Law note · Vermont
Vermont Data Privacy and Online Surveillance Act, sensitive data and biometric data definitions
This provision does not currently bind anyone; it takes effect January 1, 2028. As enacted, any genetic or biometric data (as defined) will be sensitive data, with no unique-identification qualifier, unlike New Hampshire's, Kentucky's, and Rhode Island's sensitive-data clauses.
"Biometric data" will list more enumerated modalities than those three states, including iris or retina scans, fingerprints, facial or hand geometry, vein patterns, voiceprints, and gait, and will exclude a photograph or recording, or data generated from one, only until that data is generated to identify a specific individual, the same clawback structure New Hampshire, Kentucky, and Rhode Island each use.
What it asks of an app
- This provision does not bind anyone yet; it takes effect January 1, 2028.
- Once in force, treat any genetic or biometric data you collect about a Vermont consumer as sensitive data requiring opt-in consent, without needing to show the data was collected to identify that person.
- Treat a voiceprint, faceprint, vein pattern, or gait pattern you deliberately extract from a photograph, video, or audio recording to identify a specific individual as covered biometric data once the Act takes effect. Vermont's exclusion for recording-derived data does not reach data generated for that purpose.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web, trains_models
Primary source: official Vermont session law text, 2026 Vt. Acts & Resolves Act 145 (S.71) as enacted, Vermont Legislature website