Committee reviews H.208 data privacy bill, outlining consumer rights, controller duties and limited private suits

The Vermont House Committee on Commerce & Economic Development on May 1, 2025 continued a line‑by‑line review of H.208, a proposed consumer data privacy law that would give Vermonters new rights to access, correct, delete and opt out of uses of their personal data and establish duties for entities that collect and process that data.

The bill matters because it would create defined consumer rights and compliance obligations for businesses that meet specified Vermont thresholds, set a framework for oversight by the attorney general and — in narrow circumstances — allow individual consumers to sue certain categories of data companies.

Rick Segal, legislative counsel in the Office of Legislative Council, led the committee through sections 24.18–24.25, summarizing the consumer rights H.208 would grant and the corresponding duties it would impose on controllers and processors. Segal told the committee that "a consumer shall have the right to confirm whether a controller is processing the consumer's personal data and, if they are, access that data," and he read the bill's enumerated rights, which include the ability to: know whether a consumer's data is used in an artificial intelligence system; obtain a list of third parties that have received the data; correct inaccuracies; delete personal data (including derived data) subject to legal retention requirements; and obtain a portable copy of personal data to transmit to another controller.

The bill would also allow consumers to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. Segal emphasized procedural protections in the draft: controllers would generally have 45 days to respond to consumer requests, with a single 45‑day extension…