Vermont S 71: An act relating to eliminating the sales tax exemption for candy and using that money to support child care assistance

Bill Text

No. 145 Page 1 of 54
2026

VT LEG #390229 v.1
No. 145. An act relating to consumer data privacy and online
surveillance.
(S.71)
It is hereby enacted by the General Assembly of the State of Vermont:
Sec. 1. 9 V.S.A. chapter 61A is added to read:
CHAPTER 61A. DATA PRIVACY
Subchapter 1. Vermont Data Privacy and Online Surveillance Act
§ 2415a. SHORT TITLE AND DEFINITIONS
(a) Short title. This subchapter shall be known and may be cited as the
“Vermont Data Privacy and Online Surveillance Act.”
(b) Definitions. As used in this subchapter:
(1)(A) “Affiliate” means a legal entity that shares common branding
with another legal entity or controls, is controlled by, or is under common
control with another legal entity.
(B) As used in subdivision (A) of this subdivision (1), “control” or
“controlled” means:
(i) ownership of, or the power to vote, more than 50 percent of the
outstanding shares of any class of voting security of a company;
(ii) control in any manner over the election of a majority of the
directors or of individuals exercising similar functions; or
(iii) the power to exercise controlling influence over the
management of a company.

No. 145 Page 2 of 54
2026

VT LEG #390229 v.1
(2) “Authenticate” means to use reasonable means to determine that a
request to exercise any of the rights afforded under subdivisions 2415d(a)(1)–
(4) of this subchapter is being made by, or on behalf of, the consumer who is
entitled to exercise the consumer rights with respect to the personal data at
issue.
(3)(A) “Biometric data” means data generated from the technological
processing of an individual’s unique biological, physical, or physiological
characteristics that are collected on or used to identify a specific consumer,
including:
(i) iris or retina scans;
(ii) fingerprints;
(iii) facial or hand mapping, geometry, or templates;
(iv) vein patterns;
(v) voice prints or vocal biomarkers; and
(vi) gait or personally identifying physical movement or patterns.
(B) “Biometric data” does not include:
(i) a digital or physical photograph;
(ii) an audio or video recording; or
(iii) any data generated from a digital or physical photograph or an
audio or video recording, unless such data is generated to identify a specific
individual.
(4) “Business associate” has the same meaning as in HIPAA.

No. 145 Page 3 of 54
2026

VT LEG #390229 v.1
(5) “Child” has the same meaning as in COPPA.
(6)(A) “Collect,” “collected,” or “collection” means buying, renting,
gathering, obtaining, receiving, or accessing any personal data by any means,
other than such activities between a controller and a processor or between a
processor and its subcontractors.
(B) “Collect,” “collected,” or “collection” includes receiving data
from the consumer, either actively or passively, or by observing the
consumer’s behavior.
(7)(A) “Consent” means a clear affirmative act signifying a consumer’s
freely given, specific, informed, and unambiguous agreement to allow the
processing of personal data relating to the consumer.
(B) “Consent” may include a written statement, including by
electronic means, or any other unambiguous affirmative action.
(C) “Consent” does not include:
(i) acceptance of a general or broad terms of use or similar
document that contains descriptions of personal data processing along with
other, unrelated information;
(ii) hovering over, muting, pausing, or closing a given piece of
content; or
(iii) agreement obtained through the use of dark patterns.
(8)(A) “Consumer” means an individual who is a resident of the State.

No. 145 Page 4 of 54
2026

VT LEG #390229 v.1
(B) “Consumer” does not include an individual acting in a
commercial or employment context or as an employee, owner, director, officer,
or contractor of a company, partnership, sole proprietorship, nonprofit
organization, or government agency whose communications or transactions
with the controller occur solely within the context of that individual’s role with
the company, partnership, sole proprietorship, nonprofit organization, or
government agency.
(9) “Consumer health data” means any personal data that a controller
uses to identify a consumer’s physical or mental health condition, diagnosis, or
status, including gender-affirming health data and reproductive or sexual
health data.
(10) “Consumer health data controller” means any controller that, alone
or jointly with others, determines the purpose and means of processing
consumer health data.
(11) “Consumer reporting agency” has the same meaning as in the Fair
Credit Reporting Act, 15 U.S.C. § 1681a(f).
(12) “Controller” means a person who, alone or jointly with others,
determines the purpose and means of processing personal data.
(13) “COPPA” means the Children’s Online Privacy Protection Act of
1998, 15 U.S.C. §§ 6501–6506, and any regulations, rules, guidance, and
exemptions adopted pursuant to the act, as the act and regulations, rules,
guidance, and exemptions may be amended.

No. 145 Page 5 of 54
2026

VT LEG #390229 v.1
(14) “Cove