Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

VT H0208: An act relating to consumer data privacy and online surveillance

Dead/Failed Vermont

Last verified Oct 10, 2026 · official bill text

H0208 · where it stands

This bill did not become law (dead/failed) · last action Feb 12, 2025.

What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Vermont's H.208 (2025-2026 biennium) would have enacted a consumer data privacy and online surveillance law applying to businesses processing data of at least 25,000 consumers, or 12,500 consumers with over 25 percent of revenue from selling data. Consumers could learn whether their data is used in an AI system and opt out of profiling for automated decisions; sensitive data including biometric and neural data would be limited. It would have taken effect July 1, 2026. It was referred to House Commerce on February 12, 2025 and died.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None: the bill did not pass. It would have required covered businesses to disclose AI use of personal data, honor profiling opt-outs and limit sensitive data, with Attorney General enforcement.

Key provisions

  1. Applies at 25,000 consumers, or 12,500 with over 25 percent of gross revenue from selling personal data, with lower thresholds in 2027 and 2028 (Secs. 2416, 3, 4)
  2. Consumers may learn whether their personal data is used in any AI system and opt out of profiling for automated decisions with legal or similarly significant effects (Sec. 2418(a)(2), (a)(7))
  3. Privacy notices must describe personal data used for AI training or use (Sec. 2419(f)); data protection assessments for risky profiling (Sec. 2421)
  4. Sensitive data, including biometric and neural data, may be processed only when strictly necessary and may not be sold (Sec. 2419(c))
  5. Attorney General enforces as unfair and deceptive acts; limited private right of action for harm from data brokers and large data holders, with the greater of $5,000 or actual damages (Sec. 2424)
  6. Sec. 1 would have taken effect July 1, 2026; lower thresholds July 1, 2027 and July 1, 2028 (Sec. 5). Died in House Commerce and Economic Development

Latest legislative action

Feb 12, 2025. Read first time and referred to the Committee on Commerce and Economic Development

Sponsors (showing 5 of 113)

NameRole
Primary
Primary
Primary
D Primary
D Cosponsor

Related and companion bills

Topics and industries

Affected industries

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error