It is hereby enacted by the General Assembly of the State of Vermont:
Sec. 1. 9 V.S.A. chapter 62 is amended to read:
CHAPTER 62. PROTECTION OF PERSONAL INFORMATION
Subchapter 1. General Provisions
* * *
Section 2432. FACIAL AND VOICE RECOGNITION
(a) With respect to a consumer, a person:
(1) shall not scan the face of a non-user in a photograph;
(2) shall not use facial or voice recognition technology unless a consumer opts in to the use of the technology;
(3) shall not use facial or voice recognition technology for a purpose other than product development;
(4) shall not use for marketing purposes a listening feature that stores conversations;
(5) shall delete quality enhancement data after 21 days; and
(6) shall disclose the use of facial recognition technology on a clear and conspicuous, physical sign at the entrance of a business location that uses the technology.
(b) A person who violates this section commits an unfair and deceptive act in commerce in violation of section 2453 of this title.
Section 2433. DATA PRIVACY
(a) A business that operates a social networking service:
(1) shall provide to a consumer that closes his or her account the option to permanently delete the consumer's personally identifiable information from the business's databases and records; and
(2) if a consumer exercises the option pursuant to subdivision (1) of this subsection, the business:
(A) shall delete the consumer's personally identifiable information in a commercially reasonable time; and
(B) shall not sell or exchange the consumer's personally identifiable information.
(b) A business that collects data about a consumer:
(A) the average monetary value to the business of a consumer's data; and
(B) how the business uses consumer data that is not directly related to the service the business provides;
(2) shall not sell or exchange global positioning system data about a consumer that is collected by a mobile telephone service provider.
Section 2434. DATA PRIVACY OF MINORS; CONSENT
A person that operates an internet website, online service, online application, or mobile application:
(1) shall obtain consent from a parent or guardian to use facial or voice recognition technology and to collect or use any data if a user is under 18 years of age;
(2) shall obtain consent from a parent or guardian to create an account if a user is under 13 years of age; and
(3) if the website, service, or application is directed to minors, shall not use the personal information of a minor to direct content to the minor, or a group of individuals who are similar, based upon the minor's actual or perceived race, ethnicity, religion, physical or mental disability, medical condition, gender identity, gender expression, sexual orientation, sex, socioeconomic background, or any other factor used to identify those traits.
* * *
Sec. 2. EFFECTIVE DATE
This act shall take effect on July 1, 2020.