Vermont H 630: An act relating to adopting minimum security standards for connected devices

Bill Text

BILL AS INTRODUCED H.630
2026 Page 1 of 3

VT LEG #386333 v.1
H.630 1
Introduced by Representative Rachelson of Burlington 2
Referred to Committee on 3
Date: 4
Subject: Commerce and trade; data security; connected devices 5
Statement of purpose of bill as introduced: This bill proposes to require that 6
connected devices sold in Vermont meet minimum security standards. 7
An act relating to adopting minimum security standards for connected 8
devices 9
It is hereby enacted by the General Assembly of the State of Vermont: 10
Sec. 1. 9 V.S.A. § 2433 is added to read: 11
§ 2433. CONNECTED DEVICES; MINIMUM SECURITY STANDARDS 12
(a) Requirements. A business shall not sell or deliver into this State any 13
consumer electronic product that is capable of connecting to the internet, or to 14
other electronic products that are capable of connecting to the internet, unless 15
the product meets the following minimum security standards: 16
(1) Encrypted communications. The product shall use encryption for its 17
network communication functions and capabilities to ensure that its 18
communications are not eavesdropped on or modified in transit. 19

BILL AS INTRODUCED H.630
2026 Page 2 of 3

VT LEG #386333 v.1
(2) Security updates. 1
(A) The product shall support automatic updates for a reasonable 2
period after sale, and shall be enabled by default, to ensure that when a 3
vulnerability is known, the business can make security updates available for 4
consumers that are verified using a form of cryptography and installed 5
seamlessly. 6
(B) An update shall not make the product unavailable to a consumer 7
for an extended period of time. 8
(3) Strong passwords. 9
(A) If the product uses passwords for remote authentication, it shall 10
require that strong passwords are used, including having password strength 11
requirements. 12
(B) Any nonunique default passwords shall be reset as part of the 13
device’s initial setup to protect the device from vulnerability to guessable 14
password attacks. 15
(4) Vulnerability management. The business shall have a system in 16
place to manage vulnerabilities in the product, which shall include a point of 17
contact for reporting vulnerabilities to ensure that vendors are actively 18
managing vulnerabilities throughout the product’s lifecycle. 19

BILL AS INTRODUCED H.630
2026 Page 3 of 3

VT LEG #386333 v.1
(5) Privacy practices. 1
(A) The product shall have a privacy policy that is easily accessible, 2
written in language that is easily understood, and appropriate for the person 3
using the device or service. 4
(B) The business shall notify consumers about substantive changes to 5
the policy of the product. 6
(C) The business shall disclose if it collects, transmits, or shares data 7
collected by the product for marketing purposes and shall provide the right to 8
opt-out of such practices. 9
(D) The business shall permit consumers to delete their data and 10
account that are related to the product and shall adopt a policy setting standard 11
retention periods for consumer data. 12
(b) Enforcement. A business that violates this section commits an unfair 13
and deceptive act in commerce in violation of section 2453 of this title. 14
Sec. 2. EFFECTIVE DATE 15
This act shall take effect on July 1, 2026. 16