Advocates say data privacy bill will do little to protect Vermont consumers

A data privacy bill headed to the desk of Republican Gov. Phil Scott will do little to protect Vermonters from the ravages of Big Tech, according to state and national advocates.

A yearslong battle between privacy hawks and the business community ended in the latter’s favor this year when lawmakers gave final approval to what will soon become Vermont’s first-ever comprehensive data privacy law.

The bill, which won unanimous approval in the Senate and got only three ‘no’ votes in the House, gives Vermonters the right to know what information is being collected about them, the ability to correct inaccurate data and the right to opt out of having their data sold.

“I know that this is just the beginning of our work to protect all Vermonters from the increasingly predatory practices of advertisers, marketers and Big Tech,” said Williston Rep. Angela Arsenault, a Democrat. “Your data is yours to own and keep.”

Advocates such as Zach Tomanelli, with the Vermont Public Interest Research Group, wanted far stronger guardrails on a global data industry that generates hundreds of billions of dollars annually from the sale of phone numbers, location histories, political affiliations, health conditions and other information.

“From our standpoint, this is a bill that does not meaningfully advance consumer data privacy protections, unfortunately,” Tomanelli said.

VPIRG and other groups including the Electronic Privacy Information Center and Consumer Reports say the legislation lacks three key provisions. One would prohibit companies from collecting any information unrelated to the service they’re providing — so a weather app, for instance, could collect your location data, but not your financial records or religious affiliation.

They also wanted a blanket prohibition on the collection and sale of sensitive personal information, such as biometric data or sexual orientation. And they wanted what’s known as a “private right of action,” which would allow Vermonters to sue technology companies that misuse their data.

Matt Schwartz, with Consumer Reports, said data has become “the oil of the Big Tech industry.”

“And if they have less of it, they’re going to have less power to manipulate our democracy and outcompete small businesses and any other kind of maladies that I think a lot of us feel in our day to day.”

The data privacy framework approved by lawmakers this year, Schwartz said, is worse than if they passed nothing at all.

“Because it gives people a false sense of security and privacy, frankly,” he said. “There’s so many loopholes, there’s such little substance to it, and there’s such little recourse for an individual to actually take action if their rights have been violated.”

Megan Sullivan, with the Vermont Chamber of Commerce, said provisions aimed at Big Tech would have added “insurmountable costs” and technical complexity for Vermont’s small- and mid-sized businesses.

The version of the bill favored by data privacy advocates, she said, contained novel provisions that would have made Vermont a “first-in-the-nation” outlier. About 20 states have adopted data privacy laws, and Vermont lawmakers landed on a version modeled largely after Connecticut’s.

“We’re open to this new type of regulation,” Sullivan said. “But let’s do it in a way that is compatible with what other states do.”

Brian Stevenson

/

Vermont Public

Winooski Rep. Chloe Tomlinson, a Progressive/Democrat, decried “the Big Tech interests that influenced this bill.”

“It gives the appearance of taking action while still allowing for Big Tech companies to continue to extract resources and wreak havoc here in Vermont and across the country,” she said.

Coventry Rep. Michael Marcotte, the Republican chair of the House Committee on Commerce and Economic development, said he personally supports more robust privacy protections. But he said the governor vetoed a 2024 bill that more closely followed the framework favored by advocates.

“What do we really want? Do we want to start a basis for data privacy in Vermont to protect Vermonters and protect Vermont businesses? Or are we going to take the chance that we lose this again? That’s our choice,” Marcotte said.

Scott said last week that he expects to sign the bill when it reaches his desk.