate may separately seek injunctive relief, and the Attorney General or a State's Attorney may investigate and enforce.

The enacted text adds subchapters 4 and 5 to 17 V.S.A. chapter 35, at sections 2031 to 2033 and 2041 to 2042; it is not part of chapter 61 (Campaign Finance). The act took effect on passage, when Governor Scott signed it on March 5, 2026.

A data broker must notify a consumer of a data broker security breach affecting the consumer in the most expedient time possible and without unreasonable delay, but not later than 45 days after the discovery or notification. A data broker must notify the Attorney General of the date of the security breach and the date of discovery and provide a preliminary description of the breach within 14 business days after the data broker's discovery of the breach.

A data broker security breach is an unauthorized acquisition, or a reasonable belief of an unauthorized acquisition, of more than one instance of unencrypted, unredacted brokered personal information maintained by a data broker. A data broker need not give notice under section 2436(b) if it establishes that misuse of the brokered personal information is not reasonably possible and provides notice of that determination as section 2436(c) requires.

A person who violates section 2436 commits an unfair and deceptive act in commerce in violation of section 2453 of title 9.

A data collector that owns or licenses computerized personally identifiable information or login credentials must notify an affected Vermont consumer of a security breach in the most expedient time possible and without unreasonable delay, but not later than 45 days after discovery. Notice to the Attorney General or the Department of Financial Regulation, as applicable, is faster, with a preliminary description due within 14 business days.

The source page's own history note dates original enactment to 2005, No. 162 (Adj. Sess.), sec. 1, effective January 1, 2007, since amended in 2011, 2013 (twice), 2015, and 2019; the source page itself flags it as an unofficial online copy.

The enforcement subsection gives the Attorney General and State's Attorney sole and full authority to enforce a violation by a data collector not licensed or registered with the Department of Financial Regulation, with the remedies they hold under 9 V.S.A. chapter 63, Vermont's Consumer Fraud Act. The Attorney General's June 2020 Security Breach Notice Act Guidance states that the Act does not contain a private right of action. Act 145's own section 2415j, by contrast, expressly denies a private right of action for violations of that subchapter.

A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, which includes targeted advertising, the sale of personal data, some profiling and the processing of sensitive data. A controller that engages in profiling to make a decision that produces a legal or similarly significant effect concerning a consumer must also conduct an impact assessment for the profiling.

The Attorney General may require a controller to disclose any data protection or impact assessment that is relevant to an investigation, and the controller must make it available to the Attorney General. Data protection and impact assessments are confidential and exempt from disclosure and copying under the Public Records Act. The assessment requirements apply to processing activities created or generated after January 1, 2028, and are not retroactive. The Act that enacts the section takes effect on January 1, 2028.

As enacted, it applies to a person conducting business in Vermont, or targeting products or services to Vermont residents, that in the preceding calendar year controlled or processed the personal data of at least 35,000 consumers, controlled or processed the sensitive data of at least 3,000 consumers, or offered for sale the personal data of at least 3,000 consumers, a materially broader sweep than New Hampshire's, Kentucky's, or Rhode Island's thresholds.

Sec. 2415b(c) sets a most-protective-law-controls rule against conflicting statutes, naming the Vermont Age-Appropriate Design Code Act. Act 145 (S.71) was signed June 16, 2026, following a 2024 predecessor, H.121, that passed both chambers but was vetoed and failed a Senate override by one vote.

A person must not acquire brokered personal information through fraudulent means. A person must not acquire or use brokered personal information for the purpose of stalking or harassing another person, committing a fraud, including identity theft, financial fraud or email fraud, or engaging in unlawful discrimination, including employment discrimination and housing discrimination. The prohibitions in subsection (a) bind any person and have applied since January 1, 2019.

A person who violates the section commits an unfair and deceptive act in commerce in violation of section 2453 of title 9. The Attorney General has the same authority to adopt rules to implement the section and to conduct civil investigations, enter into assurances of discontinuance, bring civil actions and take other enforcement actions as provided under chapter 63, subchapter 1 of that title.

