The Vermont legislature recently passed a data privacy measure considered one of the strongest in the country. The bill aims to crack down on companies’ use of online personal data and would allow consumers to file civil lawsuits against companies that violate certain privacy rules. The legislation prohibits the sale of sensitive data such as social security and drivers’ license numbers, financial or health information. It also sets limits on the amount of personal data companies can collect and use. More than a dozen states already have comprehensive data privacy laws, and Vermont’s is considered among the strongest in the nation.
State Rep. Monique Priestley, a Democrat and sponsor of the bill, emphasized the need for comprehensive measures to prevent gaps that can be exploited, potentially undermining the privacy protections sought by legislators. One significant aspect of the legislation is the empowerment of consumers to sue companies that violate privacy laws. This private right of action is seen as a strong deterrent to ensure compliance. However, Governor Phil Scott, a Republican, has expressed concerns about the potential impact on small businesses. The Vermont Chamber of Commerce has also raised concerns, noting that the legislation could make it harder and more expensive for businesses in the state to compete.
The bill also includes provisions aimed at protecting children, such as minimizing addictive features in products and safety liability measures. If signed by the governor, much of the legislation would take effect in 2025, with the ability for consumers to sue coming into effect in 2026 and sunsetting in 2028. There would be a study to evaluate the effectiveness and risks of the private right of action during this period. The legislation seeks to strike a balance between protecting consumers’ privacy rights and ensuring that businesses can adapt to new data privacy standards.
The Vermont legislation follows similar moves by other states, such as Maryland, which recently signed laws to better protect personal data online, including measures aimed at limiting information collected from children. The push for stronger data privacy regulations reflects growing concerns about data breaches and the misuse of personal information by tech companies. By empowering consumers to take legal action against companies that violate privacy rules, the legislation aims to hold businesses accountable and encourage compliance with data privacy regulations. The study planned for 2028 will provide valuable insights into the effectiveness and potential impact of the private right of action in safeguarding individuals’ online privacy.
