Vermont's Data Privacy Law Faces Opposition From Big Tech

Vermont is nearing the implementation of their new data privacy law, known as House Bill 121 or the Vermont Data Privacy Act (VDPA). The bill was passed with unanimous approval in the House of Representatives on May 10, 2024 and is still awaiting the signature of the state’s governor, Phil Scott. 

The VDPA stands out through the private right of action granted to consumers, stricter requirements around the data of minors, and the data broker registration requirement and is set to become effective on July 1, 2025. 

The Vermont Data Privacy Act aims to give individuals more control over their personal information. Key features include:

• Data Minimization: Companies will be restricted to collecting only the data necessary for their services.
• Consumer Rights: Residents will have the ability to access, delete, and correct their data. They can also opt out of data sales and targeted advertising.
• Private Right of Action: This provision allows individuals to sue companies for violations of their privacy rights, providing a strong enforcement mechanism - a provision limited to large data brokers and businesses).

However, the tech industry has expressed strong opposition to the law, arguing that it creates undue burdens on businesses and hinders innovation. Major technology companies such as Meta, Google, and Amazon have opposed the bill arguing that the new law would hinder innovation and have a negative impact on businesses, whom they have encouraged to voice their opinion on the matter. Additionally, they have engaged in extensive lobbying efforts, including working with industry trade groups or urging Vermont’s Governor, Phil Scott, to veto the bill.

Monique Priestley, a Vermont State Representative for the Orange 2 District, stated the following in an article she authored on the topic: 

Giant tech companies including Meta, Google, and Amazon have a lot at stake as Vermont and other states move to strengthen protections for consumer data. Every social media post, search query, and digital footstep – including those of kids and teens – is worth money to these companies and drives their enormous profits. To prevent states from cutting off this firehose of data, Big Tech firms have mounted a relentless ground game to manipulate and confuse legislators.

Still, despite this opposition, Vermont legislators have pushed forward. They have collaborated with lawmakers from other states who have faced similar challenges, using these alliances to counteract the lobbying efforts aimed at weakening the bill. To address the concerns voiced by local businesses influenced by lobbyist groups, they sought to form alliances with other state legislators in the US who had also dealt with similar lobbying pressures, which resulted in the revealing of coordinated efforts by the tech industry to undermine privacy protections.

In the same article, Monique Priestley also explained the thought process behind the strict provisions contained by the VDPA: 

Learning from the experience of lawmakers in other states, we refined the language of our privacy bill and chose to retain a critical provision called a “private right of action” that will allow Vermont residents to sue tech companies over privacy violations. Throughout the process, we were fully aware that we could set precedents for future state and national efforts to protect consumer data. [...] 

Tech companies want to continue enjoying the regulation-free environment that has allowed them to grow to monopoly scale with little regard for the privacy of their users. State lawmakers may not have the resources of those tech giants, but we have seen the real-world impact of identity theft, scams, and deepfake pornography on our constituents and understand the need for robust privacy protections. Now, we have a chance to make those protections a reality.

The Vermont data privacy law represents a significant development in the ongoing debate over consumer privacy in the digital age. To date, Governor Scott has not yet indicated his decision on the bill. However, it is  enacted, the Vermont Data Privacy Act will become one of the strongest data privacy laws in the United States, second only to California's CCPA and is expected to be a model for other US states that are looking to enhance their data privacy regulations.