The Vermont legislature, controlled by Democrats, recently passed a strong data privacy bill aimed at regulating companies’ use of online personal data. The legislation allows consumers to file civil lawsuits against companies that violate certain privacy rules. Governor Phil Scott, a Republican, has expressed concerns about the potential impact on small businesses and has not yet made a decision on signing the bill into law. The bill prohibits the sale of sensitive data such as social security and driver’s license numbers, as well as financial or health information. It also limits the amount of personal data companies can collect and use.
Vermont’s data privacy law is considered one of the strongest in the nation, with more than a dozen states having comprehensive data privacy laws. The bill was aimed at addressing gaps in existing protections and preventing the exploitation of personal data in the surveillance economy. State Rep. Monique Priestley, a Democrat and sponsor of the bill, emphasized the urgency of the moment in protecting consumer privacy. The legislation includes provisions that allow consumers to sue companies for privacy violations, as state attorneys general may not have the resources to enforce these regulations effectively.
The Vermont Chamber of Commerce has expressed concerns about the legislation, saying it could make it harder and more expensive for businesses in the state to compete. The bill limits the ability to sue to violations committed by data brokers and large data holders, rather than small businesses. Lawmakers aimed to ensure that small businesses have time to implement data privacy policies before facing legal action. The bill also includes provisions from previous legislation focused on protecting children and minimizing addictive features in online products.
The passage of Vermont’s data privacy legislation comes on the heels of Maryland signing two laws aimed at better protecting personal data online, including limits on information collected from children. If signed by the governor, much of Vermont’s bill will go into effect in 2025, with the ability for consumers to sue taking effect in 2026 and sunsetting in 2028. A study will be conducted to evaluate the effectiveness and risks of allowing consumers to sue companies for privacy violations. The bill reflects a growing trend of states taking action to enhance data privacy protections for consumers online.