A data broker shall develop, implement and maintain a comprehensive information security program, written in one or more readily accessible parts, that contains administrative, technical and physical safeguards appropriate to the size, scope and type of its business, the amount of resources available to it, the amount of stored data and the need for security and confidentiality of personally identifiable information.

The safeguards must be consistent with the safeguards for protection of personally identifiable information and information of a similar character set forth in other State rules or federal regulations applicable to the data broker. The program must at minimum provide for designation of one or more employees to maintain it.

The program must at minimum identify and assess reasonably foreseeable internal and external risks to the security, confidentiality and integrity of records containing personally identifiable information, and include a process for evaluating and improving the effectiveness of the current safeguards for limiting those risks.

The program must at minimum provide for supervision of service providers by taking reasonable steps to select and retain providers capable of maintaining appropriate security measures and by requiring them by contract to implement and maintain appropriate security measures for personally identifiable information.

The program must at minimum provide for regular review of the scope of the security measures at least annually, or whenever there is a material change in business practices that may reasonably implicate the security or integrity of records containing personally identifiable information. The program must at minimum provide for documentation of responsive actions taken in connection with any incident involving a breach of security and for mandatory post-incident review of events and actions taken.

To the extent technically feasible, the program must at minimum have the computer system security elements the section lists.

Personally identifiable information means a consumer's first name or first initial and last name in combination with one or more listed digital data elements, among them a Social Security number, a driver license number and a financial account number, when the elements are not encrypted, redacted or protected by another method that renders them unreadable or unusable by unauthorized persons.

Until January 1, 2027, personally identifiable information does not mean publicly available information that is lawfully made available to the general public from federal, State, or local government records. From January 1, 2027, personally identifiable information does not include publicly available information.

From January 1, 2027, personally identifiable information does not require a consumer's first name or first initial and last name if any of the listed data elements is sufficient to perform or attempt to perform identity theft against the consumer. A person who violates the section commits an unfair and deceptive act in commerce in violation of section 2453 of title 9.

The Attorney General has the same authority to adopt rules and to conduct civil investigations, enter into assurances of discontinuance and bring civil actions as provided under chapter 63, subchapter 1 of title 9. From January 1, 2027, the Attorney General's authority to adopt rules under subdivision (d)(2) is for implementing the provisions of the section, where it was for implementing the provisions of the chapter before.

Sections 1 and 4 of Act 138 of 2026 take effect on January 1, 2027. From that date a data broker must maintain procedures that require prospective users of its brokered personal information to identify themselves, state the purposes for which the information is sought, and certify that the information shall be used for no other purpose.

Before disclosing brokered personal information to a prospective user, a data broker must make a reasonable effort to verify the identity of the prospective user and review the user's stated purposes. A data broker must not disclose brokered personal information to a prospective user if it has reasonable grounds for believing that the information will be used to violate State or federal law or will not be used for the purposes the user stated.

A person who violates the section commits an unfair and deceptive act in commerce in violation of section 2453 of title 9. The Attorney General has the same authority to adopt rules to implement the section and to conduct civil investigations, enter into assurances of discontinuance, bring civil actions and take other enforcement actions as provided under chapter 63, subchapter 1 of that title.

A data broker is a business, or unit or units of a business, that knowingly collects and sells or licenses to third parties the brokered personal information of a consumer with whom the business does not have a direct relationship. Brokered personal information is a listed set of computerized data elements about a consumer, among them name, address, date of birth, biometric data and Social Security number, if categorized or organized for dissemination to third parties.

Brokered personal information does not include publicly available information to the extent that it is related to a consumer's business or profession.

Developing or maintaining third-party e-commerce or application platforms, providing directory assistance or directory information services for a telecommunications carrier, and providing publicly available information related to a consumer's business or profession or via real-time or near-real-time alert services for health or safety purposes do not make a business a data broker.

Each year, on or before January 31 following a year in which a person meets the definition of data broker, the data broker must register with the Secretary of State and pay a registration fee of $100.00. The registration must state whether the data broker implements a purchaser credentialing process and the number of data broker security breaches it experienced during the prior year.

Where the data broker has actual knowledge that it possesses the brokered personal information of minors, the registration must include a separate statement detailing the practices, databases, sales activities and opt-out policies that apply to that information.

