Applies to persons who conducts business in the state that controlled or processed the personal data of 25,000 consumers or 12,500 consumers and derives 25% of gross revenue from the sale of personal data, decreases threshold to 6,250 by 2028; provides certain exemptions, including third party administrators, victims or witness of child abuse, domestic violence, human trafficking, and sexual assault, nonprofits established to detect and prevent fraud, certain noncommercial activities, and radio and television; provides consumer rights to confirm whether a controller is processing the consumer’s personal data, access to personal data, using or will use data in any artificial intelligence, obtain a list of third parties to which personal data is disclosed, correct inaccuracies, delete personal data, obtain a copy of personal data processed, or opt out; provides how and who may exercise rights; provides duties for controllers to limit collection and processing, provide reasonable administrative, technical, and physical data privacy practices, provide a mechanism for a consumer to withdraw consent; prohibits a controller from processing sensitive data, sell sensitive data, discriminate or retaliate, discriminate; provides duties for processors; requires a data protection assessment; provides protections for de-identified data; provides the attorney general with enforcement powers.

Exempts 501(c)(3) nonprofits from data privacy law; applies to entities that control or process the personal data of at least 100,000 consumers, excluding data used solely to complete payment transactions; applies to entities that control or process the personal data of at least 25,000 consumers and derive more than 25 percent of their revenue from the sale of personal data; exempts certain research, health care, and commercial uses of information and data; establishes consumer rights to access their data, correct inaccuracies, delete personal data, and obtain copies of personal data processed by a controller; restricts the use of children's data; requires processors and controllers to retain certain records; establishes opt-out, appeal, and complaint procedures; requires processors and controllers to maintain data security, and to provide consumers with notice of privacy practices; establishes duties of processors and regulates contracts between data controllers and processors; requires data controllers to conduct and document periodic data protection assessments, and allows the Attorney General to use the reports to assess compliance; sets rules for de-identified and pseudonymous data; enumerates permitted data uses by controllers and processors; provides for a notice of violations and opportunity to cure, with penalties for failure to cure violations after 60 days; clarifies that there is no private right of action under the Act; protects privacy of consumer health data; prohibits using a geofence to determine when consumers are near a health care facility.

Requires the Secretary of Administration to update Administrative Bulletin 5 – Policy for Grant Issuance and Monitoring to include a uniform formula and approval process for all state-funded grants for nonprofits to use an indirect rate higher than the standard de minimis rate; requires state agencies to execute grant agreements within 30 days; requires prompt payment to grantees within 30 days after receipt of a valid written request for payment; requires online form for grantees to provide notice of untimely agreements or payments; requires a publicly accessible database of nonconfidential information submitted by grantees; creates the Working Group on State Grant Processes to assess current grant awarding procedures; includes Common Good Vermont in the Working Group; requires a report.

Expands privatization contracts to grants for services of more than $25,000 per year; requires the agency to prepare a specific written statement of services proposed; requires every bid to establish a wage rate and benefits provision for each position; requires certification; requires a review; increases projected cost saving requirements from 10% to at least 20% above projected cost of using state employees for services; authorizes the attorney general to investigate whether a contract has met prospective savings of 20%.

Amends requirements for state executive agencies to enter into privatization contracts valued at $25,000 or more; requires contractors to be paid at least the prevailing wage for the comparable position in permanent state employment; requires bids to include wage and benefit information; requires the contracting agency and the Secretary of Administration to certify legal compliance, that the services meet certain quality standards, that the designated bidder does not have a record of noncompliance, and that the contract is in the public interest; creates reporting requirements for contractors; requires compliance with EEO laws; provides just cause employment and whistleblower protection for contract employees; requires state agencies to report on fiscal and operational impact of privatization contract changes.

Prohibits all employers, including nonprofits, employment agencies, labor organizations, or persons seeking employees from discriminating between employees on the basis of color, religion, ancestry, place of birth, age, or crime victim status, adding to existing categories; extends equal pay provisions to the new categories enumerated; allows wage differentials based on seniority, merit, and factors other than discrimination on the basis of protected characteristics.

Creates a right for employees to ignore communications from employers, including nonprofits, during nonworking hours; allows employers to contact employees during nonworking hours only in case of emergency or when the employee's schedule changes within 24 hours of their next assigned hours of work; requires employers to create a policy establishing the right to disconnect from employer communications during nonworking hours; prohibits employer right-to-disconnect policies from reducing employee rights to wages or time off; establishes an employee complaint mechanism for patterns of violations, with administrative penalties of not less than $100.

Restricts businesses, including nonprofits, in the use of electronic monitoring of employees and the use of automated decision systems for employment-related decisions; allows electronic monitoring if employers can demonstrate necessity, if they use the least restrictive means, involving the smallest number of employees, with tightly controlled access to data; requires notice of monitoring to employees, and specifies form and contents of notice; requires notice of electronic monitoring to be in the employee's primary language; waives notice requirements where electronic monitoring is used to produce evidence where employer reasonably suspects an employee of wrongdoing; requires employers to disclose all electronic monitoring systems to employees annually; prohibits electronic monitoring of employees in private areas, while off-duty, while exercising protected legal rights, in the employee's private home or vehicle, or to obtain information about protected characteristics, and other related contexts; restricts electronic monitoring through personal electronic devices; requires notice to employees when electronic decision systems are being used for employment-related decisions affecting employees; requires employers to create written impact assessments of using automated decision systems before using them; requires employers to protect data gathered by electronic monitoring systems; provides employees with a right to access and correct data.

Restricts the use of noncompete agreements that prohibit individuals from competing with former employers, including nonprofits; restricts the use of "stay-or-pay" provisions that require employees to repay certain costs to an employer when separating from employment; allows noncompete agreements in limited circumstances, such as sales and dissolutions of businesses; requires notice to employees that existing stay-or-pay and noncompete agreements that violate the Act are null and void.

Prohibits employers, including nonprofits, from discharging an employee for other than good cause shown; defines "good cause" as a reasonable, good-faith reason for discharge related to a legitimate business reason, including employee's failure to satisfactorily perform job duties; protects workers from discharge for arbitrary, capricious, or other non-business reasons; requires employers to post notice of this right.