• by Wendy Davis  @wendyndavis, May 13, 2024

Vermont lawmakers early Saturday morning passed a comprehensive privacy bill that would limit the amount of data that companies can collect, impose restrictions on online ad targeting, and allow consumers to bring private lawsuits in some circumstances.

If enacted, the bill would require companies to enable consumers to opt out of targeted advertising -- meaning ads served based on non-sensitive data collected across distinctly branded sites or apps.

The measure also would explicitly obligate companies to honor opt-outs made through mechanisms like the Global Privacy Control, which transmits opt-out requests to every site consumers visit.

The legislation also would prohibit companies from collecting or harnessing sensitive data -- including biometrics, location data and information that reveals consumers' race, religion, citizenship, sexual orientation or health -- without opt-in consent.

Data-minimization requirements would ban companies from gathering more information than “reasonably necessary and proportionate” to provide specific products or services requested by consumers.

The measure's most controversial provision would allow people who have been harmed by the collection or transfer of sensitive data to bring private lawsuits. 

The bill's exact wording -- including its provisions regarding lawsuits by consumers -- is expected to be available later this week.

The Association of National Advertisers plans to ask Governor Phil Scott to veto the bill.

"If signed into law, Vermont's privacy bill would be one of the most damaging in the nation, resulting in significant consumer harm, regulatory confusion, frivolous litigation, and economic injury to Vermont's small businesses,” Chris Oswald, executive vice president of the organization said Monday.

He adds that the provision enabling private lawsuits “would foment a flood of feckless filings, driving up costs for Vermont residents and businesses while enriching unscrupulous out-of-state trial lawyers.”

But advocacy groups Consumer Reports and the Electronic Privacy Information Center praised the measure, calling it stronger than other state privacy measures -- largely because it allows for private lawsuits.

“The inclusion of a private right of action in this law, while limited, is enormously significant,” Matt Schwartz, a policy analyst with Consumer Reports, stated. “It means that consumers who have been harmed by Big Tech’s data abuses will actually be granted the ability to defend their rights.”

State privacy laws in California, Illinois and Washington also allow individuals to sue over violations -- but in more limited circumstances.

For instance, California's privacy law allows consumers to sue over data breaches, while the law in Illinois authorizes lawsuits against companies that violate the state's biometric privacy law.

Unless vetoed, the Vermont measure will take effect in October 2025.