A data broker that fails to register is liable to the State for a civil penalty of $50.00 for each day, not to exceed a total of $10,000.00 for each year, plus an amount equal to the fees due for the period and other penalties imposed by law. The Attorney General may maintain an action in the Civil Division of the Superior Court to collect the penalties and to seek appropriate injunctive relief.

Sections 1 and 4 of Act 138 of 2026 take effect on January 1, 2027. Brokered personal information means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household.

Brokered personal information does not include publicly available information. Publicly available information means information made available through federal, state or local government records or to the general public from widely distributed media, or that a data broker has a reasonable basis to believe the consumer has lawfully made available to the general public.

Publicly available information does not include biometric data collected by a business about a consumer without the consumer's knowledge, any obscene visual depiction, genetic data unless the consumer made it publicly available, or intimate images known to be nonconsensual.

A consumer has a direct relationship with a business only where the consumer has intentionally interacted with the business for the purpose of accessing, purchasing, using, requesting or obtaining information about its products or services. A consumer does not have a direct relationship with a business if the purpose of the consumer's engagement is to exercise a consumer right or for the business to verify the consumer's identity.

A business is still a data broker as to the brokered personal information it sells about a consumer that it collected outside of a first-party interaction with the consumer. A data broker must register with the Secretary of State not more than 30 days after meeting the definition of a data broker and then once annually on or before July 1, pay a registration fee of $900.00 and maintain a bond of $20,000.00 that runs to the State for any liability arising under the subchapter.

The registration must state whether the data broker collects the mobile advertising identification number, connected television identification number or vehicle identification number of consumers. The registration must also state whether, in the past year, the data broker has shared consumers' data with or sold it to a foreign actor, the federal government, other state or local governments, law enforcement unless under a subpoena or other court order, or a developer of a GenAI system or model.

A data broker that fails to register is liable to the State for an administrative fine of $200.00 for each day, the fees that were due, and any reasonable costs incurred by the State in the investigation and administration of the action as the court deems appropriate.

A data broker that fails to provide all required registration information must file an amendment not later than 30 days after discovering or receiving notification of the omission and is liable for a civil penalty of $1,000.00 per day thereafter. A data broker that files materially incorrect information in its registration is liable to the State for a civil penalty of $25,000.00 and must correct it within 30 days, or owe an additional $1,000.00 for each day it fails to correct it.

A person who violates the section commits an unfair and deceptive act in commerce in violation of section 2453 of title 9, and the Attorney General has the authority to conduct civil investigations, enter into assurances of discontinuance and bring civil actions as provided under chapter 63, subchapter 1 of that title. The Secretary of State must maintain a public page with a downloadable spreadsheet of the data brokers that have registered and the information each provided.

In the subchapter a consumer is an individual residing in Vermont and does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer or contractor of a company, partnership, sole proprietorship, nonprofit organization or government agency whose communications or transactions with the data broker occur solely within the context of that individual's role.

As enacted, sec. 2415d grants access (including a right to know about profiling used for legal or significant-effect decisions), correction, deletion, portability, opt-out of targeted advertising, sale, and profiling, a profiling-specific explanation and correction-and-reevaluation right for housing decisions, and a right to a list of third parties personal data was sold to, a broader rights list than New Hampshire, Kentucky, or Rhode Island.

A controller must respond without undue delay and not later than 45 days after receipt, with one 45-day extension available.

As enacted, a violation is a violation of the Vermont Consumer Protection Act, enforced solely by the Attorney General, with a mandatory 60-day cure notice from January 1, 2028 through June 30, 2029 under the Act's uncodified Sec. 3.

Sec. 2415j and the Act's uncodified Sec. 2 both state the Act creates no private right of action, and Sec. 2's intent language frames this as a deliberate legislative choice made contingent on the Attorney General receiving adequate enforcement resources, not an oversight. Secondary summaries describing the enacted law as including a limited private right of action for consumers are wrong: the Act's own text, quoted here, controls, and that claim is not carried.

