Wire
Vermont residents could gain new rights over online tracking and data
The Vermont Data Privacy and Online Surveillance Act would set rules for how companies collect and use personal information — including biometrics, precise location data and health details — and give people ways to request access or limits.
Vermont lawmakers are considering a sweeping set of privacy rules that would give residents more control over the personal information companies collect about them online. The proposal, called the Vermont Data Privacy and Online Surveillance Act, lays out how businesses could gather, use, and share that data and what rights people would have to push back.
The measure focuses on a reality many internet users rarely see directly. Websites, apps, and connected devices routinely collect detailed information about people and their behavior. The proposal would create a statewide framework spelling out when companies can process that information and how Vermonters can request access to it or challenge its use.
At the center of the plan are several consumer rights that residents could exercise over their personal data. When someone makes a request tied to those rights, a company would first need to confirm the identity of the person making the request before acting on it.
Defining what counts as personal and sensitive data
The proposal begins by drawing detailed lines around the types of information covered by the law. It defines personal data broadly as information that can be linked to an identifiable person or even to a device connected to that person.
Lawmakers also carve out a category of sensitive data. This includes information that could reveal deeply personal details about someone’s life or identity. Examples listed in the proposal include precise location information, government identification numbers, financial account credentials, and data that could reveal a person’s health condition, citizenship status, sexual orientation, or other private characteristics.
The definition also reaches information created by analyzing other data. The proposal recognizes that companies increasingly generate predictions or inferences about people based on their activity, devices, or online behavior.
Biometric information gets special attention
Some of the most specific language focuses on biometric data. The proposal describes this as information produced by analyzing a person’s biological or physical traits to identify them. Examples include fingerprints, facial or hand geometry, iris or retina scans, vein patterns, voiceprints, and even distinctive patterns in a person’s movement or gait.
The bill draws a line between raw media and identification technology. A simple photograph or audio recording would not automatically count as biometric data. But if software analyzes that photo or recording in order to identify a specific individual, the resulting data could fall under the biometric category.
That distinction reflects growing concern among policymakers about how everyday images and recordings can be turned into identification systems once they are processed by recognition technology.
How companies connected to each other are treated