Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

VT S0093: An act relating to consumer data privacy

Dead/Failed Vermont

Last verified Oct 10, 2026 · official bill text

S0093 · where it stands

This bill did not become law (dead/failed) · last action Feb 27, 2025.

What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Vermont's S.93 (2025-2026 biennium) would have enacted a consumer data privacy law applying to businesses that process personal data of at least 100,000 consumers, or at least 25,000 consumers while deriving over 25 percent of revenue from selling data. It would have given consumers rights including opting out of profiling for solely automated decisions with legal or similarly significant effects, required consent for sensitive data including biometrics, and given the Attorney General exclusive enforcement. It died in committee after referral on February 27, 2025.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None: the bill did not pass. It would have required larger data controllers to honor opt-outs of automated profiling, get consent for sensitive data and run data protection assessments.

Key provisions

  1. Applies to those controlling or processing data of at least 100,000 consumers, or 25,000 consumers with over 25 percent of gross revenue from selling personal data (Sec. 2416)
  2. Consumers may access, correct, delete and port data and opt out of targeted advertising, sales and profiling in furtherance of solely automated decisions with legal or similarly significant effects (Sec. 2418)
  3. Sensitive data, including genetic and biometric data used for unique identification, needs consent (Secs. 2415, 2420)
  4. Data protection assessments for targeted advertising, sales, certain profiling and sensitive data (Sec. 2422)
  5. Attorney General has exclusive enforcement; no private right of action; 60-day cure period through December 31, 2026 (Sec. 2425)
  6. Would have taken effect July 1, 2026 (Sec. 2). Referred to Senate Economic Development, Housing and General Affairs February 27, 2025; died in committee

Latest legislative action

Feb 27, 2025. Read 1st time & referred to Committee on Economic Development, Housing and General Affairs

Sponsors (showing 5 of 8)

NameRole
D Primary
Primary
Primary
D Cosponsor
Cosponsor

Related and companion bills

Topics and industries

Affected industries

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error