A person doing business in Vermont as a provider of an educational technology product must, at the time of a filing with the Secretary of State, provide its contact details, a link to the most recent privacy policy and terms and conditions of each product in use in any school, the schools where it operates under a paid contract, a description of each product, and an attestation that each product meets the student privacy subchapter, the Vermont Age-Appropriate Design Code Act and all relevant federal and State privacy laws, including the federal Children's Online Privacy Protection Act.

An educational technology product is any software, application or platform that may collect, process or transmit student data and that is used for teaching and learning purposes in a school in Vermont. Section 2444a takes effect on January 1, 2027.

A direct-to-consumer genetic testing company is an entity that sells, markets, interprets or otherwise offers consumer-initiated genetic testing products or services directly to consumers, analyzes genetic data obtained from a consumer other than through a person licensed in the healing arts for diagnosis or treatment of a medical condition, or collects, uses, maintains or discloses genetic data collected or derived from such a product or service.

A direct-to-consumer genetic testing company must obtain a consumer's express consent for the collection, use and disclosure of the consumer's genetic data, with separate and express consent for each of the uses section 2421b(a)(2) lists.

A direct-to-consumer genetic testing company must make available a plain-language summary of its privacy practices and a prominent and easily accessible privacy notice covering its data collection, consent, use, access, disclosure, maintenance, transfer, security, and retention and deletion practices.

A direct-to-consumer genetic testing company must honor a consumer's revocation of consent as soon as practicable and not later than 30 days after the revocation, and must destroy the consumer's biological sample not later than 30 days after receiving a revocation related to its storage or use.

A direct-to-consumer genetic testing company must implement and maintain reasonable security procedures and practices to protect a consumer's genetic data against unauthorized access, destruction, use, modification or disclosure. A direct-to-consumer genetic testing company must develop procedures and practices that let a consumer easily access the consumer's genetic data, delete the consumer's account and genetic data, and have the consumer's biological sample destroyed.

Genetic data and biological samples of consumers may not be stored in a country sanctioned by the Office of Foreign Assets Control or designated a foreign adversary, and may be transferred or stored outside the United States only with the consumer's express consent. A direct-to-consumer genetic testing company must obtain separate and express consent for each use of genetic data or the biological sample beyond the primary purpose of the genetic testing or service.

Section 2421b(f) bars a person or public entity from discriminating against a consumer because the consumer exercised any of the consumer's rights under the subchapter. A direct-to-consumer genetic testing company may not disclose a consumer's genetic data to an entity responsible for administering or making decisions about health, life, long-term care or disability insurance or employment, or to an entity that advises one.

A direct-to-consumer genetic testing company or service provider that violates the subchapter commits an unfair and deceptive act in commerce in violation of section 2453 of title 9. Before a consumer initiates a civil action under section 2421c, the consumer must send the company or service provider a written notice that includes as many details as possible of the alleged violation. The pre-suit notice and cure period in section 1a of Act 135 of 2026 is repealed on June 30, 2028.

The Genetic Information Privacy Act does not apply to protected health information collected, maintained, used or disclosed by a covered entity or business associate governed by the federal health privacy, security and breach notification rules.

No policy of insurance offered for delivery or issued in Vermont may be underwritten or conditioned on the basis of any requirement or agreement of the individual to undergo genetic testing, or the results of genetic testing of a member of the individual's family. A violation of section 9334 is an unfair method of competition or unfair or deceptive act or practice in the business of insurance in violation of section 4724 of title 8.

A person who violates section 9334 is also subject to the enforcement provisions available under title 8. Insurance means a policy of insurance regulated under title 8, offered or issued in Vermont, including health, life, disability and long-term care insurance policies, hospital and medical service corporation service contracts, and health maintenance organization benefit plans.

A person who intentionally violates subsection 9334(a) shall be imprisoned not more than one year or fined not more than $10,000.00, or both.

No person may, directly or indirectly, use the fact that genetic counseling or testing services were requested or that genetic testing was performed, use genetic testing results or genetic information from a person or a family member, use a diagnosis of a genetic disease derived from a clinical interview and examination, or require genetic testing, as a condition of or to affect the terms, conditions or privileges of employment, membership in a labor organization, or professional licensure, certification or registration.

Employment includes application for employment, and section 9333 does not prohibit use of genetic testing results or genetic information in connection with life, disability income or long-term care insurance provided under an employee benefit plan, subject to the underwriting limitations of section 9334.

