The Vermont Statehouse has enacted one of the strongest data privacy measures in the country, aimed at cracking down on companies’ use of online personal data. This legislation allows consumers to file civil lawsuits against companies that violate certain privacy rules. However, Republican Governor Phil Scott has expressed concerns about how part of the legislation could affect small businesses.
The bill prohibits the sale of sensitive data, such as social security and drivers’ license numbers, financial or health information. It also sets meaningful limits on the amount of personal data that companies can collect and use, according to the nonprofit Electronic Privacy Information Center based in Washington, D.C.
A key provision of the legislation is the right of consumers to sue, which has been deemed by experts as the most effective way to ensure that companies comply with privacy laws. This provision will come into effect in 2026 and sunset in 2028, with a study to assess its effectiveness and risks.
In response to concerns raised by the governor and the Vermont Chamber of Commerce about the impact on small businesses, legislators have limited the right to sue to violations by data brokers and large data holders. Data brokers are companies that derive a majority of their revenue from selling data, while large data holders process data from 100,000 or more Vermonters annually.
The bill also includes provisions aimed at protecting children’s online privacy, including measures to minimize addictive features and limit data collection. These provisions are based on previous legislation and are intended to enhance safety for young users.
Vermont’s data privacy law is among the most comprehensive in the nation, echoing similar measures recently enacted in Maryland. These laws reflect a growing recognition of the importance of protecting consumer privacy in the digital age.
