Data Privacy, Technology and AI
Few issues generated more debate during the 2025-2026 biennium than data privacy and artificial intelligence. After extensive negotiations, lawmakers adopted new consumer privacy protections, expanded oversight of data brokers, and established guardrails for emerging technologies. The final package reflects a compromise between advocates seeking stronger privacy rights and business groups concerned Vermont could become a regulatory outlier, resulting in frameworks generally aligned with neighboring states and existing federal laws.
S.71 – Vermont Data Privacy and Online Surveillance Act
After two years of debate, S.71 establishes Vermont’s first comprehensive consumer data privacy law. The bill grants consumers rights to access, correct, delete, and obtain copies of personal data, as well as opt out of targeted advertising, data sales, and certain automated profiling activities. It also requires businesses subject to the law to provide privacy notices, obtain consent for certain uses of sensitive data, honor universal opt-out mechanisms, conduct data protection assessments, and maintain reasonable security practices.
The final version moved substantially from earlier proposals and more closely aligns Vermont with privacy frameworks adopted in neighboring states. The law includes exemptions for insurers, financial institutions, HIPAA-regulated entities, educational records, employment data, and other federally regulated information. Enforcement authority rests exclusively with the Attorney General, with no private right of action. The law takes effect January 1, 2028, with a temporary cure period through June 2029.
H.211 – Data Broker Regulation
H.211 significantly expands Vermont’s regulation of data brokers. The bill broadens the definition of both “data broker” and “brokered personal information,” increases registration requirements, raises annual registration fees from $100 to $900, requires a $20,000 surety bond, and expands public disclosure requirements regarding the types of personal information brokers collect, sell, and share. Penalties for noncompliance were also strengthened.
The Legislature ultimately rejected a proposed statewide consumer data deletion mechanism and instead directed the Secretary of State to study the feasibility of a California-style deletion system. The bill also incorporates provisions creating an educational technology product registry, while omitting broader AI and chatbot-related provisions that had been proposed earlier in the process.
H.211 | H.650 EdTech Registry
Vermont’s educational technology registry began as H.650, a stand-alone bill that would have created what was widely described as a likely first-in-the-nation statewide edtech certification and registry system. As the bill moved through the Senate, the certification requirement was dropped and replaced with a registry coupled with a proposed two-year moratorium on AI chatbots in schools, subject to school-level exemptions. By the end of the session, the chatbot moratorium had also been removed, leaving only the registry provisions, which were ultimately folded into H.211, the broader data broker and privacy bill.
The final bill defines an educational technology product as software, applications, or platforms used for teaching and learning that may collect, process, or transmit student data, while expressly excluding hardware and products being used in a school without the provider’s knowledge. Providers must register with the Secretary of State and disclose information about their products, privacy policies, school customers, and compliance with state and federal student privacy laws. The registry provisions take effect July 1, 2026, with implementation work beginning immediately thereafter by Secretary of State. The legislation reflects a broader national reckoning over educational technology, student data privacy, AI, and digital learning tools. Legislators and stakeholders have already indicated that an informal interim working group will continue discussions on these issues, and additional legislation addressing educational technology and AI in schools is expected next session.
H.639 – Genetic Data Privacy Act
H.639 establishes privacy protections for consumers using direct-to-consumer genetic testing services. The bill requires consumer consent for various uses of genetic information, provides rights related to access and deletion of genetic data, and imposes security and transparency requirements on covered companies. The final bill includes a pre-suit cure process allowing companies an opportunity to address alleged violations before litigation may proceed.
H.814 – Neurological Rights and Artificial Intelligence
H.814 establishes a statement of neurological rights in Vermont law, including protections related to neural data privacy, freedom of thought, and protection from unauthorized neurotechnological interventions. The bill also extends the Artificial Intelligence Advisory Council through 2030 and directs further study of AI applications in health care, education, insurance, human services, and government operations.
H.816 – Artificial Intelligence and Mental Health Services
H.816 prohibits AI systems from independently providing mental health treatment, counseling, or therapeutic services without the involvement of a qualified mental health professional. Licensed providers may continue to use AI-assisted tools if they remain responsible for reviewing and approving services provided to patients. The bill also directs regulators to recommend future standards governing AI use within licensed professions.