No person may disclose to an employer, labor organization, employment agency or licensing agency any genetic testing results or genetic information, that genetic services have been requested, or that genetic testing has been performed, with respect to an employee, labor organization member, professional licensee, certificate holder or registrant.

A person who intentionally violates section 9333 or subsection 9334(a) shall be imprisoned not more than one year or fined not more than $10,000.00, or both. A person aggrieved by a violation of the chapter may bring an action for civil damages, including punitive damages, equitable relief, restitution of wages or other benefits, reinstatement, costs and reasonable attorney's fees, and other appropriate relief.

No person may be required to undergo genetic testing except as chapter 217 of title 18 provides. Under section 9332(d) of title 18, except in the cases subsection (b) lists, genetic testing may not be performed on an individual, and bodily materials may not be released for genetic testing, without the individual's prior written authorization and informed consent, apart from medical research under the conditions subsection (d) states.

Under section 9332(e) of title 18, except in the cases subsection (b) lists, the results of genetic testing, or the fact that an individual has requested genetic services or undergone genetic testing, may be disclosed only under a written authorization executed by the individual tested or by a person authorized by law to act for the individual.

Under section 9332(f) of title 18, when suggesting or requesting that an individual consent to genetic testing, the person must advise the individual that the results may become part of the individual's permanent medical record and may be material to the ability to obtain certain insurance benefits.

In chapter 217 of title 18, genetic testing means a test, examination or analysis that is diagnostic or predictive of a particular heritable disease or disorder and is of a human chromosome or gene, human DNA or RNA, or a human genetically encoded protein. A person aggrieved by a violation of the chapter may bring an action for civil damages, including punitive damages, equitable relief, costs and reasonable attorney's fees, and other appropriate relief.

A covered entity or business associate may not disclose protected health information unless the disclosure is permitted under the federal Health Insurance Portability and Accountability Act of 1996. Act 169 of 2016, which added section 1881 to title 18, barred a covered entity from disclosing protected health information unless the disclosure is permitted under the federal Health Insurance Portability and Accountability Act of 1996.

Section 14 of Act 15 of 2023 amended section 1881, including subsection (b). Section 14 of Act 15 of 2023 took effect on May 10, 2023. Covered entity and business associate have the meanings given in section 160.103 of title 45 of the Code of Federal Regulations. Protected health information has the meaning given in section 160.103 of title 45 of the Code of Federal Regulations.

Except as subdivision (2) provides, a covered entity or business associate may not disclose identifiable protected health information related to a legally protected health care activity to a government entity other than the State of Vermont or its political subdivisions or instrumentalities if it has reason to believe the information will be used to investigate any individual for the mere act of seeking, obtaining, providing or facilitating that activity.

Identifiable protected health information related to a legally protected health care activity may not be disclosed for use in a civil or criminal action, a proceeding preliminary to a civil or criminal action, or a probate, legislative or administrative proceeding, except as subdivision (2) provides.

A covered entity or business associate may disclose identifiable protected health information related to a legally protected health care activity where the patient or the patient's conservator, guardian or other authorized legal representative authorizes it, or where another condition in subdivision (2) is met.

A covered entity or business associate is not subject to any civil, criminal or administrative liability or professional disciplinary action for refusing to disclose such information in accordance with subsection (c). Section 6 of Act 20 of 2025 amended section 1881, including subsection (c). Act 20 of 2025 took effect on passage and was signed May 13, 2025. Section 1881 was amended by Act 15 of 2023, effective May 10, 2023, and by Act 20 of 2025, effective May 13, 2025.

Except as subsection (c) provides, a business may not intentionally make an individual's Social Security number available to the general public, intentionally print or imbed it on an access card, require its transmission over the Internet unless the connection is secure or the number is encrypted, require its use to access an Internet website without a password or other authentication device, print it on materials mailed to the individual, or disclose it to a third party without written consent when it knows or should know the third party lacks a legitimate purpose.

Section 2440(b) does not apply when a Social Security number is included in an application or in documents related to an enrollment process, or to establish, amend or terminate an account, contract or policy.

