Vermont § 2443a - Operator prohibitions

§ 2443a. Operator prohibitions

• (a) An operator shall not knowingly do any of the following with respect to its site,
  service, or application: (1) Engage in targeted advertising on the operator’s site, service, or application or
  target advertising on any other site, service, or application if the targeting of
  the advertising is based on any information, including covered information and persistent
  unique identifiers, that the operator has acquired because of the use of that operator’s
  site, service, or application for PreK-12 school purposes. (2) Use information, including a persistent unique identifier, that is created or gathered
  by the operator’s site, service, or application to amass a profile about a student,
  except in furtherance of PreK-12 school purposes. “Amass a profile” does not include
  the collection and retention of account information that remains under the control
  of the student, the student’s parent or legal guardian, or the school. (3) Sell, barter, or rent a student’s information, including covered information. This
  subdivision (3) does not apply to the purchase, merger, or other type of acquisition
  of an operator by another entity if the operator or successor entity complies with
  this subchapter regarding previously acquired student information. (4) Except as otherwise provided in section 2443c of this title, disclose covered information, unless the disclosure is made for one or more of the
  following purposes and is proportionate to the identifiable information necessary
  to accomplish the purpose: (A) to further the PreK-12 school purposes of the site, service, or application, provided: (i) the recipient of the covered information does not further disclose the information
  except to allow or improve operability and functionality of the operator’s site, service,
  or application; and (ii) the covered information is not used for a purpose inconsistent with this subchapter; (B) to ensure legal and regulatory compliance or take precautions against liability; (C) to respond to judicial process; (D) to protect the safety or integrity of users of the site or others or the security
  of the site, service, or application; (E) for a school, educational, or employment purpose requested by the student or the student’s
  parent or legal guardian, provided that the information is not used or further disclosed
  for any other purpose; or (F) to a third party if the operator contractually prohibits the third party from using
  any covered information for any purpose other than providing the contracted service
  to or on behalf of the operator, prohibits the third party from disclosing any covered
  information provided by the operator to subsequent third parties, and requires the
  third party to implement and maintain reasonable security procedures and practices. (b) This section does not prohibit an operator’s use of information for maintaining, developing,
  supporting, improving, or diagnosing the operator’s site, service, or application. (Added 2019, No. 89 (Adj. Sess.), § 4.)