The State, a State agency or political subdivision, and an agent or employee of the State may not collect a Social Security number from an individual unless authorized or required by law, State or federal regulation or grant agreement, or unless the collection is related to the performance of the agency's duties and responsibilities as prescribed by law.

A person has the right to ask a town clerk or clerk of court to remove from an image or copy of an official record placed on a publicly available Internet website the person's Social Security number and the other identifiers section 2440(f) lists.

The Attorney General and State's Attorney have sole and full authority to investigate, enforce, prosecute, obtain and impose remedies for violations of the subchapter, as they have under chapter 63 of title 9, by businesses and by the State, State agencies and political subdivisions, other than a person or entity licensed or registered with the Department of Financial Regulation.

The Department of Financial Regulation has full authority to investigate and enforce violations of the subchapter by a person or entity licensed or registered with the Department under title 8 or title 9.

An operator is the operator of an Internet website, online service, online application or mobile application with actual knowledge that it is used primarily for PreK-12 school purposes and was designed and marketed for PreK-12 school purposes.

An operator may not knowingly engage in targeted advertising on its site, service or application, or on any other, based on information, including covered information and persistent unique identifiers, acquired because of the use of its site, service or application for PreK-12 school purposes. An operator may not knowingly use information created or gathered by its site, service or application to amass a profile about a student, except in furtherance of PreK-12 school purposes.

An operator may not knowingly sell, barter or rent a student's information, including covered information, except in the purchase, merger or other acquisition of the operator by another entity that complies with the subchapter for previously acquired student information. An operator may not knowingly disclose covered information unless the disclosure is made for one of the purposes section 2443a(a)(4) lists and is proportionate to the identifiable information necessary to accomplish the purpose.

An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, delete a student's covered information within a reasonable time if the school or school district requests deletion, and publicly disclose and provide the school with material information about its collection, use and disclosure of covered information.

Subchapter 3A of chapter 62 of title 9 does not apply to general audience Internet websites, online services, online applications or mobile applications, even if login credentials created for an operator's site, service or application may be used to access them. Until January 1, 2027, a person who violates a provision of chapter 62 of title 9 commits an unfair and deceptive act in commerce in violation of section 2453 of title 9.

From January 1, 2027, section 2443f(b) gives the Attorney General the same authority to adopt rules, conduct civil investigations, enter into assurances of discontinuance and bring civil actions as chapter 63, subchapter 1 of title 9 provides.

As enacted, sensitive data means personal data that includes data revealing racial or ethnic origin, religious beliefs, sex life, sexual orientation, status as nonbinary or transgender, or citizenship or immigration status; data revealing a mental or physical health condition, diagnosis, disability, or treatment; consumer health data; genetic or biometric data or information derived therefrom; personal data collected from an individual the controller has actual knowledge, or willfully disregards, is a child; precise geolocation data; neural data; a consumer's financial account number, financial account login information, or credit card or debit card number that, in combination with any required access or security code, password, or credential, would allow access to a consumer's financial account; and a government-issued identification number, including, but not limited to, Social Security number, passport number, State identification card number, or driver's license number, that applicable law does not require to be publicly displayed.

Genetic or biometric data carries no unique-identification qualifier, unlike New Hampshire's, Kentucky's, and Rhode Island's sensitive-data clauses.

"Biometric data" lists more enumerated modalities than those three states, including iris or retina scans, fingerprints, facial or hand geometry, vein patterns, voiceprints, and gait, and excludes a photograph or recording, or data generated from one, only until that data is generated to identify a specific individual, the same clawback structure New Hampshire, Kentucky, and Rhode Island each use.

Section 4102 makes it unlawful for a person to knowingly and intentionally and without lawful authority access any computer, computer system, computer network, computer software, computer program, or data contained in one, punishable as a misdemeanor by up to six months' imprisonment or a $500.00 fine, or both.

Unlike Virginia's computer trespass statute, section 4102 carries no built-in exception for conduct that lacks malicious intent or a deceptive means; it is a bare without-lawful-authority test closer to the federal Computer Fraud and Abuse Act's own wording.

Related offenses in the same chapter reach access for fraudulent purposes (section 4103), alteration, damage, or interference (section 4104), and theft or destruction (section 4105), each requiring an additional element (a fraud scheme, or actual damage, deletion, or taking) that ordinary, non-disruptive automated collection does not supply on its own; penalties for those sections escalate with the value of the loss, up to ten years' imprisonment and a $25,000.00 fine where the loss or value exceeds $500.00.

A person damaged by a violation of the chapter may bring a civil action for damages, costs, and reasonable attorney's fees under section 4106. Its history note names 1999, No. 35, § 1 as the act that added it. No day on which that act came into force has been located.

Each licensee must develop, implement, and maintain a comprehensive written information security program that is based on the licensee's risk assessment and contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.

A licensee is a person licensed, authorized to operate, or registered or required to be licensed, authorized, or registered pursuant to the insurance laws of Vermont, but not a captive insurance company, a purchasing group or risk retention group chartered, or a licensee domiciled in another jurisdiction that is acting as an assuming insurer for a licensee domiciled in Vermont.

A licensee must establish, as part of its information security program, a written incident response plan designed to promptly respond to and recover from any cybersecurity event. Each insurer domiciled in Vermont must annually submit to the commissioner, on or before April 15, a written statement certifying that the insurer is compliant with the requirements of the subsection.

A licensee that learns that a cybersecurity event has or may have occurred must conduct a prompt investigation, or have a designated outside vendor or service provider conduct it. A licensee with fewer than 20 employees, including any independent contractors, is exempt from subsection (d) of the section. A licensee has one year from the effective date of the section to implement subsection (d), other than subdivision (d)(6), and two years to implement subdivision (d)(6).

The section takes effect on January 1, 2023. A licensee that violates the section may be penalized in accordance with section 3661 or 4726 of Title 8, as appropriate.

A business must take all reasonable steps to destroy or arrange for the destruction of a customer's records within its custody or control that contain personal information no longer to be retained, by shredding, erasing or otherwise modifying the personal information to make it unreadable or indecipherable, for the purpose of ensuring the security and confidentiality of the information, protecting against anticipated threats or hazards to its security or integrity, and protecting against unauthorized access to or use of it that could cause substantial harm or inconvenience to a customer.

A business is defined to include any sole proprietorship, partnership, corporation, association, limited liability company or other group however organized and whether or not operated for profit, including a financial institution, but never the State, a State agency or a political subdivision of the State.

An entity in the business of disposing of personal financial information that conducts business in Vermont, or that disposes of Vermont residents' personal information, carries the same duty as to the information it handles on another business's behalf, by implementing and monitoring policies and procedures that protect against unauthorized access during and after collection, transportation and disposal.

The duty is limited to disposal, imposing no ongoing obligation to safeguard personal information that remains in active use, and it does not apply to a bank, credit union or other financial institution already subject to the Gramm-Leach-Bliley Act's privacy and security provisions, a health insurer or facility already compliant with Health Insurance Portability and Accountability Act (HIPAA)'s privacy and security standards, or a consumer reporting agency already compliant with the Fair Credit Reporting Act.

The Attorney General and State's Attorneys have sole enforcement authority over a business not licensed or registered with the Department of Financial Regulation, and the Department of Financial Regulation has authority over one that is; both prosecute a violation and obtain remedies as the Attorney General and State's Attorneys have under Vermont's Consumer Protection Act, chapter 63 of this title, which sets a civil penalty of up to $10,000.00 for each unfair or deceptive act or practice in commerce.

The section does not itself declare a violation an unfair and deceptive act under 9 V.S.A. section 2453 the way the data-broker security duty at section 2447 does, so whether the Consumer Protection Act's private right of action, 9 V.S.A. section 2461(b), reaching damages caused by practices prohibited by section 2453, extends to a violation of this section is not settled by the text read here.

Requires covered businesses offering online services, products, or features reasonably likely to be accessed by minors under 18 to minimize collection and use of covered minors' personal data, refrain from using minors' data in algorithmic recommendation systems except at the minor's request, bar unsignaled monitoring or location tracking of minors, prohibit push notifications to minors between midnight and 6:00 a.m., and protect age assurance data. Violations are unfair and deceptive acts in commerce under 9 V.S.A. section 2453.